ComboFix 08-11-22.02 - Michael 2008-11-23 16:03:23.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1509 [GMT -8:00] Running from: c:\my downloads\ComboFix.exe * Created a new restore point [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Downloaded Program Files\ODCTOOLS c:\windows\system32\bszip.dll c:\windows\system32\MabryObj.dll M:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-10-23 to 2008-11-23 ))))))))))))))))))))))))))))))) . 2008-11-23 11:45 . 2008-11-23 11:44 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-21 13:27 . 2005-12-19 09:08 3,096,576 --a------ c:\windows\system32\BCMWLCPL.CPL 2008-11-21 13:27 . 2005-12-19 09:08 2,129,920 --a------ c:\windows\system32\WLBCGCBPRO731.DLL 2008-11-21 13:27 . 2005-12-19 09:08 1,347,584 --a------ c:\windows\system32\WLTRAY.EXE 2008-11-21 13:27 . 2005-12-19 09:08 1,200,128 --a------ c:\windows\system32\BCMWLTRY.EXE 2008-11-21 13:27 . 2005-12-19 09:08 757,760 --a------ c:\windows\system32\bcm1xsup.dll 2008-11-21 13:27 . 2005-12-19 09:08 253,952 --a------ c:\windows\system32\bcmwlu00.exe 2008-11-21 13:27 . 2005-12-19 09:08 86,016 --a------ c:\windows\system32\preflib.dll 2008-11-21 13:27 . 2005-12-19 09:08 69,632 --a------ c:\windows\system32\bcmwlpkt.dll 2008-11-21 13:27 . 2005-12-19 09:08 44,032 --a------ c:\windows\system32\wltrynt.dll 2008-11-21 13:27 . 2005-12-19 09:08 33,664 --a------ c:\windows\system32\drivers\BCMWLNPF.SYS 2008-11-21 13:27 . 2005-12-19 09:08 18,944 --a------ c:\windows\system32\WLTRYSVC.EXE 2008-11-21 10:26 . 2008-11-21 10:26 d-------- c:\documents and settings\Michael\Application Data\Windows Search 2008-11-20 17:40 . 2008-11-20 17:40 d-------- c:\windows\system32\GroupPolicy 2008-11-20 17:39 . 2008-11-20 17:41 1,393 --a------ c:\windows\imsins.BAK 2008-11-20 17:38 . 2008-03-07 09:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll 2008-11-20 17:38 . 2008-03-07 09:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll 2008-11-20 17:38 . 2008-03-07 09:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll 2008-11-20 16:58 . 2008-11-18 12:28 348,160 --a------ c:\windows\system32\msvc4d39.rra 2008-11-20 16:49 . 2008-11-18 12:28 348,160 --a------ c:\windows\system32\msvc92e8.rra 2008-11-20 16:47 . 2008-11-18 12:28 348,160 --a------ c:\windows\system32\msvc3382.rra 2008-11-20 15:22 . 2006-07-11 21:35 348,160 --------- c:\windows\system32\msvca133.rra 2008-11-20 14:24 . 2008-11-20 14:25 d-------- C:\msiinv 2008-11-19 17:38 . 2008-11-19 17:38 d-------- c:\windows\system32\URTTemp 2008-11-19 14:38 . 2008-11-19 17:34 d-------- c:\windows\system32\URTTemp(2) 2008-11-19 13:45 . 2006-07-11 21:35 348,160 --------- c:\windows\system32\msvca763.rra 2008-11-19 13:21 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui 2008-11-18 20:04 . 2006-07-11 21:35 348,160 --------- c:\windows\system32\msvc357f.rra 2008-11-18 17:10 . 2008-11-18 17:10 0 --------- C:\hb_2.tmp 2008-11-18 12:39 . 2008-11-18 12:39 0 --------- C:\hb_1.tmp 2008-11-18 12:33 . 2008-11-18 12:33 d-------- c:\documents and settings\All Users\Application Data\BVRP Software 2008-11-18 12:25 . 2007-02-09 15:26 132,736 --a------ c:\windows\system32\drivers\Uim_IM.sys 2008-11-18 12:25 . 2007-02-09 15:26 37,864 --a------ c:\windows\system32\drivers\hotcore3.sys 2008-11-18 12:25 . 2007-02-09 15:26 33,632 --a------ c:\windows\system32\drivers\UimBus.sys 2008-11-18 12:25 . 2007-02-09 15:26 13,120 --a------ c:\windows\system32\drivers\UimFIO.sys 2008-11-18 09:05 . 2008-11-18 12:35 d-------- c:\documents and settings\Michael\Application Data\AutoSizer 2008-11-17 22:38 . 2008-11-18 19:29 d-------- c:\program files\Avanquest 2008-11-15 19:26 . 2008-11-15 19:26 d-------- c:\program files\CCleaner 2008-11-12 08:35 . 2008-09-04 09:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll 2008-11-12 08:35 . 2008-10-24 03:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-11 21:15 . 2008-11-11 21:25 d-------- c:\program files\Yahoo! 2008-11-10 20:56 . 2008-11-10 20:56 d-------- c:\documents and settings\Michael\Application Data\Avira 2008-11-10 20:29 . 2008-11-19 11:38 d-------- c:\program files\Avira 2008-11-08 21:10 . 2008-11-08 21:10 d-------- c:\program files\APC 2008-11-08 21:10 . 2004-08-10 15:35 4,142,592 --------- c:\windows\system32\qtintf.dll 2008-11-08 19:12 . 2008-04-13 11:36 20,352 --------- c:\windows\system32\drivers\hidbatt.sys 2008-11-08 19:12 . 2008-04-13 11:36 20,352 --------- c:\windows\system32\dllcache\hidbatt.sys 2008-11-05 15:39 . 2008-11-05 15:39 d-------- c:\documents and settings\Michael\Application Data\Genie-soft 2008-11-05 15:32 . 2006-11-02 00:50 128,104 --------- c:\windows\system32\drivers\WimFltr.sys 2008-11-05 11:15 . 