The previous combofix was a log file opened in notepad - here is the c:\combofix.txt -probably the same but wanted to make sure
ComboFix 08-05-26.2 - Shelley Simon 2008-05-27 10:25:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.170 [GMT -4:00]
Running from: C:\Documents and Settings\Shelley Simon\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Shelley Simon\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\windows\Downloaded Program Files\rave
C:\windows\Downloaded Program Files\rave\avirexe.vdm
C:\windows\Downloaded Program Files\rave\avirscr.vdm
C:\windows\Downloaded Program Files\rave\base.vdm
C:\windows\Downloaded Program Files\rave\daily.vdm
C:\windows\Downloaded Program Files\rave\daily.vdt
C:\windows\Downloaded Program Files\rave\filters.vdm
C:\windows\Downloaded Program Files\rave\kernel.vdk
C:\windows\Downloaded Program Files\rave\keyring.vdk
C:\windows\Downloaded Program Files\rave\mapi_vdm.vdm
C:\windows\Downloaded Program Files\rave\modules.vdk
C:\windows\Downloaded Program Files\rave\rav8def.vdm
C:\windows\Downloaded Program Files\rave\rufs.vdm
C:\windows\Downloaded Program Files\rave\rufsplg.vdm
C:\windows\Downloaded Program Files\rave\unarch.vdm
C:\windows\Downloaded Program Files\rave\unmail.vdm
C:\windows\Downloaded Program Files\rave\unpack.vdm
C:\windows\Downloaded Program Files\setup.dll
C:\windows\file.bat
C:\windows\system32\navdq.dat
.
((((((((((((((((((((((((( Files Created from 2008-04-27 to 2008-05-27 )))))))))))))))))))))))))))))))
.
2008-05-25 08:10 . 2008-05-25 08:23 <DIR> d-------- C:\autoruns
2008-05-21 16:02 . 2008-05-21 16:19 <DIR> d-------- C:\Program Files\PC Registry Cleaner
2008-05-21 16:01 . 2008-05-21 16:01 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-18 15:48 . 2008-05-23 12:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-05-18 15:46 . 2008-05-18 16:05 <DIR> d-------- C:\Program Files\Security Task Manager
2008-05-18 09:20 . 2008-05-18 09:21 <DIR> d-------- C:\WINDOWS\SYSTEM32\scripting
2008-05-18 09:20 . 2008-05-18 09:20 <DIR> d-------- C:\WINDOWS\SYSTEM32\en
2008-05-18 09:20 . 2008-05-18 09:20 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-18 08:55 . 2008-04-13 20:12 1,306,624 --------- C:\WINDOWS\SYSTEM32\msxml6.dll
2008-05-18 08:54 . 2001-08-09 19:37 457,607 -----c--- C:\WINDOWS\SYSTEM32\dllcache\mdlib.wmv
2008-05-18 08:53 . 2008-04-13 20:11 650,752 --------- C:\WINDOWS\SYSTEM32\dot3ui.dll
2008-05-16 12:27 . 2008-05-16 12:27 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-16 12:06 . 2008-05-16 12:22 <DIR> d-------- C:\Documents and Settings\Shelley Simon\.housecall6.6
2008-05-10 15:31 . 2008-05-11 19:45 <DIR> d-------- C:\Program Files\Google
2008-05-06 15:36 . 2008-05-06 15:37 <DIR> d-------- C:\Documents and Settings\Shelley Simon\Application Data\Move Networks
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-27 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-05-27 11:28 --------- d-----w C:\Program Files\ewido anti-malware
2008-05-23 11:54 --------- d-----w C:\Documents and Settings\Shelley Simon\Application Data\AVG7
2008-05-22 22:21 --------- d-----w C:\Program Files\RegCure
2008-05-22 10:38 --------- d-----w C:\Program Files\CCleaner
2008-05-18 23:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-18 13:23 77,824 ----a-w C:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\bin\WinVerifyTrust.dll
2008-05-18 13:23 731,136 ----a-w C:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\bin\motdeusr.zip
2008-05-18 13:23 49,152 ----a-w C:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\bin\PCHI18N.dll
2008-05-18 13:23 420,432 ----a-w C:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\bin\pchplugin.zip
