ComboFix 09-09-14.02 - HP_Owner 09/15/2009 9:11.1.2 - NTFSx86 (continued)
.
((((((((((((((((((((((((( Files Created from 2009-08-15 to 2009-09-15 )))))))))))))))))))))))))))))))
.
2009-09-13 21:16 . 2009-09-13 21:16 -------- d-----w- c:\documents and settings\Mom\Application Data\Malwarebytes
2009-09-13 18:41 . 2009-09-14 06:56 -------- d-----w- C:\$AVG8.VAULT$
2009-09-13 16:22 . 2009-09-13 16:22 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-09-13 16:22 . 2009-09-13 16:22 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-09-13 16:22 . 2009-09-13 16:22 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-09-13 16:22 . 2009-09-13 16:22 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-09-13 16:22 . 2009-09-14 23:21 -------- d-----w- c:\windows\system32\drivers\Avg
2009-09-13 16:22 . 2009-09-13 16:22 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-09-13 16:21 . 2009-09-13 16:21 -------- d-----w- c:\program files\AVG
2009-09-13 16:21 . 2009-09-13 16:21 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-13 15:56 . 2009-09-13 15:56 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\AVG8
2009-09-10 21:52 . 2009-09-10 21:52 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\Turbine,_Inc
2009-09-10 21:50 . 2009-09-13 01:52 -------- d-----w- c:\program files\Turbine
2009-09-09 15:41 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-08 17:30 . 2009-09-08 17:30 -------- d-----w- c:\program files\ESET
2009-09-08 16:57 . 2009-09-08 16:57 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-09-08 16:56 . 2009-09-10 02:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-08 00:26 . 2009-09-08 00:26 -------- d-----w- c:\windows\system32\XPSViewer
2009-09-08 00:25 . 2009-09-08 00:25 -------- d-----w- c:\program files\MSBuild
2009-09-08 00:25 . 2009-09-08 00:25 -------- d-----w- c:\program files\Reference Assemblies
2009-09-08 00:25 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-09-08 00:25 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-09-08 00:25 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-09-08 00:25 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-09-08 00:25 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-09-08 00:25 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-09-08 00:25 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-09-08 00:25 . 2009-09-08 00:25 -------- d-----w- C:\47a57fa2ae8e511859123f0c09fd1023
2009-09-07 19:55 . 2009-09-07 19:55 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\Malwarebytes
2009-09-07 19:54 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-07 19:54 . 2009-09-12 19:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-07 19:54 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-07 19:54 . 2009-09-07 19:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-07 19:39 . 2009-09-07 19:39 -------- d-----w- C:\_OTL
2009-09-07 14:08 . 2009-09-07 14:08 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\Turbine
2009-09-06 19:00 . 2009-09-07 19:15 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\PMB Files
2009-09-06 19:00 . 2009-09-07 03:48 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2009-09-06 18:59 . 2009-09-06 18:59 -------- d-----w- c:\program files\Pando Networks
2009-09-05 01:18 . 2009-09-13 21:17 -------- d-----w- c:\documents and settings\Mom\Tracing
2009-08-26 22:17 . 2009-08-26 22:17 -------- d-----w- c:\program files\Trend Micro
2009-08-21 22:36 . 2009-08-21 22:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-08-20 18:43 . 2009-08-20 18:43 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\Downloaded Installations
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-15 13:04 . 2008-11-06 20:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-09-13 16:37 . 2004-10-22 00:27 -------- d-----w- c:\program files\Java