2008-11-05 11:15 d-------- c:\documents and settings\All Users\Application Data\GoodSync 2008-11-04 20:10 . 2008-11-04 20:10 0 --------- C:\hb_B0.tmp 2008-10-26 09:06 . 2008-11-10 20:29 d-------- c:\documents and settings\All Users\Application Data\Avira 2008-10-25 22:26 . 2008-10-25 22:26 d-------- c:\program files\Trend Micro 2008-10-25 19:13 . 2008-10-25 19:13 d-------- c:\program files\filehippo.com 2008-10-23 22:31 . 2008-10-15 08:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-23 23:19 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-11-23 23:18 --------- d-----w c:\program files\Type Pilot 2008-11-23 21:02 --------- d-----w c:\program files\Windows Desktop Search 2008-11-23 20:52 --------- d-----w c:\program files\Uniblue 2008-11-23 19:58 --------- d-----w c:\program files\XoftSpySE 2008-11-23 19:44 --------- d-----w c:\program files\Java 2008-11-23 14:17 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2008-11-23 08:53 --------- d-----w c:\documents and settings\Michael\Application Data\.oit 2008-11-23 02:59 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2008-11-21 18:13 --------- d-----w c:\program files\MSECACHE 2008-11-21 00:57 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-20 23:22 --------- d-----w c:\documents and settings\Michael\Application Data\InstallShield Installation Information 2008-11-20 01:37 --------- d-----w c:\program files\X1 2008-11-18 20:28 1,053,184 ----a-w c:\windows\system32\MFC71u.dll 2008-11-18 18:44 --------- d-----w c:\program files\AutoSizer 2008-11-16 21:54 --------- d-----w c:\documents and settings\Michael\Application Data\GoodSync 2008-11-16 03:29 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-11-12 16:22 --------- d-----w c:\program files\AJSystems Common 2008-11-11 21:08 --------- d-----w c:\program files\ClipMate7 2008-11-05 19:11 --------- d-----w c:\program files\Siber Systems 2008-11-04 05:14 --------- d-----w c:\program files\ezBackup4 2008-10-30 17:40 --------- d-----w c:\program files\Paragon Software 2008-10-26 19:11 --------- d-----w c:\program files\Furl Toolbar 2008-10-26 19:01 --------- d-----w c:\program files\Auction Sentry Deluxe 2008-10-26 06:42 --------- d-----w c:\program files\Picasa2 2008-10-24 11:21 455,296 ------w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 02:23 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-23 00:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-23 00:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-10-19 03:04 --------- d-----w c:\program files\iTunes 2008-10-19 03:04 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-19 03:01 --------- d-----w c:\program files\iPod 2008-10-17 17:50 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-10-17 17:14 --------- d-----w c:\program files\SpyZooka 2008-10-17 01:50 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 22:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 22:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 22:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 22:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 22:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 22:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-08 19:12 --------- d-----w c:\program files\NOS 2008-10-08 19:12 --------- d-----w c:\documents and settings\All Users\Application Data\NOS 2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll 2008-10-03 15:50 --------- d-----w c:\program files\Common Files\xing shared 2008-10-03 15:44 --------- d-----w c:\program files\Common Files\Real 2008-10-01 00:43 1,286,152 ------w c:\windows\system32\msxml4.dll 2008-09-28 05:37 --------- d-----w c:\program files\QuickTime 2008-09-28 05:36 --------- d-----w c:\program files\Common Files\Apple 2008-09-28 05:08 --------- d-----w c:\program files\Bonjour 2008-09-28 05:08 --------- d-----w c:\documents and settings\Michael\Application Data\ZoomBrowser EX 2008-09-26 23:45 --------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser 2008-09-24 12:57 --------- d-----w c:\program files\Canon 2008-09-24 12:30 --------- d-----w c:\program files\Common Files\Canon 2008-09-15 12:12 1,846,400 ------w c:\windows\system32\win32k.sys 2008-09-15 12:12 1,846,400 ------w c:\windows\system32\dllcache\win32k.sys 2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll 2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll 2008-09-08 10:41 333,824 ------w c:\windows\system32\dllcache\srv.sys 2008-09-04 17:15 1,106,944 ------w c:\windows\system32\msxml3.dll 2008-08-29 17:18 87,336 ------w c:\windows\system32\dns-sd.exe 2008-08-29 16:53 61,440 ------w c:\windows\system32\dnssd.dll 2008-08-27 08:24 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll 2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe 2008-08-25 08:37 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe 2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll 2008-04-25 17:00 56,912 ------w c:\documents and settings\Michael\g2mdlhlpx.exe 2007-12-18 00:46 223,640 ------w c:\program files\Powermarks 3.txt 2007-01-26 00:13 1,205 ------w c:\program files\InstallInfo.log 2007-01-25 04:31 5 --sh--w c:\windows\system32\dfdaea0_s.