ComboFix 09-05-03.6 - Mike 05/04/2009 13:48.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2038.1247 [GMT -4:00]
Running from: c:\users\Mike\Downloads\ComboFix.exe
Command switches used :: c:\users\Mike\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated)
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_CLTNetCnService
((((((((((((((((((((((((( Files Created from 2009-04-04 to 2009-05-04 )))))))))))))))))))))))))))))))
.
2009-05-04 14:43 . 2009-05-04 14:43 -------- d-----w c:\programdata\OnlineArmor
2009-05-04 14:43 . 2009-05-04 14:43 -------- d-----w c:\users\All Users\OnlineArmor
2009-05-04 14:43 . 2009-05-04 14:43 -------- d-----w c:\users\Mike\AppData\Roaming\OnlineArmor
2009-05-04 14:42 . 2009-04-16 09:49 31824 ----a-w c:\windows\system32\drivers\OAmon.sys
2009-05-04 14:42 . 2009-04-16 09:49 30800 ----a-w c:\windows\system32\drivers\OAnet.sys
2009-05-04 14:42 . 2009-04-16 09:49 196688 ----a-w c:\windows\system32\drivers\OADriver.sys
2009-05-04 14:42 . 2009-05-04 14:42 -------- d-----w c:\program files\Tall Emu
2009-05-04 13:08 . 2009-05-04 13:32 -------- d-----w c:\programdata\Comodo
2009-05-04 13:08 . 2009-05-04 13:32 -------- d-----w c:\users\All Users\Comodo
2009-05-04 13:08 . 2009-05-04 14:29 -------- d-----w c:\program files\COMODO
2009-05-04 13:03 . 2009-03-24 20:08 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-04 13:03 . 2009-05-04 13:03 -------- d-----w c:\program files\Avira
2009-05-04 13:03 . 2009-05-04 13:03 -------- d-----w c:\programdata\Avira
2009-05-04 13:03 . 2009-05-04 13:03 -------- d-----w c:\users\All Users\Avira
2009-05-01 16:54 . 2009-05-01 16:54 -------- d-----w c:\users\Mike\AppData\Local\Apple
2009-05-01 16:33 . 2009-05-01 16:34 -------- d-----w c:\users\Mike\AppData\Local\Adobe
2009-05-01 13:23 . 2009-05-01 13:23 -------- d--h--w c:\users\Mike\AppData\Local\acer eNM
2009-05-01 13:22 . 2009-05-01 16:53 -------- d-----w c:\users\Mike\AppData\Local\Apple Computer
2009-04-22 17:22 . 2009-04-22 17:24 -------- d-----w c:\windows\system32\SmitfraudFix
2009-04-17 03:34 . 2008-12-08 04:34 376832 ----a-w c:\windows\system32\winhttp.dll
2009-04-17 03:34 . 2008-06-05 04:50 500736 ----a-w c:\windows\system32\msdtcprx.dll
2009-04-17 03:34 . 2008-06-05 04:50 30208 ----a-w c:\windows\system32\xolehlp.dll
2009-04-17 03:34 . 2009-03-03 04:19 549888 ----a-w c:\windows\system32\rpcss.dll
2009-04-17 03:34 . 2009-03-03 04:24 3469280 ----a-w c:\windows\system32\ntoskrnl.exe
2009-04-17 03:34 . 2009-03-03 04:24 3503584 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-04-17 03:34 . 2009-03-03 02:40 654336 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-04-17 03:34 . 2009-03-03 04:19 158720 ----a-w c:\windows\system32\sdohlp.dll
2009-04-12 00:58 . 2009-05-01 15:27 -------- d---a-w c:\programdata\TEMP
2009-04-12 00:58 . 2009-05-01 15:27 -------- d---a-w c:\users\All Users\TEMP
2009-04-10 14:25 . 2009-04-17 15:58 -------- d-----w c:\programdata\rolivepa
2009-04-10 14:25 . 2009-04-10 14:25 -------- d-----w c:\programdata\wevetora
2009-04-10 14:25 . 2009-04-17 15:58 -------- d-----w c:\users\All Users\rolivepa
2009-04-10 14:25 . 2009-04-10 14:25 -------- d-----w c:\users\All Users\wevetora
2009-04-10 14:25 . 2009-04-10 14:25 -------- d-----w c:\programdata\wakosoli
2009-04-10 14:25 . 2009-04-10 14:25 -------- d-----w c:\users\All Users\wakosoli
2009-04-10 02:25 . 2009-04-10 02:25 -------- d-----w c:\programdata\hiyokovu
2009-04-10 02:25 . 2009-04-10 02:25 -------- d-----w c:\users\All Users\hiyokovu
2009-04-10 02:25 . 2009-04-10 14:25 -------- d-----w c:\programdata\zowepaba
2009-04-10 02:25 . 2009-04-10 14:25 -------- d-----w c:\users\All Users\zowepaba
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 15:12 . 2009-02-12 02:58 -------- d---a-w c:\program files\Cake Poker
2009-05-04 14:43 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstrng.dat
2009-05-04 14:43 . 2006-11-02 10:25 51200 ----a-w c:\windows\inf\infpub.dat
