thanks for the continued support, Combofix log below
ComboFix 09-08-10.06 - Home 08/13/2009 21:59.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1470.770 [GMT -4:00]
Running from: c:\documents and settings\Home\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Home\Desktop\cfscript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Administrator\Local Settings\Application Data\Internet Saving Optimizer
c:\documents and settings\Administrator\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\config.md
c:\documents and settings\Administrator\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090801-002349.906.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\config.md
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\ipdata.md
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090725-221927.187.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090725-222441.250.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090725-222447.015.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-010946.281.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-091938.437.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-105601.687.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-151658.218.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-152055.312.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-194944.078.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-212739.562.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-093218.609.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-230224.390.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090729-000912.453.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090729-212558.093.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090729-234732.671.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090729-234944.140.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090730-000028.234.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090730-213548.343.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090730-224525.046.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090730-233346.406.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090730-233526.375.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090731-003148.968.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090731-005253.703.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090731-183957.296.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090731-215234.687.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090731-234443.421.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090801-003007.765.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090801-012321.562.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090801-012327.859.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090801-093758.593.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090801-173338.328.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090801-225911.593.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090802-111439.468.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090802-134929.562.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090802-135029.750.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090802-210913.921.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090802-220705.061.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090802-230029.223.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090802-230437.551.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090803-075848.078.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090803-195536.812.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090803-212010.359.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090803-220416.203.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090804-213733.593.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090805-004220.359.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090805-214628.265.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090805-223732.390.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090806-211434.468.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090807-190202.796.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090807-224834.281.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090808-162632.093.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090808-163307.343.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090808-211726.140.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090809-112702.984.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090809-120959.140.log
c:\documents and settings\Home\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\rstatus.md
c:\program files\LimeWire