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL" [2008-02-08 66912] [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] 2008-02-08 11:15 66912 --------- c:\program files\AskSBar\SrchAstt\2.bin\A2SRCHAS.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "X1FileMonitor.exe"="c:\program files\X1\X1FileMonitor.exe" [2008-01-28 369336] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288] "Type Pilot"="c:\program files\Type Pilot\TypePlt.exe" [2006-05-01 330240] "RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-22 160592] "EscapeClose"="c:\program files\EscapeClosePro\EscapeClosePro.exe" [2006-12-13 46080] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "ClipMate7"="c:\program files\ClipMate7\ClipMate.exe" [2008-10-21 3760424] "AutoSizer"="c:\program files\AutoSizer\AutoSizer.exe" [2008-11-18 131072] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Nuance PDF Converter 5-reminder"="c:\program files\Nuance\PDF Converter 5\Ereg\Ereg.exe" [2007-08-31 328992] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-03 185896] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-23 136600] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2007-03-26 210472] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-26 4632576] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2003-05-15 163840] "COMODO Firewall Pro"="c:\program files\Comodo\Firewall\cfp.exe" [2007-11-23 1481984] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497] "AJS Open File Manager"="c:\program files\AJS Open File Manager\fileAccessManager.exe" [2007-03-27 937984] "Acrobat Assistant 7.0"="c:\program files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "RegisterDropHandler"="c:\progra~1\TEXTBR~1.0\Bin\REGIST~1.EXE" [1998-12-10 23040] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-15 443968] c:\documents and settings\Michael\Start Menu\Programs\Startup\ X1.lnk - c:\program files\X1\X1.exe [2008-01-28 2532536] Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-03-18 4742184] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-07-18 25214] APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2008-11-08 221247] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\guard32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk] backup=c:\windows\pss\Adobe Gamma.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BounceBack Launcher.lnk] backup=c:\windows\pss\BounceBack Launcher.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EPSON SMART PANEL for Scanner.lnk] backup=c:\windows\pss\EPSON SMART PANEL for Scanner.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=c:\windows\pss\Google Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak Picture Transfer.lnk] backup=c:\windows\pss\Kodak Picture Transfer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ListGrabber Standard 3.0.lnk] backup=c:\windows\pss\ListGrabber Standard 3.0.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Michael^Start Menu^Programs^Startup^BounceBack Launcher.lnk] backup=c:\windows\pss\BounceBack Launcher.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Michael^Start Menu^Programs^Startup^iFinger.lnk] backup=c:\windows\pss\iFinger.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Michael^Start Menu^Programs^Startup^Powermarks.lnk] backup=c:\windows\pss\Powermarks.lnkStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWMON HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyZooka [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --------- 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Version Cue CS2] --------- 2005-04-04 18:58 856064 c:\program files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] -r------- 2002-08-22 19:28 143360 c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] --------- 2008-09-03 19:12 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\filehippo.com] --------- 2008-10-22 04:51 147968 c:\program files\filehippo.com\UpdateChecker.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess] --------- 1999-12-14 10:12 37376 c:\progra~1\TEXTBR~1.0\Bin\INSTAN~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --------- 2005-02-16 15:15 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --------- 2005-02-16 15:15 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --------- 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxtorOneTouch] --------- 2003-05-21 15:30 45056 c:\progra~1\Maxtor\OneTouch\Utils\OneTouch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2008-04-13 16:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfotoNow USB Detection] --------- 2002-11-05 09:32 77824 c:\progra~1\Ofoto\OfotoNow\OFUSBS.