2009-05-04 14:43 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstor.dat
2009-05-01 12:16 . 2007-11-24 01:22 -------- d-----w c:\program files\Full Tilt Poker
2009-04-23 17:37 . 2007-11-27 03:12 -------- d-----w c:\program files\PokerStars
2009-04-22 17:23 . 2008-04-15 20:40 35 ----a-w c:\users\Mike\AppData\Roaming\SetValue.bat
2009-04-22 17:23 . 2008-04-15 20:40 691 ----a-w c:\users\Mike\AppData\Roaming\GetValue.vbs
2009-04-17 15:56 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-10 15:52 . 2007-12-07 05:11 -------- d-----w c:\program files\Google
2009-03-17 03:16 . 2009-04-17 03:33 14848 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:16 . 2009-04-17 03:33 25600 ----a-w c:\windows\system32\amxread.dll
2009-03-03 04:20 . 2009-04-17 03:33 826368 ----a-w c:\windows\system32\wininet.dll
2009-03-03 04:19 . 2009-04-17 03:33 24576 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:16 . 2009-04-17 03:33 56320 ----a-w c:\windows\system32\iesetup.dll
2009-03-03 04:16 . 2009-04-17 03:33 97280 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:16 . 2009-04-17 03:33 53248 ----a-w c:\windows\system32\iasads.dll
2009-03-03 04:16 . 2009-04-17 03:33 37888 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 04:16 . 2009-04-17 03:33 78336 ----a-w c:\windows\system32\ieencode.dll
2009-03-03 04:15 . 2009-04-17 03:33 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-03 02:08 . 2009-04-17 03:33 26624 ----a-w c:\windows\system32\ieUnatt.exe
2009-03-03 00:44 . 2009-04-17 03:33 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-02-13 07:26 . 2009-04-17 03:33 72704 ----a-w c:\windows\system32\secur32.dll
2009-02-13 07:26 . 2009-04-17 03:33 1233408 ----a-w c:\windows\system32\lsasrv.dll
2009-02-13 07:26 . 2009-04-17 03:33 7680 ----a-w c:\windows\system32\lsass.exe
2009-02-09 01:59 . 2009-03-11 04:11 2028032 ----a-w c:\windows\system32\win32k.sys
2008-12-13 08:11 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((( SnapShot@2009-04-30_14.07.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-04 12:58 . 2009-05-04 12:58 54272 c:\windows\winsxs\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_ecdf8c290e547f39\vcomp90.dll
+ 2009-05-04 12:58 . 2009-05-04 12:58 62976 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90RUS.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 46080 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90KOR.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 46592 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90JPN.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 64512 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90ITA.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 66048 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90FRA.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 65024 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90ESP.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 65024 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90ESN.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 56832 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90ENU.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 66560 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90DEU.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 39936 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90CHT.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 38912 c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1\MFC90CHS.DLL
+ 2009-05-04 12:58 . 2009-05-04 12:58 59904 c:\windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_dcc7eae99ad0d9cf\mfcm90u.dll
+ 2009-05-04 12:58 . 2009-05-04 12:58 59904 c:\windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_dcc7eae99ad0d9cf\mfcm90.dll
+ 2007-04-10 08:59 . 2009-05-04 17:26 64458 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-05-04 17:26 69772 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-11-24 03:02 . 2009-05-01 16:57 84661 c:\windows\System32\Macromed\Flash\uninstall_plugin.exe