2009-09-10 18:51 . 2005-10-23 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-10 18:43 . 2005-10-23 18:10 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\Lavasoft
2009-09-10 18:32 . 2004-10-22 21:12 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-10 15:00 . 2009-07-08 20:00 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-08 17:23 . 2009-04-22 23:52 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-08 16:59 . 2006-05-24 22:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-08 01:46 . 2005-04-23 20:34 52848 ----a-w- c:\documents and settings\HP_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-05 02:14 . 2009-07-23 20:59 -------- d-----w- c:\documents and settings\Mom\Application Data\Delicious IE Extension
2009-09-02 00:54 . 2007-04-09 01:12 -------- d-----w- c:\program files\World of Warcraft
2009-08-24 23:00 . 2004-10-22 01:37 -------- d-----w- c:\program files\Common Files\SureThing Shared
2009-08-24 22:53 . 2009-03-17 20:49 -------- d-----w- c:\program files\Bonjour
2009-08-21 13:27 . 2005-04-28 23:18 -------- d-----w- c:\program files\interMute
2009-08-08 01:14 . 2009-08-08 01:14 2168320 ----a-w- c:\windows\SET9F.tmp
2009-08-05 09:01 . 2004-11-03 18:50 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 18:50 . 2009-07-29 03:56 -------- d-----w- c:\program files\Microsoft Windows OneCare Live
2009-07-26 22:57 . 2009-07-26 22:57 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\IObit
2009-07-26 22:57 . 2009-07-26 22:57 -------- d-----w- c:\program files\IObit
2009-07-22 02:21 . 2009-07-09 03:15 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\Delicious IE Extension
2009-07-22 01:40 . 2009-05-06 14:25 -------- d-----w- c:\program files\Safari
2009-07-22 01:37 . 2009-07-22 01:36 -------- d-----w- c:\program files\iTunes
2009-07-22 01:36 . 2009-07-22 01:36 -------- d-----w- c:\program files\iPod
2009-07-22 01:36 . 2007-09-07 01:44 -------- d-----w- c:\program files\Common Files\Apple
2009-07-22 01:34 . 2004-10-22 01:58 -------- d-----w- c:\program files\QuickTime
2009-07-17 19:01 . 2004-11-03 19:19 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2004-10-21 23:36 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-06-29 16:12 . 2004-11-03 18:52 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-11-03 19:19 17408 ------w- c:\windows\system32\corpol.dll
2009-06-29 16:12 . 2004-11-03 18:50 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-25 08:25 . 2004-11-03 18:52 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-11-03 18:50 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-11-03 18:50 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-11-03 18:50 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-11-03 18:50 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-11-03 18:50 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 15:43 . 2009-01-13 20:17 831488 ----a-w- c:\windows\RtlExUpd.dll
2009-06-24 11:18 . 2004-10-21 23:35 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-22 22:39 . 2009-01-13 20:17 1482752 ----a-w- c:\windows\RtlUpd.exe
2005-05-01 18:49 . 2005-05-01 18:49 0 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 14:55 1090816 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-06 39408]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2004-10-22 180269]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-13 163840]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-13 135168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-13 2007832]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2007-7-14 221247]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-13 16:22 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^palstart.exe]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\palstart.exe
backup=c:\windows\pss\palstart.exeCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=c:\windows\pss\Updates from HP.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^HP Organize.lnk]
