ComboFix 11-01-31.02 - Ship 02/05/2011 19:25:46.7.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.422 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\zzz.exe Command switches used :: c:\documents and settings\Ship\Desktop\CFScript.txt AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} FILE :: "c:\windows\Tasks\Ad-Aware Update (Weekly).job" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Lavasoft c:\program files\Lavasoft\Ad-Aware\AAWService.exe c:\program files\Lavasoft\Ad-Aware\AAWTray.exe c:\program files\Lavasoft\Ad-Aware\AAWWSC.exe c:\program files\Lavasoft\Ad-Aware\Ad-Aware.exe c:\program files\Lavasoft\Ad-Aware\Ad-Aware_manual_EN.chm c:\program files\Lavasoft\Ad-Aware\Ad-Aware_manual_FR.chm c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe c:\program files\Lavasoft\Ad-Aware\Ad-AwareCommand.exe c:\program files\Lavasoft\Ad-Aware\CEAPI.dll c:\program files\Lavasoft\Ad-Aware\dbghelp.dll c:\program files\Lavasoft\Ad-Aware\drivers\32\AAWDriverTool.exe c:\program files\Lavasoft\Ad-Aware\drivers\32\AAWDriverTool.exe.aawbak c:\program files\Lavasoft\Ad-Aware\drivers\32\AAWDriverTool.exp c:\program files\Lavasoft\Ad-Aware\drivers\32\AAWDriverTool.lib c:\program files\Lavasoft\Ad-Aware\drivers\32\DIFxAPI.dll c:\program files\Lavasoft\Ad-Aware\drivers\32\lbd.cat c:\program files\Lavasoft\Ad-Aware\drivers\32\lbd.cat.aawbak c:\program files\Lavasoft\Ad-Aware\drivers\32\lbd.inf c:\program files\Lavasoft\Ad-Aware\drivers\32\lbd.sys c:\program files\Lavasoft\Ad-Aware\drivers\32\lbd.sys.aawbak c:\program files\Lavasoft\Ad-Aware\drivers\64\AAWDriverTool.exe c:\program files\Lavasoft\Ad-Aware\drivers\64\AAWDriverTool.exe.aawbak c:\program files\Lavasoft\Ad-Aware\drivers\64\DIFxAPI.dll c:\program files\Lavasoft\Ad-Aware\drivers\64\lbd.cat c:\program files\Lavasoft\Ad-Aware\drivers\64\lbd.cat.aawbak c:\program files\Lavasoft\Ad-Aware\drivers\64\lbd.inf c:\program files\Lavasoft\Ad-Aware\drivers\64\lbd.sys c:\program files\Lavasoft\Ad-Aware\drivers\64\lbd.sys.aawbak c:\program files\Lavasoft\Ad-Aware\drivers\AAWDriverTool.exe c:\program files\Lavasoft\Ad-Aware\drivers\DIFxAPI.dll c:\program files\Lavasoft\Ad-Aware\drivers\lbd.cat c:\program files\Lavasoft\Ad-Aware\drivers\lbd.inf c:\program files\Lavasoft\Ad-Aware\drivers\lbd.sys c:\program files\Lavasoft\Ad-Aware\lavalicense.dll c:\program files\Lavasoft\Ad-Aware\lavamessage.dll c:\program files\Lavasoft\Ad-Aware\Lavasoft Homepage.url c:\program files\Lavasoft\Ad-Aware\lsdelete.exe c:\program files\Lavasoft\Ad-Aware\PrivacyClean.dll c:\program files\Lavasoft\Ad-Aware\Resources.dll c:\program files\Lavasoft\Ad-Aware\Resources\aa11.efp c:\program files\Lavasoft\Ad-Aware\Resources\aa14.efp c:\program files\Lavasoft\Ad-Aware\Resources\Carbon.eGL c:\program files\Lavasoft\Ad-Aware\Resources\Default.eGL c:\program files\Lavasoft\Ad-Aware\Resources\Gold.eGL c:\program files\Lavasoft\Ad-Aware\Resources\Orange.eGL c:\program files\Lavasoft\Ad-Aware\Resources\Sedona.eGL c:\program files\Lavasoft\Ad-Aware\Resources\wa11.efp c:\program files\Lavasoft\Ad-Aware\Resources\wa11b.efp c:\program files\Lavasoft\Ad-Aware\Resources\wa12.efp c:\program files\Lavasoft\Ad-Aware\Resources\wa12b.efp c:\program files\Lavasoft\Ad-Aware\Resources\wa14b.efp c:\program files\Lavasoft\Ad-Aware\Resources\wa14i.efp c:\program files\Lavasoft\Ad-Aware\Resources\wt12.efp c:\program files\Lavasoft\Ad-Aware\Resources\wt12b.efp c:\program files\Lavasoft\Ad-Aware\Resources\wt16b.efp c:\program files\Lavasoft\Ad-Aware\Resources\wt16bi.efp c:\program files\Lavasoft\Ad-Aware\Resources\wt20b.efp c:\program files\Lavasoft\Ad-Aware\Resources\wt20bi.efp c:\program files\Lavasoft\Ad-Aware\RPAPI.dll c:\program files\Lavasoft\Ad-Aware\savapibridge.dll c:\program files\Lavasoft\Ad-Aware\ShellExt.dll c:\program files\Lavasoft\Ad-Aware\ThreatWork.exe c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\AutoStart Manager.exe c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\settings.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\Skins\grey\gbottompic.bmp c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\Skins\grey\gbottompicp.bmp c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\Skins\grey\gtoppic.bmp c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\Skins\grey\gtoppicp.bmp c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\Skins\grey\skin.