+ 2009-05-04 14:42 . 2009-04-16 09:49 30800 c:\windows\System32\DriverStore\FileRepository\oanet.inf_812b2ea4\OAnet.sys
+ 2009-05-04 13:08 . 2009-05-04 13:08 68112 c:\windows\System32\DriverStore\FileRepository\inspect.inf_729f6358\inspect.sys
+ 2009-05-04 13:03 . 2009-02-13 16:50 28376 c:\windows\System32\drivers\ssmdrv.sys
+ 2009-05-04 13:03 . 2009-03-30 14:33 96104 c:\windows\System32\drivers\avipbb.sys
+ 2007-11-24 05:51 . 2009-05-01 16:53 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-11-24 05:51 . 2009-04-30 14:03 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-11-24 05:51 . 2009-05-01 16:53 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-11-24 05:51 . 2009-04-30 14:03 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-11-24 05:51 . 2009-05-01 16:53 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-11-24 05:51 . 2009-04-30 14:03 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-11-24 05:55 . 2009-05-04 17:26 9810 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1876173119-3738006576-1583403349-1000_UserData.bin
- 2009-04-30 13:26 . 2009-04-30 13:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-05-04 17:55 . 2009-05-04 17:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-04-30 13:26 . 2009-04-30 13:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-05-04 17:55 . 2009-05-04 17:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-05-04 12:58 . 2009-05-04 12:58 655872 c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada\msvcr90.dll
+ 2009-05-04 12:58 . 2009-05-04 12:58 572928 c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada\msvcp90.dll
+ 2009-05-04 12:58 . 2009-05-04 12:58 225280 c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada\msvcm90.dll
+ 2009-05-04 12:58 . 2009-05-04 12:58 161784 c:\windows\winsxs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_e29d1181971ae11e\ATL90.dll
- 2006-11-02 10:33 . 2009-04-30 13:31 618648 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-04 17:30 618648 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-04-30 13:31 104024 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-05-04 17:30 104024 c:\windows\System32\perfc009.dat
+ 2009-02-03 02:15 . 2009-02-03 02:15 240544 c:\windows\System32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2009-05-01 14:21 . 2009-05-01 14:21 262144 c:\windows\System32\config\TxR\NTUSER.DAT
+ 2009-05-01 14:20 . 2009-05-01 14:21 262144 c:\windows\System32\config\RegBack\NTUSER.DAT
+ 2009-05-01 14:20 . 2009-05-01 14:21 262144 c:\windows\System32\config\Journal\NTUSER.DAT
+ 2009-05-04 12:58 . 2009-05-04 12:58 3783672 c:\windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_dcc7eae99ad0d9cf\mfc90u.dll
+ 2009-05-04 12:58 . 2009-05-04 12:58 3768312 c:\windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_dcc7eae99ad0d9cf\mfc90.dll
- 2006-11-02 10:22 . 2009-04-17 16:23 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2006-11-02 10:22 . 2009-05-04 14:28 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2009-02-03 02:15 . 2009-02-03 02:15 3771296 c:\windows\System32\Macromed\Flash\NPSWF32.dll
+ 2008-02-16 11:01 . 2009-05-04 14:28 175391361 c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2006-11-02 2159104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 464168]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-12-08 614400]
"LogitechCommunicationsManager"="c:\program files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 304664]
"AcerOrbicamRibbon"="c:\program files\Acer\OrbiCam10\OrbiCam.exe" [2006-11-29 754712]
"LVCOMSX"="c:\program files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-11-29 244512]
"eDSMSNfix"="c:\acer\Empowering Technology\eDSMSNfix.exe" [2007-02-08 13312]
"Acer Product Registration"="c:\program files\Acer Registration\ACE1.exe" [2007-02-02 3383296]