2008-05-18 13:23 155,648 ----a-w C:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\bin\PCHButton.exe
2008-05-18 13:23 126,976 ----a-w C:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\bin\ContentUpdater.exe
2008-05-18 13:23 122,880 ----a-w C:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\bin\SearchCtrl.dll
2008-05-18 13:23 106,496 ----a-w C:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\bin\PluginCtrl.dll
2008-05-16 23:27 --------- d-----w C:\Program Files\PC-Doctor for Windows XP
2008-05-16 15:55 --------- d-----w C:\Program Files\Java
2008-05-16 15:54 --------- d-----w C:\Program Files\Common Files\Java
2008-04-14 09:42 985,088 ----a-w C:\windows\SYSTEM32\setupapi.dll
2008-04-14 09:42 11,264 ----a-w C:\windows\SYSTEM32\spnpinst.exe
2008-04-14 09:41 423,936 ----a-w C:\windows\SYSTEM32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\windows\SYSTEM32\dcache.bin
2008-04-14 00:16 329,728 ----a-w C:\windows\SYSTEM32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\windows\SYSTEM32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\windows\SYSTEM32\rdpwsx.dll
2008-04-14 00:13 40,840 ----a-w C:\windows\system32\drivers\termdd.sys
2008-04-14 00:13 299,520 ----a-w C:\windows\SYSTEM32\drmclien.dll
2008-04-14 00:13 21,896 ----a-w C:\windows\system32\drivers\tdtcp.sys
2008-04-14 00:13 139,656 ----a-w C:\windows\system32\drivers\rdpwd.sys
2008-04-14 00:13 12,168 ----a-w C:\windows\SYSTEM32\tsddd.dll
2008-04-14 00:13 12,040 ----a-w C:\windows\system32\drivers\tdpipe.sys
2008-04-14 00:11 997,376 ----a-w C:\windows\SYSTEM32\msgina.dll
2008-04-14 00:10 53,279 ----a-w C:\windows\SYSTEM32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\windows\SYSTEM32\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\windows\SYSTEM32\msafd.dll
2008-04-13 21:00 103,424 ----a-w C:\windows\SYSTEM32\dpcdll.dll
2008-04-13 19:30 1,845,632 ----a-w C:\windows\SYSTEM32\win32k.sys
2008-04-13 19:28 175,744 ----a-w C:\windows\system32\drivers\rdbss.sys
2008-04-13 19:27 2,188,928 ----a-w C:\windows\SYSTEM32\ntoskrnl.exe
2008-04-13 19:21 162,816 ----a-w C:\windows\system32\drivers\netbt.sys
2008-04-13 19:20 91,520 ----a-w C:\windows\system32\drivers\ndiswan.sys
2008-04-13 19:20 361,344 ----a-w C:\windows\system32\drivers\tcpip.sys
2008-04-13 19:20 182,656 ----a-w C:\windows\system32\drivers\ndis.sys
2008-04-13 19:19 75,264 ----a-w C:\windows\system32\drivers\ipsec.sys
2008-04-13 19:19 51,328 ----a-w C:\windows\system32\drivers\rasl2tp.sys
2008-04-13 19:19 48,384 ----a-w C:\windows\system32\drivers\raspptp.sys
2008-04-13 19:19 146,048 ----a-w C:\windows\system32\drivers\portcls.sys
2008-04-13 19:19 138,112 ----a-w C:\windows\system32\drivers\afd.sys
2008-04-13 19:18 52,480 ----a-w C:\windows\system32\drivers\i8042prt.sys
2008-04-13 19:17 83,072 ----a-w C:\windows\system32\drivers\wdmaud.sys
2008-04-13 19:17 456,576 ----a-w C:\windows\system32\drivers\mrxsmb.sys
2008-04-13 19:17 105,344 ----a-w C:\windows\system32\drivers\mup.sys
2008-04-13 19:16 49,536 ----a-w C:\windows\system32\drivers\classpnp.sys
2008-04-13 19:16 141,056 ----a-w C:\windows\system32\drivers\ks.sys
2008-04-13 19:15 64,512 ----a-w C:\windows\system32\drivers\serial.sys
2008-04-13 19:15 60,800 ----a-w C:\windows\system32\drivers\sysaudio.sys
2008-04-13 19:15 574,976 ----a-w C:\windows\system32\drivers\ntfs.sys
2008-04-13 19:15 334,848 ----a-w C:\windows\system32\drivers\srv.sys
2008-04-13 19:14 63,744 ----a-w C:\windows\system32\drivers\cdfs.sys
2008-04-13 19:14 143,744 ----a-w C:\windows\system32\drivers\fastfat.sys
2008-04-13 19:00 30,080 ----a-w C:\windows\system32\drivers\modem.sys
2008-04-13 19:00 225,664 ----a-w C:\windows\system32\drivers\tcpip6.sys
2008-04-13 19:00 19,072 ----a-w C:\windows\system32\drivers\tdi.sys