c:\program files\LimeWire\dl\1212.wmv
c:\program files\LimeWire\dl\158sam.wmv
c:\program files\LimeWire\dl\2.WMV
c:\program files\LimeWire\root\magnet10\Thumbs.db
c:\program files\LimeWire\root\Thumbs.db
.
((((((((((((((((((((((((( Files Created from 2009-07-14 to 2009-08-14 )))))))))))))))))))))))))))))))
.
2009-08-14 01:43 . 2009-08-14 01:43 -------- d-----w- c:\windows\LastGood
2009-08-09 17:08 . 2009-03-06 14:00 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-08-09 17:08 . 2009-02-09 10:01 473088 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-08-09 17:08 . 2009-02-09 10:01 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-08-09 17:08 . 2009-02-06 10:22 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-08-09 17:08 . 2009-02-06 09:54 35328 -c----w- c:\windows\system32\dllcache\sc.exe
2009-08-09 17:08 . 2009-02-06 09:41 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-08-09 17:08 . 2005-07-26 04:20 60416 -c----w- c:\windows\system32\dllcache\colbact.dll
2009-08-09 17:08 . 2009-02-09 10:01 617984 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-08-09 17:08 . 2009-02-09 10:01 715264 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-08-09 16:43 . 2008-04-21 10:02 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-08-01 04:48 . 2009-08-01 04:48 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-08-01 04:23 . 2009-08-01 04:23 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Media Access Startup
2009-08-01 04:23 . 2009-08-01 04:23 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-01 04:22 . 2009-08-01 04:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-08-01 04:13 . 2009-08-01 04:31 117760 ----a-w- c:\documents and settings\Home\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-01 04:13 . 2009-08-01 04:13 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-01 04:13 . 2009-08-01 04:13 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-01 04:13 . 2009-08-01 04:13 -------- d-----w- c:\documents and settings\Home\Application Data\SUPERAntiSpyware.com
2009-07-31 03:46 . 2009-07-31 03:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-13 01:47 . 2007-10-05 01:31 -------- d-----w- c:\program files\Verizon
2009-08-13 01:45 . 2005-11-05 02:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-11 00:33 . 2009-08-11 00:33 2568 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2009-08-02 16:59 . 2006-04-10 04:36 -------- d-----w- c:\documents and settings\Home\Application Data\OpenOffice.org2
2009-08-01 04:12 . 2008-12-25 17:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-12 19:19 . 2009-02-15 18:10 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-04 14:42 . 2009-07-04 14:42 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap
2009-07-01 22:43 . 2005-11-05 04:03 -------- d-----w- c:\program files\InterVideo
2009-06-26 15:59 . 2005-11-05 00:53 668160 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 15:59 . 2005-11-05 00:52 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-23 01:40 . 2009-02-15 18:10 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-06-23 01:40 . 2009-02-15 18:10 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-03 19:27 . 2005-11-05 00:53 1290752 ----a-w- c:\windows\system32\quartz.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-08-09_16.23.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-11 21:23 . 2009-08-11 21:23 16384 c:\windows\Temp\Perflib_Perfdata_130.dat
+ 2005-11-05 03:10 . 2007-07-27 13:41 26488 c:\windows\system32\spupdsvc.exe
+ 2009-04-04 04:56 . 2008-07-09 07:38 17272 c:\windows\system32\spmsg.dll
+ 2005-11-05 00:53 . 2009-02-03 20:08 55808 c:\windows\system32\secur32.dll
- 2005-11-05 00:53 . 2004-08-04 12:00 55808 c:\windows\system32\secur32.dll
+ 2005-11-05 00:53 . 2009-02-06 09:54 35328 c:\windows\system32\sc.exe
- 2005-11-05 00:53 . 2008-10-16 10:20 39424 c:\windows\system32\pngfilt.dll
+ 2005-11-05 00:53 . 2009-06-26 15:59 39424 c:\windows\system32\pngfilt.dll
+ 2005-11-05 02:26 . 2008-06-12 13:47 91648 c:\windows\system32\mtxoci.dll
+ 2005-11-05 00:53 . 2008-06-12 13:47 66560 c:\windows\system32\mtxclu.dll
- 2005-11-05 00:53 . 2006-03-01 19:34 66560 c:\windows\system32\mtxclu.dll
+ 2005-11-05 02:26 . 2008-06-12 13:47 58880 c:\windows\system32\msdtclog.dll
- 2005-11-05 02:26 . 2004-08-04 12:00 58880 c:\windows\system32\msdtclog.dll
+ 2007-11-26 02:15 . 2009-08-12 00:46 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2005-11-05 00:52 . 2009-06-26 15:59 16384 c:\windows\system32\jsproxy.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 16384 c:\windows\system32\jsproxy.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 96256 c:\windows\system32\inseng.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 96256 c:\windows\system32\inseng.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 55808 c:\windows\system32\extmgr.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 55808 c:\windows\system32\extmgr.dll