"Acer Assist Launcher"="c:\program files\Acer Assist\launcher.exe" [2007-02-02 1261568]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-01-17 151552]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-12-12 185896]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-23 116040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\OAui.exe" [2009-04-16 2044104]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-01 4390912]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-4-10 528384]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=eNetHook.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{61D6F5A3-DAD3-4E8C-9CE5-63523CC49926}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{F92F3B7D-937B-4CE2-AE67-C63A3EC4BEBC}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
"{2564132A-89FC-4665-A9A2-1559BF33012E}"= c:\program files\Acer Arcade Deluxe\VideoMagician\MagicDirector.exe:CyberLink MagicDirector
"{D7234E07-012D-42D4-AF05-A6748696508A}"= c:\program files\Acer Arcade Deluxe\DV Wizard\PowerDV.exe:CyberLink PowerDV
"{ED0EC2F9-8427-4EFA-8D2D-7782F9DD57C0}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{1AEB0B71-A0EB-49F4-8EF0-2049CBC46C48}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"TCP Query User{7C18D15D-5D85-4C73-AE18-693EE70437EF}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{347E4714-9917-453B-AC04-4311DE10E259}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{F18E3DB1-C5DB-4D14-B62F-DB0564B19459}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{ADB6B5AC-4BC0-4B23-A86F-27FC53C53B37}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{E468085C-A293-447B-966E-943C66B40A43}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{63F5BBC5-C9D9-409C-A7D7-4772E69CB0F0}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{BE656B17-320E-45A9-9393-20A1774E9EF8}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{E9809C04-38BB-46C4-B4F0-5B7076B4698F}"= TCP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
S1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2009-04-16 196688]
S1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2009-04-16 31824]
S2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]
S2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\OAcat.exe [2009-04-16 361160]
S2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [2009-04-16 3049160]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S2 ZDCNDIS5;ZDCNDIS5 NDIS5.1 Protocol Driver;c:\windows\system32\ZDCNDIS5.sys [2007-12-27 20736]
S3 OAnet;OnlineArmor Service;c:\windows\system32\DRIVERS\oanet.sys [2009-04-16 30800]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\z9upgm0g.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage -
hxxp://www.yahoo.com/FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-05-04 13:56
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(6124)
c:\program files\Tall Emu\Online Armor\OAwatch.dll
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\BatchCrypto.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\keyManager.dll
c:\acer\Empowering Technology\EPOWER\SysHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\System32\drivers\XAudio.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\acer\Empowering Technology\ePower\ePowerSvc.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Launch Manager\LManager.exe
c:\users\Mike\AppData\Local\Temp\RtkBtMnt.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\System32\igfxext.exe
c:\windows\ehome\ehmsas.exe
c:\acer\Empowering Technology\eNet\eNMTray.exe
c:\program files\Tall Emu\Online Armor\oahlp.exe
c:\windows\System32\igfxsrvc.exe
c:\acer\Empowering Technology\ePower\ePower_DMC.exe
c:\acer\Empowering Technology\eRecovery\eRAgent.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Completion time: 2009-05-04 14:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-04 18:02
ComboFix2.txt 2009-04-30 17:14
ComboFix3.txt 2009-04-30 14:09
Pre-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
Post-Run: 43,766,603,776 bytes free
290 --- E O F --- 2009-05-01 12:34