2008-04-13 18:57 41,472 ----a-w C:\windows\system32\drivers\raspppoe.sys
2008-04-13 18:57 40,576 ----a-w C:\windows\system32\drivers\ndproxy.sys
2008-04-13 18:57 34,560 ----a-w C:\windows\system32\drivers\wanarp.sys
2008-04-13 18:57 20,864 ----a-w C:\windows\system32\drivers\ipinip.sys
2008-04-13 18:57 152,832 ----a-w C:\windows\system32\drivers\ipnat.sys
2008-04-13 18:57 14,336 ----a-w C:\windows\system32\drivers\asyncmac.sys
2008-04-13 18:57 10,112 ----a-w C:\windows\system32\drivers\ndistapi.sys
2008-04-13 18:56 88,320 ----a-w C:\windows\system32\drivers\nwlnkipx.sys
2008-04-13 18:56 69,120 ----a-w C:\windows\system32\drivers\psched.sys
2008-04-13 18:56 35,072 ----a-w C:\windows\system32\drivers\msgpc.sys
2008-04-13 18:56 34,688 ----a-w C:\windows\system32\drivers\netbios.sys
2008-04-13 18:56 30,592 ----a-w C:\windows\system32\drivers\rndismpx.sys
2008-04-13 18:56 30,592 ----a-w C:\windows\system32\drivers\rndismp.sys
2008-04-13 18:56 12,800 ----a-w C:\windows\system32\drivers\usb8023x.sys
2008-04-13 18:56 12,800 ----a-w C:\windows\system32\drivers\usb8023.sys
2008-04-13 18:56 12,288 ----a-w C:\windows\system32\drivers\tunmp.sys
2008-04-13 18:55 202,624 ----a-w C:\windows\system32\drivers\rmcast.sys
2008-04-13 18:55 14,592 ----a-w C:\windows\system32\drivers\ndisuio.sys
2008-04-13 18:54 11,264 ----a-w C:\windows\system32\drivers\irenum.sys
2008-04-13 18:53 71,552 ----a-w C:\windows\system32\drivers\bridge.sys
2008-04-13 18:53 40,320 ----a-w C:\windows\system32\drivers\nmnt.sys
2008-04-13 18:53 36,608 ----a-w C:\windows\system32\drivers\ip6fw.sys
2008-04-13 18:53 264,832 ----a-w C:\windows\system32\drivers\http.sys
2008-04-13 18:51 61,824 ----a-w C:\windows\system32\drivers\nic1394.sys
2008-04-13 18:51 60,800 ----a-w C:\windows\system32\drivers\arp1394.sys
2008-04-13 18:51 59,904 ----a-w C:\windows\system32\drivers\atmarpc.sys
2008-04-13 18:51 55,808 ----a-w C:\windows\system32\drivers\atmlane.sys
2008-04-13 18:51 101,120 ----a-w C:\windows\system32\drivers\bthpan.sys
2008-04-13 18:45 60,160 ----a-w C:\windows\system32\drivers\drmk.sys
2008-04-13 18:44 81,664 ----a-w C:\windows\system32\drivers\videoprt.sys
2008-04-13 18:44 799,744 ----a-w C:\windows\system32\drivers\dmboot.sys
2008-04-13 18:44 20,992 ----a-w C:\windows\system32\drivers\vga.sys
2008-04-13 18:44 17,664 ----a-w C:\windows\SYSTEM32\watchdog.sys
2008-04-13 18:44 153,344 ----a-w C:\windows\system32\drivers\dmio.sys
2008-04-13 18:43 14,208 ----a-w C:\windows\system32\drivers\wacompen.sys
2008-04-13 18:43 12,672 ----a-w C:\windows\system32\drivers\mutohpen.sys
2008-04-13 18:41 52,352 ----a-w C:\windows\system32\drivers\volsnap.sys
2008-04-13 18:39 7,552 ----a-w C:\windows\system32\drivers\mskssrv.sys
2004-09-16 05:53 56,832 --sha-w C:\windows\qsacz.dll
2004-09-08 15:48 11,591 --sha-w C:\windows\vrdgb.dat
2004-08-20 02:15 56,832 --sha-w C:\windows\SYSTEM32\iupds.dll
2004-09-16 05:45 11,591 --sha-w C:\windows\SYSTEM32\jxuhu.dat
2004-09-08 13:33 3,063 --sha-w C:\windows\SYSTEM32\ldbox.dat
2004-10-02 22:12 0 -csha-w C:\windows\SYSTEM32\zeupz.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2008-04-13 20:12 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 20:12 1695232]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe" [2004-12-07 17:50 196608]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"CheckNetworkConnection"="C:\Program Files\Support.com\providerComcast\desktopdoctor.exe" [2005-05-15 10:06 1286144]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [2007-03-07 10:58 1773568]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 03:52 36975]
"SBCSTray"="C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SBCSTray.exe" [2007-12-21 16:30 698864]
