Combofix log

sueb75 · 10-26-2009, 01:24 AM

Hi, sorry if this is in the wrong place, or not explained properly. After having several problems with my computer, windows messenger displaying an error message each time I try to sign in, adaware doing the same, and malwarebytes also, I assume there is some sort of infection/problem going on. I have done av (eset) which came up with nothing. I was advised to run combofix, I now have a log, but have no clue what to do with it. Could anyone help?
Thank you in advance
Sue

ComboFix 09-10-25.01 - Sue 25/10/2009 22:58.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1394 [GMT 0:00]
Running from: c:\documents and settings\Sue\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Sue\Application Data\inst.exe
c:\windows\kb913800.exe
c:\windows\msa.exe
c:\windows\system32\oem119.inf
D:\Autorun.inf

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\eventlog.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

((((((((((((((((((((((((( Files Created from 2009-09-25 to 2009-10-25 )))))))))))))))))))))))))))))))
.

2009-10-25 22:31 . 2009-10-25 22:31 -------- d-----w- c:\program files\Microsoft
2009-10-25 22:30 . 2009-10-25 22:31 -------- d-----w- c:\program files\Windows Live
2009-10-08 21:09 . 2009-10-08 21:09 -------- d-----w- c:\documents and settings\Sue\Application Data\Malwarebytes
2009-10-08 21:09 . 2009-10-08 21:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-02 20:01 . 2009-10-02 20:01 -------- d-----w- c:\documents and settings\Guest\Application Data\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-25 22:57 . 2009-09-21 21:55 0 ----a-w- c:\windows\win32k.sys
2009-10-25 18:31 . 2006-12-26 13:29 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-10-22 20:14 . 2007-01-24 07:37 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-17 10:08 . 2007-03-16 17:09 -------- d-----w- c:\documents and settings\Sue\Application Data\BitTorrent
2009-10-06 21:31 . 2006-09-12 03:42 91200 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-04 08:18 . 2009-09-24 13:35 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-04 08:18 . 2008-06-22 09:50 -------- d-----w- c:\program files\SpywareBlaster
2009-09-26 09:49 . 2007-08-24 20:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-09-25 20:59 . 2009-09-25 20:59 -------- d-----w- c:\documents and settings\Sue\Application Data\ESET
2009-09-25 20:58 . 2009-09-25 20:58 -------- d-----w- c:\program files\ESET
2009-09-25 20:58 . 2009-09-25 20:58 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-09-25 20:44 . 2008-05-23 15:06 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-25 20:44 . 2007-08-24 21:02 -------- d-----w- c:\program files\VS Revo Group
2009-09-24 18:32 . 2008-09-21 19:23 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-24 18:30 . 2008-09-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-24 16:01 . 2009-09-24 16:01 -------- d-----w- c:\program files\MSSOAP
2009-09-24 16:00 . 2009-09-24 16:00 -------- d-----w- c:\program files\Webroot
2009-09-24 15:54 . 2009-09-24 15:54 164 ----a-w- c:\windows\install.dat
2009-09-22 21:46 . 2009-03-11 20:10 -------- d-----w- c:\program files\LimeWire
2009-09-22 21:42 . 2009-09-22 21:35 -------- d-----w- c:\program files\Common Files\Macromedia
2009-09-22 21:42 . 2009-09-22 21:35 -------- d-----w- c:\program files\Macromedia
2009-09-22 21:33 . 2009-03-11 20:12 -------- d-----w- c:\documents and settings\Sue\Application Data\LimeWire
2009-09-21 21:17 . 2009-09-21 21:17 -------- d-----w- c:\program files\Adobe Media Player
2009-09-21 21:10 . 2009-09-21 21:10 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-09-16 21:21 . 2008-11-19 20:05 -------- d-----w- c:\program files\RescuePRO Deluxe DEMO
2009-09-11 06:26 . 2009-09-11 06:26 55768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2009-09-11 06:26 . 2009-09-11 06:26 135048 ----a-w- c:\windows\system32\drivers\epfw.sys
2009-09-11 06:23 . 2009-09-11 06:23 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-09-11 06:17 . 2009-09-11 06:17 116008 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-09-10 17:12 . 2008-04-13 21:44 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-08 13:42 . 2009-09-08 13:42 -------- d-----w- c:\program files\Common Files\Sony Ericsson
2009-09-08 13:42 . 2008-06-20 18:10 -------- d-----w- c:\program files\Sony Ericsson
2009-09-08 13:41 . 2008-06-20 18:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Ericsson
2009-09-08 13:14 . 2009-09-08 13:14 148736 ----a-w- c:\documents and settings\All Users\Application Data\hpe32A.dll
2009-09-08 13:13 . 2006-09-12 10:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-22 11:55 . 2008-05-23 15:06 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-22 11:55 . 2008-05-23 15:06 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-22 11:55 . 2008-05-23 15:06 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-16 09:26 . 2009-05-04 18:38 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 09:01 . 2006-03-16 04:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2006-12-25 23:23 . 2006-12-25 23:23 251 ----a-w- c:\program files\wt3d.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-07-13 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 221184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-08-14 98304]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-02 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2054360]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-06-02 61952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-7 113664]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-12-25 962663]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-22 11:55 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MioSync.lnk]
backup=c:\windows\pss\MioSync.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"HP Software Update"=c:\program files\Hp\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxcecoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxcepswx.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Sony Ericsson\\SEMC OMSI Module\\SEMC OMSI Module.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [23/05/2008 15:06 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [23/05/2008 15:06 108552]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11/09/2009 06:23 108792]
R1 myWIFIzone;myWIFIzone Driver;c:\windows\system32\drivers\myWIFIzone.sys [22/12/2005 21:45 19712]
R2 BOCore;BOCore;c:\program files\Comodo\CBOClean\BOCore.exe [15/08/2008 06:32 73464]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [11/09/2009 06:24 735960]
R2 EmmaDevMgmtSvc;Emma Device Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe [26/08/2009 15:51 306296]
R2 EmmaUpdMgmtSvc;Emma Update Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe [26/08/2009 15:51 162936]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [06/05/2007 16:35 114024]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe --> c:\progra~1\AVG\AVG8\avgemc.exe [?]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [05/07/2008 06:40 297752]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [08/09/2009 13:13 90112]
S3 Asompmsark1.43;Asompmsark1.43; [x]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [21/06/2008 07:18 13224]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [17/01/2009 17:25 89256]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [17/01/2009 17:25 86824]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [17/01/2009 17:25 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [17/01/2009 17:25 114600]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [17/01/2009 17:25 108328]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [17/01/2009 17:25 26024]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [17/01/2009 17:25 104616]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [17/01/2009 17:25 109736]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [08/09/2009 13:14 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [08/09/2009 13:14 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [08/09/2009 13:14 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [08/09/2009 13:14 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [08/09/2009 13:14 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [08/09/2009 13:14 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [08/09/2009 13:14 109864]
.
Contents of the 'Scheduled Tasks' folder