path=c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\HP Organize.lnk
backup=c:\windows\pss\HP Organize.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^SpamSubtract.lnk]
path=c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\SpamSubtract.lnk
backup=c:\windows\pss\SpamSubtract.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^SpySubtract.lnk]
path=c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\SpySubtract.lnk
backup=c:\windows\pss\SpySubtract.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SymWSC"=2 (0x2)
"Software Jukebox v2.0 Service"=3 (0x3)
"MDM"=2 (0x2)
"LightScribeService"=2 (0x2)
"iPod Service"=3 (0x3)
"ewido security suite control"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
"SNDSrvc"=3 (0x3)
"Pml Driver HPZ12"=2 (0x2)
"ose"=3 (0x3)
"gusvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Netscape\\Netscape Browser\\netscape.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Quicken\\qw.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\Program Files\\Wild Divine\\Wild Divine.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
"6881:TCP"= 6881:TCP:Blizzard Downloader
"6999:TCP"= 6999:TCP:Blizzard Downloader
"6882:TCP"= 6882:TCP:Blizzard Downloader
"6883:TCP"= 6883:TCP:Blizzard Downloader
"6884:TCP"= 6884:TCP:Blizzard Downloader
"6885:TCP"= 6885:TCP:Blizzard Downloader
"6886:TCP"= 6886:TCP:Blizzard Downloader
"6887:TCP"= 6887:TCP:Blizzard Downloader
"6888:TCP"= 6888:TCP:Blizzard Downloader
"6889:TCP"= 6889:TCP:Blizzard Downloader
"6890:TCP"= 6890:TCP:Blizzard Downloader
"6891:TCP"= 6891:TCP:Blizzard Downloader
"6892:TCP"= 6892:TCP:Blizzard Downloader
"6893:TCP"= 6893:TCP:Blizzard Downloader
"6894:TCP"= 6894:TCP:Blizzard Downloader
"6895:TCP"= 6895:TCP:Blizzard Downloader
"689:TCP"= 689:TCP:Blizzard Downloader
"6896:TCP"= 6896:TCP:Blizzard Downloader
"6897:TCP"= 6897:TCP:Blizzard Downloader
"6898:TCP"= 6898:TCP:Blizzard Downloader
"6899:TCP"= 6899:TCP:Blizzard Downloader
"6900:TCP"= 6900:TCP:Blizzard Downloader
"6901:TCP"= 6901:TCP:Blizzard Downloader
"6902:TCP"= 6902:TCP:Blizzard Downloader
"6903:TCP"= 6903:TCP:Blizzard Downloader
"6904:TCP"= 6904:TCP:Blizzard Downloader
"6905:TCP"= 6905:TCP:Blizzard Downloader
"6906:TCP"= 6906:TCP:Blizzard Downloader
"6907:TCP"= 6907:TCP:Blizzard Downloader
"6908:TCP"= 6908:TCP:Blizzard Downloader
"6909:TCP"= 6909:TCP:Blizzard Downloader
"6809:TCP"= 6809:TCP:Blizzard Downloader
"6910:TCP"= 6910:TCP:Blizzard Downloader
"6911:TCP"= 6911:TCP:Blizzard Downloader
"6912:TCP"= 6912:TCP:Blizzard Downloader
"6913:TCP"= 6913:TCP:Blizzard Downloader
"6914:TCP"= 6914:TCP:Blizzard Downloader
"6915:TCP"= 6915:TCP:Blizzard Downloader
"6916:TCP"= 6916:TCP:Blizzard Downloader
"6917:TCP"= 6917:TCP:Blizzard Downloader
"6918:TCP"= 6918:TCP:Blizzard Downloader
"6919:TCP"= 6919:TCP:Blizzard Downloader
"6920:TCP"= 6920:TCP:Blizzard Downloader
"6921:TCP"= 6921:TCP:Blizzard Downloader
"6922:TCP"= 6922:TCP:Blizzard Downloader
"6923:TCP"= 6923:TCP:Blizzard Downloader
"6924:TCP"= 6924:TCP:Blizzard Downloader
"6925:TCP"= 6925:TCP:Blizzard Downloader
"6926:TCP"= 6926:TCP:Blizzard Downloader
"6927:TCP"= 6927:TCP:Blizzard Downloader
"6928:TCP"= 6928:TCP:Blizzard Downloader
"6929:TCP"= 6929:TCP:Blizzard Downloader
"6930:TCP"= 6930:TCP:Blizzard Downloader
"6931:TCP"= 6931:TCP:Blizzard Downloader
"6932:TCP"= 6932:TCP:Blizzard Downloader
"6933:TCP"= 6933:TCP:Blizzard Downloader
"6934:TCP"= 6934:TCP:Blizzard Downloader
"6935:TCP"= 6935:TCP:Blizzard Downloader
"6936:TCP"= 6936:TCP:Blizzard Downloader
"6937:TCP"= 6937:TCP:Blizzard Downloader
"6938:TCP"= 6938:TCP:Blizzard Downloader
"6939:TCP"= 6939:TCP:Blizzard Downloader
"6940:TCP"= 6940:TCP:Blizzard Downloader
"6941:TCP"= 6941:TCP:Blizzard Downloader
"6942:TCP"= 6942:TCP:Blizzard Downloader
"6943:TCP"= 6943:TCP:Blizzard Downloader
"6944:TCP"= 6944:TCP:Blizzard Downloader