+ 2009-02-03 20:08 . 2009-02-03 20:08 55808 c:\windows\system32\dllcache\secur32.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 39424 c:\windows\system32\dllcache\pngfilt.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 39424 c:\windows\system32\dllcache\pngfilt.dll
+ 2008-06-12 13:47 . 2008-06-12 13:47 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2008-06-12 13:47 . 2008-06-12 13:47 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2008-06-12 13:47 . 2008-06-12 13:47 58880 c:\windows\system32\dllcache\msdtclog.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 16384 c:\windows\system32\dllcache\jsproxy.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 16384 c:\windows\system32\dllcache\jsproxy.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 96256 c:\windows\system32\dllcache\inseng.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 96256 c:\windows\system32\dllcache\inseng.dll
+ 2009-06-26 15:59 . 2009-06-26 15:59 81920 c:\windows\system32\dllcache\ieencode.dll
+ 2006-05-09 11:41 . 2009-06-22 11:40 18432 c:\windows\system32\dllcache\iedw.exe
- 2006-05-09 11:41 . 2008-10-15 14:18 18432 c:\windows\system32\dllcache\iedw.exe
+ 2006-05-10 05:25 . 2009-06-26 15:59 55808 c:\windows\system32\dllcache\extmgr.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 55808 c:\windows\system32\dllcache\extmgr.dll
+ 2005-11-05 02:47 . 2009-06-22 11:26 352768 c:\windows\system32\xpsp3res.dll
+ 2006-10-19 01:47 . 2008-06-24 22:12 295936 c:\windows\system32\wmpeffects.dll
- 2006-10-19 01:47 . 2006-10-19 01:47 295936 c:\windows\system32\wmpeffects.dll
- 2005-11-05 00:53 . 2004-08-04 12:00 351232 c:\windows\system32\winhttp.dll
+ 2005-11-05 00:53 . 2008-12-16 12:47 351232 c:\windows\system32\winhttp.dll
+ 2005-11-05 02:26 . 2009-02-06 09:41 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2005-11-05 02:26 . 2009-02-10 22:31 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2005-11-05 02:26 . 2009-02-09 10:01 473088 c:\windows\system32\wbem\fastprox.dll
+ 2005-11-05 00:53 . 2009-06-26 15:59 620032 c:\windows\system32\urlmon.dll
+ 2005-11-05 00:53 . 2009-06-26 15:59 474112 c:\windows\system32\shlwapi.dll
- 2005-11-05 00:53 . 2008-10-16 10:20 474112 c:\windows\system32\shlwapi.dll
+ 2005-11-05 00:53 . 2009-02-06 10:22 110592 c:\windows\system32\services.exe
- 2005-11-05 00:53 . 2007-04-25 14:21 144896 c:\windows\system32\schannel.dll
+ 2005-11-05 00:53 . 2008-12-05 07:12 144896 c:\windows\system32\schannel.dll
+ 2005-11-05 00:53 . 2009-02-09 10:01 401408 c:\windows\system32\rpcss.dll
- 2005-11-05 00:53 . 2007-07-09 13:09 584192 c:\windows\system32\rpcrt4.dll
+ 2005-11-05 00:53 . 2009-04-15 15:11 584192 c:\windows\system32\rpcrt4.dll
+ 2005-11-05 00:53 . 2009-03-06 14:00 284160 c:\windows\system32\pdh.dll
+ 2005-11-05 00:53 . 2009-02-09 10:01 715264 c:\windows\system32\ntdll.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 532480 c:\windows\system32\mstime.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 532480 c:\windows\system32\mstime.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 146432 c:\windows\system32\msrating.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 146432 c:\windows\system32\msrating.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 449024 c:\windows\system32\mshtmled.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 449024 c:\windows\system32\mshtmled.dll
+ 2005-11-05 02:26 . 2008-06-12 13:47 161792 c:\windows\system32\msdtcuiu.dll
+ 2005-11-05 02:26 . 2008-06-12 13:47 956928 c:\windows\system32\msdtctm.dll
+ 2005-11-05 02:26 . 2008-06-12 13:47 428032 c:\windows\system32\msdtcprx.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 257440 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2005-11-05 00:52 . 2009-02-09 10:01 728576 c:\windows\system32\lsasrv.dll
+ 2005-11-05 00:52 . 2009-05-07 15:44 344064 c:\windows\system32\localspl.dll
+ 2005-11-05 00:52 . 2009-03-21 14:18 986112 c:\windows\system32\kernel32.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 251904 c:\windows\system32\iepeers.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 251904 c:\windows\system32\iepeers.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 205312 c:\windows\system32\dxtrans.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 205312 c:\windows\system32\dxtrans.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 357888 c:\windows\system32\dxtmsft.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 357888 c:\windows\system32\dxtmsft.dll