2009-09-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = 127.0.0.1:8080
uInternet Settings,ProxyOverride = local;*.local
FF - ProfilePath - c:\documents and settings\Sue\Application Data\Mozilla\Firefox\Profiles\dmvt7vh0.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - component: c:\documents and settings\Sue\Application Data\Mozilla\Firefox\Profiles\dmvt7vh0.default\extensions\keyscrambler@qfx.software.corporation\components\KeyScramblerIE.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-25 23:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ???????????g?@?????L?@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(316)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\system32\msdtc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\mqtgsvc.exe
c:\combofix\CF22159.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Java\jre6\bin\jucheck.exe
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-25 23:20 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-25 23:20

Pre-Run: 13,104,791,552 bytes free
Post-Run: 13,396,901,888 bytes free

- - End Of File - - 9B67DE6439C3CFE67C4029C8514AF73C

Ried · 10-26-2009, 09:53 AM

Hello Sue and welcome.

Who advised you to run ComboFix?

sueb75 · 10-27-2009, 02:57 PM

Hi, and thank you for the welcome. It was guy at work, who I'm told is pretty good with computers.

I haven't seen him since, so have so far been unable to ask his opinion.

Sue

Ried · 10-27-2009, 04:16 PM

Thank you. Please, in the future, when a friend or coworker etc., tells you to 'run this tool' do check the warnings and guidelines as stated within the tool. ComboFix specifically mentions that it should only be run under supervision.

Download Junction.zip and save it to your desktop. Double click the junction.zip and extract to your desktop.

Next, open Notepad and copy/paste the contents in the quote box below, into Notepad.

Quote:

junction -s c:\ > log.txt
notepad log.txt
exit

Save this as junction.bat Choose to "Save type as - All Files" and save it to your desktop.

It should look like this:

Double click Junction folder to open it.
Now drag the junction.bat into the Junction folder
Double click the junction.bat and allow it to run - it can take a while to complete, so be patient.

Post the log it produces

Ried · 11-04-2009, 08:40 PM

Due to lack of response, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic.

10-26-2009, 09:53 AM	#2 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,886 OS: WinXP and Vista	Re: Combofix log Hello Sue and welcome. Who advised you to run ComboFix? __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

10-27-2009, 02:57 PM	#3 (permalink)
sueb75 Registered User Join Date: Oct 2009 Posts: 2 OS: winxp	Re: Combofix log Hi, and thank you for the welcome. It was guy at work, who I'm told is pretty good with computers. I haven't seen him since, so have so far been unable to ask his opinion. Sue

11-04-2009, 08:40 PM	#5 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,886 OS: WinXP and Vista	Re: Combofix log Due to lack of response, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."