Can someone review a combofix log

ComboFix 09-03-01.01 - sparzatka 2009-03-02 10:54:01.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2047.1426 [GMT -5:00]
Running from: c:\documents and settings\sparzatka\Desktop\ComboFix.exe
AV: Total Protection Service *On-access scanning disabled* (Updated)
 * Created a new restore point
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\docume~1\SPARZA~1\LOCALS~1\Temp\ntdll64.dll
c:\winnt\a3kebook.ini
c:\winnt\akebook.ini
c:\winnt\ANS2000.INI
c:\winnt\system32\dbxDgrevCheck.dll
c:\winnt\system32\dumphive.exe
c:\winnt\system32\frmwrk32.exe
c:\winnt\system32\ntdll64.exe
c:\winnt\system32\setup.ini
c:\winnt\system32\SrchSTS.exe
c:\winnt\system32\uninstall.exe
c:\winnt\system32\uniq.tll
c:\winnt\Tasks\dkhzlmjh.job
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
 
 
(((((((((((((((((((((((((   Files Created from 2009-02-02 to 2009-03-02  )))))))))))))))))))))))))))))))
.
 
2009-02-26 15:49 . 2001-08-17 13:28	714,698	--a------	c:\winnt\system32\dllcache\cbmdmkxx.sys
2009-02-26 15:49 . 2001-08-17 12:13	49,182	--a------	c:\winnt\system32\dllcache\cem56n5.sys
2009-02-26 15:49 . 2001-08-17 12:13	46,108	--a------	c:\winnt\system32\dllcache\cben5.sys
2009-02-26 15:49 . 2001-08-17 12:12	39,680	--a------	c:\winnt\system32\dllcache\cb325.sys
2009-02-26 15:49 . 2001-08-17 12:12	37,916	--a------	c:\winnt\system32\dllcache\cb102.sys
2009-02-26 15:49 . 2001-08-17 22:36	32,256	--a------	c:\winnt\system32\dllcache\diapi2NT.dll
2009-02-26 15:49 . 2001-08-17 12:13	27,164	--a------	c:\winnt\system32\dllcache\ce3n5.sys
2009-02-26 15:49 . 2001-08-17 12:13	22,044	--a------	c:\winnt\system32\dllcache\cem33n5.sys
2009-02-26 15:49 . 2001-08-17 12:13	22,044	--a------	c:\winnt\system32\dllcache\cem28n5.sys
2009-02-26 15:49 . 2001-08-17 12:13	21,530	--a------	c:\winnt\system32\dllcache\ce2n5.sys
2009-02-26 15:49 . 2008-02-12 03:13	8,192	--a------	c:\winnt\system32\dllcache\changer.sys
2009-02-26 15:49 . 2003-03-31 07:00	7,680	--a------	c:\winnt\system32\dllcache\cd20xrnt.sys
2009-02-26 15:47 . 2001-08-17 12:19	747,392	--a------	c:\winnt\system32\dllcache\adm8830.sys
2009-02-26 15:46 . 2008-02-12 04:04	2,188,928	--a------	c:\winnt\system32\dllcache\ntoskrnl.exe
2009-02-26 15:46 . 2001-08-17 13:28	762,780	--a------	c:\winnt\system32\dllcache\3cwmcru.sys
2009-02-26 15:46 . 2001-08-17 14:55	689,216	--a------	c:\winnt\system32\dllcache\3dfxvs.dll
2009-02-26 15:46 . 2001-08-17 12:48	148,352	--a------	c:\winnt\system32\dllcache\3dfxvsm.sys
2009-02-26 15:46 . 2001-08-17 14:56	66,048	--a------	c:\winnt\system32\dllcache\s3legacy.dll
2009-02-26 15:46 . 2008-02-12 03:13	12,288	--a------	c:\winnt\system32\dllcache\4mmdat.sys
2009-02-26 15:46 . 2003-03-31 07:00	11,264	--a------	c:\winnt\system32\dllcache\1394vdbg.sys
2009-02-25 17:30 . 2009-02-25 17:30	<DIR>	d--------	c:\program files\SiteAdvisor
2009-02-25 17:30 . 2009-02-26 15:43	<DIR>	d--------	c:\documents and settings\LocalService\Application Data\SiteAdvisor
2009-02-25 17:23 . 2009-02-25 17:23	<DIR>	d--------	c:\program files\McAfee
2009-02-25 16:33 . 2009-01-21 12:16	<DIR>	d--------	c:\documents and settings\sparzatka\Application Data\SiteAdvisor
2009-02-25 16:03 . 2006-12-05 17:17	240	--a------	c:\winnt\myClean.bat
2009-02-25 14:59 . 2009-02-25 16:33	<DIR>	d--------	c:\documents and settings\sparzatka\Application Data\Desktopicon
2009-02-24 11:15 . 2009-02-24 05:15	52,224	--a------	c:\winnt\system32\javame1.1.exe
2009-02-06 15:57 . 2009-02-06 15:58	1,908	--a------	c:\winnt\diagwrn.xml
2009-02-06 15:57 . 2009-02-06 15:58	1,908	--a------	c:\winnt\diagerr.xml
2009-02-06 13:11 . 2009-02-06 14:18	<DIR>	d--------	C:\Microsoft Winows 7 Beta 32 Bit
2009-02-06 13:10 . 2009-02-06 13:12	<DIR>	d--------	c:\documents and settings\sparzatka\Application Data\Download Manager
2009-02-05 15:11 . 2009-02-09 12:22	<DIR>	d--------	c:\documents and settings\All Users\Application Data\AMMYY
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-25 23:30	---------	d-----w	c:\program files\MOV to AVI MPEG WMV Converter
2009-02-25 22:30	---------	d-----w	c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-02-25 21:01	---------	d-----w	c:\program files\Symantec
2009-02-25 21:01	---------	d-----w	c:\program files\Common Files\Symantec Shared
2009-02-25 20:52	---------	d-----w	c:\documents and settings\All Users\Application Data\McAfee
2009-02-25 20:49	---------	d--h--w	c:\program files\InstallShield Installation Information
2009-02-20 22:14	---------	d-----w	c:\documents and settings\sparzatka\Application Data\U3
2009-01-27 17:22	---------	d-----w	c:\documents and settings\All Users\Application Data\ATI MMC
2009-01-27 15:16	---------	d-----w	c:\documents and settings\sparzatka\Application Data\gtk-2.0
2007-02-27 19:03	56,912	----a-w	c:\documents and settings\sparzatka\g2mdlhlpx.exe
2005-03-01 16:04	1,061,769	----a-w	c:\program files\CuteFTP.zip
2008-08-25 16:05	23	--sha-w	c:\winnt\system32\efdd2_z.dll
2007-11-30 16:32	56	--sh--r	c:\winnt\system32\F48807E1F1.sys
2007-11-30 16:33	3,350	--sha-w	c:\winnt\system32\KGyGaAvL.sys
2008-04-22 15:15	32,768	--sha-w	c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008042220080423\index.dat
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MVS Splash"="c:\program files\McAfee\Managed VirusScan\Agent\Splash.exe" [2008-01-22 468288]
"McAfee Managed Services Tray"="c:\program files\McAfee\Managed VirusScan\Agent\StartMyagtTry.exe" [2008-01-22 87360]
"SiteAdvisor"="c:\program files\SiteAdvisor\6173\SiteAdv.exe" [2007-08-28 36640]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-11-01 77824]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Cisco Systems VPN Client.lnk - c:\program files\Cisco Systems\VPN Client\vpngui.exe [2006-01-20 1524776]
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 1 (0x1)
"Btn_Back"= 1 (0x1)
"Btn_Forward"= 1 (0x1)
"Btn_Stop"= 1 (0x1)
"Btn_Refresh"= 1 (0x1)
"Btn_Home"= 1 (0x1)
"Btn_Search"= 2 (0x2)
"Btn_Favorites"= 1 (0x1)
"Btn_History"= 2 (0x2)
"Btn_Media"= 2 (0x2)
"Btn_Folders"= 2 (0x2)
"Btn_Fullscreen"= 1 (0x1)
"Btn_Tools"= 2 (0x2)
"Btn_MailNews"= 1 (0x1)
"Btn_Size"= 2 (0x2)
"Btn_Print"= 1 (0x1)
"Btn_Edit"= 2 (0x2)
"Btn_Discussions"= 2 (0x2)
"Btn_Cut"= 2 (0x2)
"Btn_Copy"= 2 (0x2)
"Btn_Paste"= 2 (0x2)
"Btn_Encoding"= 2 (0x2)
 
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
2002-02-15 09:51 24638 c:\winnt\system32\PCANotify.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YU12"= ATIYUV12.DLL 
"VIDC.PIM1"= pclepim1.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0[/u]\[u]0[/u]]
"Script"=router.cmd
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders	msapsspc.dll schannel.dll digest.dll msnsspc.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\McAfee\\Managed VirusScan\\Agent\\myAgtSvc.exe"=
 
R2 EngineServer;EngineServer;c:\program files\McAfee\Managed VirusScan\VScan\EngineServer.exe [2009-02-25 14144]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [2009-02-25 169280]
S1 32b957c0;32b957c0;c:\winnt\system32\drivers\32b957c0.sys --> c:\winnt\system32\drivers\32b957c0.sys [?]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 ACCSKMD;Canon Camera Storage Device;c:\winnt\system32\drivers\accskmd.sys [2003-05-13 32640]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\winnt\system32\drivers\teamviewervpn.sys [2008-01-25 25088]
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
 
2009-03-02 c:\winnt\Tasks\User_Feed_Synchronization-{B45B2CFA-750A-452B-B38E-71BC5DD4C2CD}.job
- c:\winnt\system32\msfeedssync.exe [2006-10-17 10:58]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.2.cab
.
 
**************************************************************************
 
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 11:06:01
Windows 5.1.2600 Service Pack 3, v.3311 NTFS
 
scanning hidden processes ...  
 
scanning hidden autostart entries ... 
 
scanning hidden files ...  
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'winlogon.exe'(1088)
c:\winnt\system32\Ati2evxx.dll
 
- - - - - - - > 'lsass.exe'(1144)
c:\winnt\system32\relog_ap.dll
.
------------------------ Other Running Processes ------------------------
.
c:\winnt\system32\ati2evxx.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\winnt\system32\HPZipm12.exe
c:\program files\SiteAdvisor\6173\SAService.exe
c:\program files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
c:\winnt\system32\WFXSVC.EXE
c:\program files\Symantec\WinFax\WFXMOD32.EXE
c:\winnt\system32\searchindexer.exe
c:\winnt\system32\searchprotocolhost.exe
c:\winnt\system32\ati2evxx.exe
c:\program files\McAfee\Managed VirusScan\Agent\myAgtTry.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe
c:\progra~1\HEWLET~1\DIGITA~1\PRODUC~1\bin\hprblog.exe
c:\winnt\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-03-02 11:10:52 - machine was rebooted
ComboFix-quarantined-files.txt  2009-03-02 16:10:49
 
Pre-Run: 21,314,072,576 bytes free
Post-Run: 21,343,592,448 bytes free
 
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
 
204	--- E O F ---	2008-12-02 13:09:47

Select allOpen in new window