+ 2009-02-10 22:31 . 2009-02-10 22:31 453120 c:\windows\system32\dllcache\wmiprvsd.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 668160 c:\windows\system32\dllcache\wininet.dll
+ 2008-12-16 12:47 . 2008-12-16 12:47 351232 c:\windows\system32\dllcache\winhttp.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 620032 c:\windows\system32\dllcache\urlmon.dll
+ 2005-11-05 00:54 . 2007-06-27 02:10 317440 c:\windows\system32\dllcache\unregmp2.exe
- 2006-05-10 05:25 . 2008-10-16 10:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 474112 c:\windows\system32\dllcache\shlwapi.dll
- 2007-04-25 14:21 . 2007-04-25 14:21 144896 c:\windows\system32\dllcache\schannel.dll
+ 2007-04-25 14:21 . 2008-12-05 07:12 144896 c:\windows\system32\dllcache\schannel.dll
- 2007-10-10 01:14 . 2007-07-09 13:09 584192 c:\windows\system32\dllcache\rpcrt4.dll
+ 2007-10-10 01:14 . 2009-04-15 15:11 584192 c:\windows\system32\dllcache\rpcrt4.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 532480 c:\windows\system32\dllcache\mstime.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 532480 c:\windows\system32\dllcache\mstime.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 146432 c:\windows\system32\dllcache\msrating.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 146432 c:\windows\system32\dllcache\msrating.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 449024 c:\windows\system32\dllcache\mshtmled.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 449024 c:\windows\system32\dllcache\mshtmled.dll
+ 2008-06-12 13:47 . 2008-06-12 13:47 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2008-06-12 13:47 . 2008-06-12 13:47 956928 c:\windows\system32\dllcache\msdtctm.dll
+ 2008-06-12 13:47 . 2008-06-12 13:47 428032 c:\windows\system32\dllcache\msdtcprx.dll
+ 2006-08-17 12:28 . 2009-02-09 10:01 728576 c:\windows\system32\dllcache\lsasrv.dll
+ 2009-05-07 15:44 . 2009-05-07 15:44 344064 c:\windows\system32\dllcache\localspl.dll
+ 2006-07-05 10:55 . 2009-03-21 14:18 986112 c:\windows\system32\dllcache\kernel32.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 251904 c:\windows\system32\dllcache\iepeers.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 251904 c:\windows\system32\dllcache\iepeers.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 357888 c:\windows\system32\dllcache\dxtmsft.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 357888 c:\windows\system32\dllcache\dxtmsft.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 151040 c:\windows\system32\dllcache\cdfview.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 151040 c:\windows\system32\dllcache\cdfview.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 151040 c:\windows\system32\cdfview.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 151040 c:\windows\system32\cdfview.dll
+ 2005-11-05 00:52 . 2009-02-09 10:01 617984 c:\windows\system32\advapi32.dll
+ 2005-11-05 00:54 . 2007-06-27 02:10 317440 c:\windows\inf\unregmp2.exe
+ 2005-11-05 00:53 . 2009-04-17 09:58 1846656 c:\windows\system32\win32k.sys
+ 2005-11-05 00:53 . 2008-07-03 13:03 8460800 c:\windows\system32\shell32.dll
+ 2005-11-05 00:53 . 2009-07-18 16:00 1509888 c:\windows\system32\shdocvw.dll
+ 2005-11-05 00:53 . 2009-02-06 10:32 2186112 c:\windows\system32\ntoskrnl.exe
+ 2004-08-03 22:59 . 2009-02-06 09:49 2062976 c:\windows\system32\ntkrnlpa.exe
+ 2005-11-05 00:52 . 2009-07-18 16:00 3069440 c:\windows\system32\mshtml.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 3883424 c:\windows\system32\Macromed\Flash\NPSWF32.dll
- 2009-04-04 04:42 . 2009-04-04 04:42 1478632 c:\windows\system32\FNTCACHE.DAT
+ 2009-04-04 04:42 . 2009-08-11 21:23 1478632 c:\windows\system32\FNTCACHE.DAT
+ 2007-03-08 13:47 . 2009-04-17 09:58 1846656 c:\windows\system32\dllcache\win32k.sys
+ 2005-11-05 00:53 . 2008-07-03 13:03 8460800 c:\windows\system32\dllcache\shell32.dll
+ 2006-05-29 15:32 . 2009-07-18 16:00 1509888 c:\windows\system32\dllcache\shdocvw.dll
+ 2007-10-29 22:43 . 2009-06-03 19:27 1290752 c:\windows\system32\dllcache\quartz.dll
+ 2006-12-19 14:17 . 2009-02-06 10:32 2186112 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2006-12-19 12:55 . 2009-02-06 09:49 2020864 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2006-12-19 12:55 . 2009-02-06 09:49 2062976 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2006-12-19 14:15 . 2009-02-06 10:29 2142720 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2006-05-19 15:06 . 2009-07-18 16:00 3069440 c:\windows\system32\dllcache\mshtml.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 1054208 c:\windows\system32\dllcache\danim.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 1054208 c:\windows\system32\dllcache\danim.dll