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\SO.dll c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\de.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\en.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\es.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\fr.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\it.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\ja.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\nl.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\pr.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\zh-cmn-Hans.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\translations\zh-cmn-Hant.xml c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Extras.LGFF c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\HostFileEditor.exe c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Lang\DE.lslang c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Lang\EN.lslang c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Lang\ES.lslang c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Lang\FL.lslang c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Lang\FR.lslang c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Lang\IT.lslang c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Lang\NL.lslang c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\Lang\PT.lslang c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\ProcessWatch.dll c:\program files\Lavasoft\Ad-Aware\Toolbox\LT\ProcessWatch.exe c:\program files\Lavasoft\Ad-Aware\unrar.dll c:\program files\Lavasoft\Ad-Aware\UpdateManager.dll c:\windows\Tasks\Ad-Aware Update (Weekly).job . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_Lavasoft_Ad-Aware_Service -------\Legacy_Lavasoft_Ad-Aware_Service -------\Service_Lavasoft Ad-Aware Service -------\Service_Lavasoft Ad-Aware Service ((((((((((((((((((((((((( Files Created from 2011-01-06 to 2011-02-06 ))))))))))))))))))))))))))))))) . 2011-02-01 19:28 . 2011-02-01 19:28 -------- d-----w- c:\documents and settings\Ship\Application Data\SUPERAntiSpyware.com 2011-02-01 19:28 . 2011-02-01 19:28 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2011-02-01 19:28 . 2011-02-01 19:28 -------- d-----w- c:\program files\SUPERAntiSpyware 2011-01-25 19:59 . 2011-01-25 19:59 -------- d-----w- c:\program files\Microsoft Silverlight . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-11-18 18:12 . 2008-07-01 18:57 81920 ----a-w- c:\windows\system32\isign32.dll 2010-11-09 14:52 . 2002-09-03 16:50 249856 ----a-w- c:\windows\system32\odbc32.dll 2010-10-14 02:28 . 2010-05-06 02:27 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK] @="{3c3f3c1a-9153-7c05-f938-622e7003894d}" [HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}] 2010-02-06 01:14 2871608 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2] @="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}" [HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}] 2010-02-06 01:14 2871608 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3] @="{b4caf489-1eec-c617-49ad-8d7088598c06}" [HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}] 2010-02-06 01:14 2871608 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-01-13 2424560] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "nwiz"="nwiz.exe" [2008-05-16 1630208] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928] "AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 684032] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2010-03-17 1565696] "VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2009-03-12 2303216] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-07 1848648] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-12-12 722256] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512] "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848] "McPvTray"="c:\program files\McAfee\Anti-Theft\McPvTray.exe" [2009-11-17 670312] "Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-12-22 1092872] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-11 421160] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360] QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2010-9-14 