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF5 Registry Controller] --------- 2008-02-02 01:19 58656 c:\program files\Nuance\PDF Converter 5\RegistryController.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] --------- 2008-08-15 08:57 443968 c:\program files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --------- 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegisterDropHandler] --------- 1998-12-10 12:33 23040 c:\progra~1\TEXTBR~1.0\Bin\REGIST~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -r-hs---- 2008-09-16 11:16 1833296 c:\program files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2] --------- 2007-12-05 16:06 1885464 c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --------- 2004-10-26 12:01 921600 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE] --------- 2002-07-18 16:58 163840 c:\windows\system32\pctspk.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"= "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Kodak\\Kodak Utilities\\PTS\\Kodak Picture Transfer Service.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Roxio\\Digital Home 8\\RoxUpnpServer.exe"= R0 FileCloner;FileCloner;c:\windows\system32\drivers\famfd.sys [2007-03-20 69632] R0 hotcore;hotcore;c:\windows\system32\drivers\hotcore.sys [2007-01-16 30820] R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2008-11-18 37864] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2007-11-23 79096] R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2007-11-23 23672] R2 AntiVirMailService;Avira AntiVir Premium MailGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-11-10 164097] R2 antivirwebservice;Avira AntiVir Premium WebGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-11-10 258305] R2 AVEService;Avira AntiVir Premium MailGuard helper service;"c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-11-10 41217] S2 KODAK Picture Transfer Agent;Kodak picture transfer agent;"c:\program files\Kodak\Kodak Utilities\PTS\Kodak Picture Transfer Service.exe" [2007-03-13 163840] S2 portD;CMS PortIO Service; [] S3 DrvSnSht;DrvSnSht;\??\c:\program files\R-Drive Image\DrvSnSht.sys [] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-08 33752] S3 portio;CMS Openfile Service;c:\windows\system32\DRIVERS\portd64.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ea5b6ca-aa46-11db-b825-00904b6d33a8}] \Shell\AutoRun\command - E:\PortableRoboForm.exe \Shell\RoboForm2Go\command - E:\PortableRoboForm.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b289d1f0-46f2-11dc-b8a4-00904b6d33a8}] \Shell\AutoRun\command - G:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1f13e50-b40f-11dd-b9a1-00904b6d33a8}] \Shell\AutoRun\command - E:\LaunchU3.exe -a *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder 2008-10-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-19 c:\windows\Tasks\EasyShare Registration Task.job - c:\windows\system32\rundll32.exe [2008-04-13 16:12] 2008-11-23 c:\windows\Tasks\XoftSpySE 2.job - c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 13:44] 2008-03-06 c:\windows\Tasks\XoftSpySE.job - c:\program files\XoftSpySE\XoftSpy.exe [2007-07-13 13:44] . - - - - ORPHANS REMOVED - - - - HKLM-Run-Comodo Firewall - c:\program files\Comodo\Firewall\CPF.exe MSConfigStartUp-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe MSConfigStartUp-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Michael\Application Data\Mozilla\Firefox\Profiles\oikxsxdf.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ig?hl=en FF -: plugin - c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll FF -: plugin - c:\program files\mozilla firefox\plugins\np_gp.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsnapfish.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsnapfish.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll FF -: plugin - c:\program files\Picasa2\npPicasa2.dll FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-23 17:40:18 Windows 5.1.2600 Service Pack 3 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(912) c:\windows\system32\guard32.dll c:\windows\system32\WgaLogon.dll - - - - - - - > 'lsass.exe'(968) c:\windows\system32\guard32.dll c:\windows\system32\avsda.dll . Completion time: 2008-11-23 17:44:36 ComboFix-quarantined-files.txt 2008-11-24 01:43:49 Pre-Run: 49,367,277,568 bytes free Post-Run: 49,563,070,464 bytes free 380 --- E O F --- 2008-11-12 17:17:41