"S3TRAY2"="S3tray2.exe" [2001-10-04 15:06 69632 C:\WINDOWS\SYSTEM32\S3tray2.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2001-06-15 19:34 212992]
"KBD"="C:\HP\KBD\KBD.EXE" [2001-07-06 18:56 61440]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 13:04 52736]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-04 14:32 196608]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2001-08-07 20:36 90112]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-14 09:39 579584]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-26 10:04 219136]
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
AutoPlay.exe [2001-09-17 15:22:52 36864]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
CARD Monitor.lnk - C:\Program Files\Panasonic\Palmcorder\CARD LINK (for USB)\regcnt09.exe [2002-01-13 11:02:17 32768]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\htproc]
htproc32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssldr]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\support.com\\bin\\tgcmd.exe"=
"C:\\Program Files\\Java\\jdk1.5.0_04\\jre\\bin\\java.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1850:UDP"= 1850:UDP:Windows Media Format SDK (iexplore.exe)
"1851:UDP"= 1851:UDP:Windows Media Format SDK (iexplore.exe)
R0 SBHR;SBHR;C:\windows\system32\drivers\sbhr.sys [2008-02-08 09:46]
R3 SBAPIFS;SBAPIFS;C:\windows\system32\drivers\sbapifs.sys []
S1 i386p;i386p;C:\windows\system32\drivers\i386p.sys []
S2 MKEMUSB;Panasonic Digital Palmcorder;C:\windows\system32\Drivers\Mkemusb.sys [2001-08-08 18:52]
S3 CSVirtA;Cisco Systems SSL VPN Adapter;C:\windows\system32\DRIVERS\CSVirtA.sys [2008-03-04 16:57]
S3 DCamUSBMke;USB Video Camera for Panasonic Digital Palmcorder;C:\windows\system32\Drivers\Mkeusbi.sys [2001-12-18 11:38]
S3 OracleAgent80;OracleAgent80;C:\orant\agentbin\DBSNMP.EXE [1998-06-12 09:52]
S3 OracleClientCache80;OracleClientCache80;C:\orant\BIN\ONRSD80.EXE [1998-06-10 07:43]
S3 OracleCMAdminService80;OracleCMAdminService80;C:\orant\BIN\CMADM80.EXE [1998-06-10 07:47]
S3 OracleCManService80;OracleCManService80;C:\orant\BIN\CMGW80.EXE [1998-06-10 07:47]
S3 OracleDataGatherer;OracleDataGatherer;C:\orant\bin\vppdc.exe [1998-06-26 08:29]
S3 OracleExtprocAgent;OracleExtprocAgent;C:\orant\BIN\EXTPROCT.EXE extproc []
S3 OracleNamesService80;OracleNamesService80;C:\orant\BIN\NAMES80.EXE [1998-06-10 07:43]
S3 OracleServiceORC0;OracleServiceORC0;c:\orant\bin\oracle80.exe ORC0 []
S3 OracleServiceORCL;OracleServiceORCL;c:\orant\bin\oracle80.exe ORCL []
S3 OracleStartORC0;OracleStartORC0;C:\orant\BIN\strtdb80.exe [1997-10-27 23:42]
S3 OracleStartORCL;OracleStartORCL;C:\orant\BIN\strtdb80.exe [1997-10-27 23:42]
S3 OracleTNSListener80;OracleTNSListener80;C:\orant\BIN\TNSLSNR80.EXE [1998-06-10 07:43]
S3 PCDRDRV;Pcdr Helper Driver;C:\windows\system32\drivers\PCDRDRV.sys []
*Newly Created Service* - CATCHME
*Newly Created Service* - SBAPIFS
.
Contents of the 'Scheduled Tasks' folder
"2008-05-27 10:51:41 C:\windows\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-05-15 09:53:22 C:\windows\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-05-27 10:27:23
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\windows\Prairie Wind.bmp:tfppr 56832 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
Completion time: 2008-05-27 10:29:38
ComboFix-quarantined-files.txt 2008-05-27 14:29:31
Pre-Run: 93,124,493,312 bytes free
Post-Run: 93,733,396,480 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\windows
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\windows="microsoft windows xp home edition" /fastdetect /noexecute=alwayoff
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
260 --- E O F --- 2008-05-18 23:55:48