"6945:TCP"= 6945:TCP:Blizzard Downloader
"6946:TCP"= 6946:TCP:Blizzard Downloader
"6947:TCP"= 6947:TCP:Blizzard Downloader
"6948:TCP"= 6948:TCP:Blizzard Downloader
"6949:TCP"= 6949:TCP:Blizzard Downloader
"6950:TCP"= 6950:TCP:Blizzard Downloader
"6951:TCP"= 6951:TCP:Blizzard Downloader
"6952:TCP"= 6952:TCP:Blizzard Downloader
"6953:TCP"= 6953:TCP:Blizzard Downloader
"6954:TCP"= 6954:TCP:Blizzard Downloader
"6955:TCP"= 6955:TCP:Blizzard Downloader
"6956:TCP"= 6956:TCP:Blizzard Downloader
"6957:TCP"= 6957:TCP:Blizzard Downloader
"6958:TCP"= 6958:TCP:Blizzard Downloader
"6959:TCP"= 6959:TCP:Blizzard Downloader
"6960:TCP"= 6960:TCP:Blizzard Downloader
"6961:TCP"= 6961:TCP:Blizzard Downloader
"6962:TCP"= 6962:TCP:Blizzard Downloader
"6963:TCP"= 6963:TCP:Blizzard Downloader
"6964:TCP"= 6964:TCP:Blizzard Downloader
"6965:TCP"= 6965:TCP:Blizzard Downloader
"6966:TCP"= 6966:TCP:Blizzard Downloader
"6967:TCP"= 6967:TCP:Blizzard Downloader
"6968:TCP"= 6968:TCP:Blizzard Downloader
"6969:TCP"= 6969:TCP:Blizzard Downloader
"6970:TCP"= 6970:TCP:Blizzard Downloader
"6971:TCP"= 6971:TCP:Blizzard Downloader
"6972:TCP"= 6972:TCP:Blizzard Downloader
"6973:TCP"= 6973:TCP:Blizzard Downloader
"6974:TCP"= 6974:TCP:Blizzard Downloader
"6975:TCP"= 6975:TCP:Blizzard Downloader
"6976:TCP"= 6976:TCP:Blizzard Downloader
"6977:TCP"= 6977:TCP:Blizzard Downloader
"6978:TCP"= 6978:TCP:Blizzard Downloader
"6979:TCP"= 6979:TCP:Blizzard Downloader
"6980:TCP"= 6980:TCP:Blizzard Downloader
"6981:TCP"= 6981:TCP:Blizzard Downloader
"6982:TCP"= 6982:TCP:Blizzard Downloader
"6983:TCP"= 6983:TCP:Blizzard Downloader
"6984:TCP"= 6984:TCP:Blizzard Downloader
"6985:TCP"= 6985:TCP:Blizzard Downloader
"6986:TCP"= 6986:TCP:Blizzard Downloader
"6987:TCP"= 6987:TCP:Blizzard Downloader
"6988:TCP"= 6988:TCP:Blizzard Downloader
"6989:TCP"= 6989:TCP:Blizzard Downloader
"6990:TCP"= 6990:TCP:Blizzard Downloader
"6991:TCP"= 6991:TCP:Blizzard Downloader
"6992:TCP"= 6992:TCP:Blizzard Downloader
"6993:TCP"= 6993:TCP:Blizzard Downloader
"6994:TCP"= 6994:TCP:Blizzard Downloader
"6995:TCP"= 6995:TCP:Blizzard Downloader
"6996:TCP"= 6996:TCP:Blizzard Downloader
"6997:TCP"= 6997:TCP:Blizzard Downloader
"6998:TCP"= 6998:TCP:Blizzard Downloader
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/13/2009 11:22 AM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/13/2009 11:22 AM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/13/2009 11:21 AM 297752]
.
Contents of the 'Scheduled Tasks' folder
2009-09-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
2009-09-08 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-11-03 00:12]
2009-09-15 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-17 19:13]
2009-09-15 c:\windows\Tasks\User_Feed_Synchronization-{5F225D75-952B-4890-9966-74FE79ADCC13}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 23:36]
.
.
------- Supplementary Scan -------
.
uLocal Page = \blank.htm
uStart Page =
hxxp://www.facebook.com/cheryl.sanderhilluSearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL =
hxxp://www.google.com/ieuInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add To HP Organize... - c:\progra~1\HEWLET~1\HPORGA~1\bin/module.main/favorites\ie_add_to.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} -
hxxp://download.eset.com/special/eos/OnlineScanner.cab.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Turbine Download Manager Tray Icon - c:\program files\Turbine\Turbine Download Manager\TurbineDownloadManagerIcon.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-09-15 09:28
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2009-09-15 9:31
ComboFix-quarantined-files.txt 2009-09-15 14:31
Pre-Run: 102,401,114,112 bytes free
Post-Run: 102,932,361,216 bytes free
2760 --- E O F --- 2009-09-11 03:56
OTHER PROBLEMS: Computer fails to recognize me as "Administrator" for certain tasks accessed from 'