ComboFix 08-07-20.5 - gNiHyKcAj 2008-07-21 13:10:39.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.851 [GMT 9:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\EKlknnpo.ini C:\WINDOWS\system32\EKlknnpo.ini2 C:\WINDOWS\system32\fccaArol.dll C:\WINDOWS\system32\fcccAstt.dll C:\WINDOWS\system32\hgGvwvst.dll C:\WINDOWS\system32\lufbcuko.dll C:\WINDOWS\system32\okucbful.ini C:\WINDOWS\system32\opnnklKE.dll C:\WINDOWS\system32\ssqOHxwW.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF ((((((((((((((((((((((((( Files Created from 2008-06-21 to 2008-07-21 ))))))))))))))))))))))))))))))) . 2008-07-21 13:15 . 2008-07-21 13:15 268 --ah----- C:\sqmdata10.sqm 2008-07-21 13:15 . 2008-07-21 13:15 244 --ah----- C:\sqmnoopt10.sqm 2008-07-21 13:03 . 2008-07-21 13:03 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-07-21 00:37 . 2008-07-21 00:37 244 --ah----- C:\sqmnoopt09.sqm 2008-07-21 00:37 . 2008-07-21 00:37 232 --ah----- C:\sqmdata09.sqm 2008-07-18 20:51 . 2008-07-18 20:51 205 --a------ C:\melt2.bat 2008-07-18 20:45 . 2008-07-18 21:32 110,486 --a------ C:\WINDOWS\BMef4c400f.xml 2008-07-18 20:38 . 2008-07-18 20:38 205 --a------ C:\melt1.bat 2008-07-18 01:03 . 2008-02-03 04:08 2,439,559 --a------ C:\WINDOWS\Bridge.scr 2008-07-14 22:48 . 2008-07-14 22:55 1,772 --a------ C:\WINDOWS\system32\tmp.reg 2008-07-14 22:22 . 2008-07-14 22:22 d-------- C:\Deckard 2008-07-14 01:08 . 2008-07-14 01:08 d-------- C:\Program Files\Softouch 2008-07-13 21:48 . 2008-07-13 21:49 d-------- C:\Program Files\Spybot - Search & Destroy 2008-07-13 21:48 . 2008-07-13 22:06 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-07 11:16 . 2008-07-18 21:23 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-07 11:15 . 2008-07-07 11:15 d-------- C:\Program Files\SpywareBlaster 2008-07-03 23:26 . 2008-07-03 23:26 d-------- C:\Documents and Settings\gNiHyKcAj\Application Data\Camfrog 2008-07-03 23:25 . 2008-07-03 23:25 d-------- C:\Program Files\Camfrog 2008-07-03 21:10 . 2008-07-03 21:10 d-------- C:\Program Files\Common Files\Borland Shared 2008-07-03 21:10 . 1999-01-20 05:01 210,032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL 2008-07-03 21:10 . 1999-11-12 05:11 183,808 --a------ C:\WINDOWS\system32\BDEADMIN.CPL 2008-07-03 21:08 . 2008-07-03 21:08 d-------- C:\Documents and Settings\gNiHyKcAj\Application Data\Softouch 2008-07-03 21:08 . 2008-07-14 01:08 d-------- C:\Documents and Settings\All Users\Application Data\Softouch 2008-07-02 21:45 . 2008-07-02 21:45 53,248 --a------ C:\WINDOWS\system32\suppdll.dll 2008-07-02 21:45 . 2008-07-02 21:45 35,363 --a------ C:\WINDOWS\system32\windrvNT.sys 2008-07-02 21:44 . 2008-07-15 01:12 d-------- C:\Program Files\Folder Lock 2008-07-02 21:44 . 2002-12-25 09:44 380,928 --a------ C:\WINDOWS\system32\vaultskn.ocx 2008-07-02 21:44 . 2005-04-11 16:40 73,728 --a------ C:\WINDOWS\system32\FLKill.exe 2008-07-02 21:44 . 1999-04-23 22:22 20,992 --a------ C:\WINDOWS\system32\hhopen.ocx 2008-06-25 13:44 . 2008-06-25 13:44 d-------- C:\Documents and Settings\gNiHyKcAj\Application Data\Media Player Classic 2008-06-25 13:43 . 2006-09-24 17:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2008-06-25 13:43 . 2007-09-04 18:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll 2008-06-25 13:43 . 2007-09-21 02:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-06-25 13:43 . 2007-10-03 17:03 414 --a------ C:\WINDOWS\system32\lame_acm.xml 2008-06-25 13:42 . 2008-06-25 13:42 d-------- C:\Program Files\K-Lite Codec Pack 2008-06-25 13:42 . 2007-09-28 18:07 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-06-25 13:42 . 2007-07-25 15:24 1,559,040 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-06-25 13:42 . 2007-09-28 18:05 739,840 --a------ C:\WINDOWS\system32\divx.dll 2008-06-25 13:42 . 2007-03-10 13:51 282,624 --a------ C:\WINDOWS\system32\xvidvfw.dll 2008-06-25 13:42 . 2007-09-28 18:05 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2008-06-25 13:42 . 2007-07-29 17:51 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-06-25 13:42 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-06-24 15:03 . 2002-12-29 01:14 81,920 --a------ C:\WINDOWS\system32\Startup.cpl 2008-06-21 08:14 . 2008-06-21 08:14 268 --ah----- C:\sqmdata08.sqm 2008-06-21 08:14 . 2008-06-21 08:14 244 --ah----- C:\sqmnoopt08.sqm 2008-06-21 03:20 . 2008-06-21 03:20 268 --ah----- C:\sqmdata07.sqm 2008-06-21 03:20 . 2008-06-21 03:20 244 --ah----- C:\sqmnoopt07.sqm . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-21 04:05 --------- d-----w C:\Documents and Settings\gNiHyKcAj\Application Data\Skype 2008-07-21 03:48 --------- d-----w C:\Documents and Settings\gNiHyKcAj\Application Data\skypePM 2008-07-20 13:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-07-18 12:44 --------- d-----w C:\Documents and Settings\gNiHyKcAj\Application Data\uTorrent 2008-07-17 16:47 --------- d-----w C:\Program Files\Stardock 2008-07-17 16:15 --------- d-----w C:\Program Files\Common Files\Stardock 2008-07-03 13:18 --------- d-----w C:\Documents and Settings\gNiHyKcAj\Application Data\LimeWire 2008-06-26 10:14 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys 2008-06-19 14:17 --------- d-----w C:\Program Files\Trillian 2008-06-19 03:25 --------- d-----w C:\Program Files\AskPBar 2008-06-14 15:39 --------- d-----w C:\Program Files\X360 Video Player ActiveX Control 2008-06-10 09:40 --------- d-----w C:\Program Files\Google 2008-06-10 01:42 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-09 04:55 --------- d-----w C:\Program Files\Skype 2008-06-08 13:10 --------- d-----w C:\Program Files\uTorrent 2008-06-08 12:48 --------- d-----w C:\Program Files\Java 2008-06-08 12:46 --------- d-----w C:\Program Files\Common Files\Java 2008-06-08 12:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogMeIn 2008-06-06 03:28 --------- d-----w C:\Program Files\Tudou 2008-06-02 14:57 --------- d-----w C:\Program Files\Common Files\Skype 2008-05-28 03:33 83,288 ----a-w C:\WINDOWS\system32\LMIRfsClientNP.dll 2008-05-28 03:33 24,608 ----a-w C:\WINDOWS\system32\LMIport.dll 2008-05-28 03:32 87,352 ----a-w C:\WINDOWS\system32\LMIinit.dll 2008-05-28 03:32 23,736 ----a-w C:\WINDOWS\system32\lmimirr.dll 2008-05-28 03:32 10,040 ----a-w C:\WINDOWS\system32\lmimirr2.dll 2008-05-27 01:20 --------- d-----w C:\Program Files\SopCast 2008-04-23 15:31 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-02-28 05:30 8,784 ----a-w C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll 2008-02-28 05:33 245,408 ----a-w C:\Program Files\mozilla firefox\plugins\unicows.dll 2006-05-03 09:06 163,328 --sha-r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47 31,232 --sha-r C:\WINDOWS\system32\msfDX.dll 2007-12-17 12:43 27,648 --sha-w C:\WINDOWS\system32\Smab0.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34 128000] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 18:11 925696] C:\Documents and Settings\gNiHyKcAj\Start Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-04-11 12:17:24 3581680] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] 2005-01-31 15:13 49152 C:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] 2008-04-11 00:02 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2008-05-28 12:32 87352 C:\WINDOWS\system32\LMIinit.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wbsys.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VModes] VModes AttachToDesktop [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChikkaDefault] --a------ 2007-08-28 17:11 36864 C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 10:07 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera] --a------ 2007-07-11 16:09 20480 C:\WINDOWS\FixCamera.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2006-12-10 21:52 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] --a------ 2004-08-04 10:07 208952 C:\WINDOWS\ime\IMJP8_1\imjpmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2007-05-15 15:55 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2006-12-05 22:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel] --a------ 2008-03-17 17:59 2289664 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] --a------ 2004-08-04 10:07 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] --a------ 2004-08-04 10:07 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --------- 2006-11-23 15:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] --a------ 2007-05-15 15:55 1628208 C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-04-23 17:45 22058792 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2std] --a------ 2007-05-10 16:58 344064 C:\WINDOWS\vsnp2std.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQ931STI] --a------ 2007-01-24 14:24 151552 C:\WINDOWS\SQ931STI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-03-25 04:28 144784 C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp2std] --a------ 2007-05-12 11:19 270336 C:\WINDOWS\tsnp2std.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] --------- 2006-03-07 00:52 36864 C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2006-03-11 02:45 35328 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] --a------ 2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer] -ra------ 2005-03-08 12:33 53248 C:\WINDOWS\system32\VTTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp] -ra------ 2005-11-01 13:15 163840 C:\WINDOWS\system32\VTTrayp.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "ec7f7393"=rundll32.exe "C:\WINDOWS\system32\lufbcuko.dll",b "BMef4c400f"=Rundll32.exe "C:\WINDOWS\system32\vnrphufb.dll",s [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 12:38] R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 12:39] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 08:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 08:16] R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2008-03-07 13:39] R3 ARCSOFTVIRTUALCAPTURE;ArcSoft Magic-i Driver;C:\WINDOWS\system32\DRIVERS\ArcSoftVirtualCapture.sys [2006-11-24 01:53] R3 SQ931;V-Gear TalkCam RX8;C:\WINDOWS\system32\Drivers\Capt931a.sys [2007-04-12 16:52] S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [] S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-08-31 16:03] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder "2008-05-30 08:18:54 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe "2008-06-18 10:08:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-07-21 03:59:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-DW6 - C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe MSConfigStartUp-LogMeIn GUI - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe MSConfigStartUp-TudouVAStart - C:\Program Files\Tudou\����Tudou\TudouVa.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-21 13:25:28 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe . ************************************************************************** . Completion time: 2008-07-21 13:26:48 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-21 04:26:45 Pre-Run: 9,446,633,472 bytes free Post-Run: 9,970,810,880 bytes free 284