Thanks
tetonbob for the responce. I have followed the instructions to the best of my ability. attached is the combofix log you requested. Thank You in advance for your kind attention to this matter.
ComboFix 08-12-05.02 - David Burns 2008-12-05 20:10:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.645 [GMT -6:00]
Running from: c:\documents and settings\David Burns\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Barbara Burns\Application Data\ShoppingReport
c:\documents and settings\Barbara Burns\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\Barbara Burns\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\Barbara Burns\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\Barbara Burns\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\Barbara Burns\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\Barbara Burns\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\Barbara Burns\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
c:\program files\INSTALL.LOG
c:\windows\system32\drivers\fad.sys
.
((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))
.
2008-12-05 17:19 . 2008-12-05 17:19 118,276 --a------ c:\windows\SYSTEM32\msxml71.dll.upd
2008-12-02 20:53 . 2008-12-02 20:53 250 --a------ c:\windows\gmer.ini
2008-11-30 19:52 . 2008-12-05 19:55 52,168 --a------ C:\VETlog.dmp
2008-11-25 20:24 . 2008-11-25 20:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-25 20:23 . 2008-11-25 20:23 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-25 19:43 . 2008-11-25 20:09 <DIR> d-------- c:\program files\NoAdware
2008-11-10 18:10 . 2008-11-10 18:12 <DIR> d-------- c:\program files\Microsoft MapPoint
2008-11-10 18:10 . 2008-11-10 18:12 <DIR> d-------- c:\program files\Microsoft Location Finder
2008-11-06 17:31 . 2008-11-06 17:31 <DIR> d-------- c:\program files\Signal Communications
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-26 02:24 --------- d-----w c:\program files\Lavasoft
2008-11-24 23:57 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2008-11-19 02:37 --------- d-----w c:\program files\QUICKENW
2008-11-18 23:09 --------- d-----w c:\program files\Common Files\Palo Alto Software
2008-11-15 01:28 --------- d-----w c:\program files\McAfee
2008-10-22 23:04 --------- d-----w c:\documents and settings\David Burns\Application Data\AdobeUM
2007-04-22 01:42 6,980,738 ----a-w c:\documents and settings\David Burns\HC4Installer.exe
2005-07-14 18:31 27,648 --sha-r c:\windows\SYSTEM32\AVSredirect.dll
2005-06-26 21:32 616,448 --sha-r c:\windows\SYSTEM32\cygwin1.dll
2005-06-22 04:37 45,568 --sha-r c:\windows\SYSTEM32\cygz.dll
2005-02-28 19:16 240,128 --sha-r c:\windows\SYSTEM32\x.264.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{971F630E-AD68-4d6e-B0C3-1C627AAC80F1}]
2008-03-03 17:26 635392 --a------ c:\program files\GamingSquared\Gaming2\G2IE_v1042.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U"="copy" [X]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"AOL Fast Start"="c:\program files\AOL 9.1a\AOL.EXE" [2008-03-06 50528]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-12-19 98304]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-01-13 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-01-13 114688]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
"HelpCenter"="c:\program files\Bellsouth\HelpCenter\bin\sprtcmd.exe" [2006-10-30 192512]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-26 185896]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2003-06-08 24576]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JPEG"= JPEGCODE.DLL
"VIDC.MJPG"= JPEGCODE.DLL
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Ulead Photo Express 4.0 SE Calendar Checker .lnk]
backup=c:\windows\pss\Ulead Photo Express 4.0 SE Calendar Checker .lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
--a------ 2002-12-17 11:28 684032 c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
--------- 2006-10-23 06:50 71216 c:\program files\Common Files\aol\ACS\AOLDial.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\G2]
--a------ 2008-03-03 17:26 1215664 c:\program files\GamingSquared\Gaming2\G2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-06-20 22:36 1207080 c:\program files\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2007-10-08 15:50 41824 c:\program files\Common Files\aol\1132229713\ee\aolsoftware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
--a------ 2003-10-23 05:36 45056 c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\monitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\aol\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\aol\\ACS\\AOLDial.exe"=
"c:\\Program Files\\America Online 9.0c\\waol.exe"=
"c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\aol\\1132229713\\ee\\aolsoftware.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\AOL 9.1a\\waol.exe"=
"c:\\Program Files\\Common Files\\aol\\1132229713\\ee\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26afe103-36db-11dd-827e-00038a000015}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-10-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]
2007-12-15 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.aol.com/
uLocal Page = \blank.htm
uInternet Settings,ProxyOverride = hxxp://localhost;
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd
O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-12-05 20:14:18
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-12-05 20:16:38
ComboFix-quarantined-files.txt 2008-12-06 02:16:24
Pre-Run: 59,257,073,664 bytes free
Post-Run: 59,458,002,944 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
d:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
163 --- E O F --- 2008-05-17 04:10:03