984352] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [12/30/2009 11:41 PM 64160] R0 McPvDrv;McPvDrv Driver;c:\windows\system32\drivers\McPvDrv.sys [11/17/2009 10:15 AM 63080] R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [5/5/2010 9:27 PM 84072] R1 MOBKFilter;MOBKFilter;c:\windows\system32\drivers\MOBK.sys [5/5/2010 9:29 PM 54776] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [5/5/2010 9:27 PM 271480] R2 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 7:49 AM 227232] R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [5/5/2010 9:27 PM 271480] R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [5/5/2010 9:27 PM 271480] R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [5/5/2010 9:28 PM 188136] R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\Mcafee\SystemCore\mfevtps.exe [5/5/2010 9:27 PM 141792] R2 MOBKbackup;McAfee Online Backup;c:\program files\McAfee Online Backup\MOBKbackup.exe [2/5/2010 8:14 PM 229688] R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [5/5/2010 9:27 PM 55840] R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [5/5/2010 9:27 PM 313288] R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [5/5/2010 9:27 PM 88544] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/22/2010 2:19 PM 136176] S3 DMService;Whale Component Manager;c:\windows\DOWNLO~1\DMService.exe [7/12/2008 1:05 PM 423576] S3 dsiarhwprog;dsiarhwprog;c:\windows\system32\drivers\dsiarhwprog.sys [5/23/2010 7:05 PM 29184] S3 efipsk;efipsk;\??\c:\docume~1\Ship\LOCALS~1\Temp\efipsk.sys --> c:\docume~1\Ship\LOCALS~1\Temp\efipsk.sys [?] S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [5/5/2010 9:27 PM 88544] S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [5/5/2010 9:27 PM 84264] --- Other Services/Drivers In Memory --- *Deregistered* - mfeavfk01 . Contents of the 'Scheduled Tasks' folder 2011-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-22 19:19] 2011-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-22 19:19] 2011-02-05 c:\windows\Tasks\vtscheduletask.job - c:\program files\McAfee\Supportability\MVT\MvtApp.exe [2011-02-01 19:25] . . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 IE: Free YouTube Download - c:\documents and settings\Ship\Application Data\DVDVideoSoftIEHelpers\youtubedownload.htm IE: Free YouTube to Mp3 Converter - c:\documents and settings\Ship\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm Trusted Zone: internet Trusted Zone: mcafee.com Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Ship\Application Data\Mozilla\Firefox\Profiles\mpjftknk.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - www.google.com FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p= FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: PDF Download: {37E4D8EA-8BDA-4831-8EA1-89053939A250} - %profile%\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF - Ext: 1-Click YouTube Video Downloader: [removed] - %profile%\extensions\[removed] FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor . - - - - ORPHANS REMOVED - - - - SafeBoot-Lavasoft Ad-Aware Service ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-02-05 19:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1060) c:\program files\SUPERAntiSpyware\SASWINLO.DLL c:\windows\system32\WININET.dll - - - - - - - > 'explorer.exe'(1564) c:\windows\system32\WININET.dll c:\progra~1\mcafee\SITEAD~1\saHook.dll c:\program files\McAfee Online Backup\MOBKshell.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\Motive\McciCMService.exe c:\program files\CDBurnerXP\NMSAccessU.exe c:\windows\system32\nvsvc32.exe c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe c:\program files\Common Files\McAfee\SystemCore\mcshield.exe c:\windows\system32\wscntfy.exe c:\windows\system32\rundll32.exe c:\windows\system32\RUNDLL32.EXE c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2011-02-05 19:43:32 - machine was rebooted ComboFix-quarantined-files.txt 2011-02-06 00:43 ComboFix2.txt 2011-02-05 00:36 ComboFix3.txt 2009-12-31 18:46 ComboFix4.txt 2009-12-31 18:34 ComboFix5.txt 2011-02-06 00:24 Pre-Run: 114,700,865,536 bytes free Post-Run: 114,565,128,192 bytes free - - End Of File - - 7A9E10DBDB0BBA49D9B4A87D28BEBEC6