ComboFix 09-06-21.01 - Administrator 06/21/2009 22:50.1 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.128.56 [GMT -4:00]
Running from: c:\documents and settings\Administrator.DAISY\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\arcldr.exe
C:\arcsetup.exe
c:\winnt\mainms.vpi
c:\winnt\megavid.cdt
c:\winnt\muotr.so
c:\winnt\system32\ebvhpfdd.ini
c:\winnt\system32\ehknqtwa.ini
c:\winnt\system32\ehknqtwa.ini2
c:\winnt\system32\hhyjmduj.ini
c:\winnt\system32\hljwugsf.bin
c:\winnt\system32\keddnweh.ini
c:\winnt\system32\myacivwy.ini
c:\winnt\system32\rgnrrvcq.ini
c:\winnt\system32\ulyceide.ini
c:\winnt\system32\uysfwmlf.ini
c:\winnt\system32\xsddgddk.ini
c:\winnt\Web\default.htt
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MSSECURITY1.209.4
-------\Legacy_PLUGPLAYRPC
((((((((((((((((((((((((( Files Created from 2009-05-22 to 2009-06-22 )))))))))))))))))))))))))))))))
.
2009-06-22 03:02 . 2009-06-22 03:02 16384 ----a-w- c:\winnt\system32\Perflib_Perfdata_1dc.dat
2009-06-18 00:27 . 2009-06-18 00:27 -------- d-----w- c:\documents and settings\All Users.WINNT\Application Data\Webroot
2009-06-17 20:54 . 2009-06-17 20:54 -------- d-----w- c:\documents and settings\All Users.WINNT\Application Data\Geek Squad
2009-06-15 19:00 . 2009-02-05 20:06 23152 ----a-w- c:\winnt\system32\drivers\aswRdr.sys
2009-06-15 19:00 . 2009-02-05 20:06 51376 ----a-w- c:\winnt\system32\drivers\aswTdi.sys
2009-06-15 19:00 . 2009-02-05 20:05 26944 ----a-w- c:\winnt\system32\drivers\aavmker4.sys
2009-06-15 19:00 . 2009-02-05 20:04 97480 ----a-w- c:\winnt\system32\AvastSS.scr
2009-06-15 18:59 . 2009-02-05 20:07 114768 ----a-w- c:\winnt\system32\drivers\aswSP.sys
2009-06-15 18:59 . 2009-02-05 20:08 94032 ----a-w- c:\winnt\system32\drivers\aswmon2.sys
2009-06-15 18:59 . 2009-02-05 20:08 93296 ----a-w- c:\winnt\system32\drivers\aswmon.sys
2009-06-15 18:58 . 2009-02-05 20:11 1256296 ----a-w- c:\winnt\system32\aswBoot.exe
2009-06-15 17:58 . 2009-06-15 17:58 0 ----a-w- c:\winnt\nsreg.dat
2009-06-15 17:58 . 2009-06-15 17:58 -------- d-----w- c:\documents and settings\Administrator.DAISY\Local Settings\Application Data\Mozilla
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-12 23:52 . 2009-02-22 20:09 3371383 ----a-w- c:\documents and settings\All Users.WINNT\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-10 22:16 . 2004-10-11 21:24 8482 ----a-w- c:\winnt\extend.dat
2009-05-26 17:20 . 2008-12-20 23:51 40160 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-05-26 17:19 . 2008-12-20 23:51 18456 ----a-w- c:\winnt\system32\drivers\mbam.sys
2009-05-05 22:54 . 2009-05-05 22:54 -------- d-----w- c:\documents and settings\All Users.WINNT\Application Data\McAfee
2009-05-02 12:37 . 2009-05-02 12:37 4096 ------w- c:\program files\AskSearch
2004-08-30 00:52 . 2000-05-02 19:00 21952 ---h--w- c:\program files\folder.htt
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-04 1809648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"D-Link AirPlus XtremeG"="c:\program files\D-Link\AirPlus XtremeG\AirPlusCFG.exe" [2004-09-22 987136]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-08-16 45056]
"Synchronization Manager"="mobsync.exe" - c:\winnt\system32\mobsync.exe [2003-06-19 111376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2003-06-19 186640]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 18:56 352256 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nwprovau]
2003-06-19 19:05 139536 ----a-w- c:\winnt\system32\NWPROVAU.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [12/4/2008 1:50 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/4/2008 1:50 PM 55024]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\winnt\system32\drivers\A3AB.sys [9/2/2004 9:01 PM 396480]
R3 EL90BC;3Com EtherLink XL B/C Adapter Driver;c:\winnt\system32\drivers\el90xbc5.sys [8/29/2004 8:03 PM 61712]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/4/2008 1:50 PM 7408]
R3 SiSV;SiSV;c:\winnt\system32\drivers\SiSV.sys [8/29/2004 8:03 PM 49904]
S3 NtApm;NT Apm/Legacy Interface Driver;c:\winnt\system32\drivers\NtApm.sys [8/29/2004 8:06 PM 9104]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - IPNAT
*NewlyCreated* - RASAUTO
*NewlyCreated* - SHAREDACCESS
.
- - - - ORPHANS REMOVED - - - -
Notify-cbXNHYpn - cbXNHYpn.dll
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
uStart Page = hxxp://www.google.com/
mWindow Title = Microsoft Internet Explorer provided by Comcast
mSearchMigratedDefaultURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
LSP: %SystemRoot%\system32\msafd.dll
Trusted Zone: safetydownload.com
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
FF - ProfilePath -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-06-21 23:03
Windows 5.0.2195 Service Pack 4 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(144)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\winnt\system32\wzcdlg.dll
c:\winnt\system32\WZCSAPI.DLL
- - - - - - - > 'explorer.exe'(984)
c:\winnt\AppPatch\AcLayers.DLL
c:\winnt\system32\SHDOCVW.DLL
c:\program files\Creative\Creative NOMAD Jukebox Zen Xtra\NOMAD Explorer\CTJBNS.DLL
c:\program files\Creative\Creative NOMAD Jukebox Zen Xtra\NOMAD Explorer\CTIntrfc.dll
c:\program files\Creative\Creative NOMAD Jukebox Zen Xtra\NOMAD Explorer\JBNSHK.dll
c:\program files\Creative\Creative NOMAD Jukebox Zen Xtra\NOMAD Explorer\JBNSRES.DLL
c:\winnt\system32\MSI.DLL
c:\program files\SUPERAntiSpyware\SASSEH.DLL
c:\program files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
.
Completion time: 2009-06-22 23:08 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-22 03:08
Pre-Run: 4,873,306,112 bytes free
Post-Run: 5,038,407,680 bytes free
139
my comp is running veryy slow and im suspicious plz help 