+ 2006-05-10 05:25 . 2009-06-26 15:59 1024000 c:\windows\system32\dllcache\browseui.dll
- 2006-05-10 05:25 . 2008-10-16 10:20 1024000 c:\windows\system32\dllcache\browseui.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 1054208 c:\windows\system32\danim.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 1054208 c:\windows\system32\danim.dll
+ 2005-11-05 00:52 . 2009-06-26 15:59 1024000 c:\windows\system32\browseui.dll
- 2005-11-05 00:52 . 2008-10-16 10:20 1024000 c:\windows\system32\browseui.dll
+ 2005-11-05 02:48 . 2009-02-06 10:32 2186112 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2005-11-05 02:48 . 2009-02-06 09:49 2020864 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2005-11-05 02:48 . 2009-02-06 09:49 2062976 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2005-11-05 02:48 . 2009-02-06 10:29 2142720 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2005-11-05 00:54 . 2008-11-11 22:34 10838016 c:\windows\system32\wmp.dll
+ 2007-07-15 01:19 . 2009-07-07 12:10 24539592 c:\windows\system32\MRT.exe
+ 2005-11-05 00:54 . 2008-11-11 22:34 10838016 c:\windows\system32\dllcache\wmp.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-18 68856]
"ShutterflyStudio"="c:\program files\Shutterfly\Studio\BIN\SFlyStudio.exe" [2007-03-06 2496512]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-14 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-14 688218]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2005-11-25 352256]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-11-10 73728]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-08-01 122940]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 122880]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-06-06 936960]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-06 177472]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-23 1948440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-04 158208]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-06-09 185896]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-11-10 15473664]
"NDSTray.exe"="NDSTray.exe" [BU]
"TFncKy"="TFncKy.exe" [BU]
"TPSMain"="TPSMain.exe" - c:\windows\system32\TPSMain.exe [2005-06-01 282624]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2005-11-4 155648]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-23 01:40 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Home^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\documents and settings\Home\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnkStartup
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AGRSMMSG"=AGRSMMSG.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/15/2009 2:10 PM 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/15/2009 2:10 PM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/28/2009 10:53 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/28/2009 10:53 AM 72944]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/12/2009 3:19 PM 907032]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [6/22/2009 9:40 PM 298776]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [12/25/2008 1:37 PM 18560]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [7/28/2009 10:53 AM 7408]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
2009-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2008-07-27 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2007-08-31 19:01]
.
.
------- Supplementary Scan -------
.
uSearch Page =
hxxp://www.google.comuStart Page =
hxxp://www.yahoo.com/uSearch Bar =
hxxp://www.google.com/ieuInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;*.local
uSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Home\Application Data\Mozilla\Firefox\Profiles\kudntcqt.default\
FF - prefs.js: browser.startup.homepage -
www.yahoo.comFF - prefs.js: keyword.URL -
hxxp://www.google.com/search?btnG=Google+Search&q=FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPUploader.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
FF - user.js: yahoo.homepage.dontask - true.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-08-13 22:08
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ShutterflyStudio = c:\program files\Shutterfly\Studio\BIN\SFlyStudio.exe /trayonly?mmand:?10?????????????????????????????es\Shutterfly\Studio\BIN\mmpartner_langres.dll?1\T??????????udio Event - ?\L?C????UNIQUE_GEN_LISTENER_LOCK_NAME?AM??????????????????=C??????????re????tt??fly\
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(556)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-08-14 22:11
ComboFix-quarantined-files.txt 2009-08-14 02:11
ComboFix2.txt 2009-08-09 16:56
ComboFix3.txt 2009-08-09 16:27
Pre-Run: 12,118,929,408 bytes free
Post-Run: 12,060,143,616 bytes free
581 --- E O F --- 2009-08-11 21:05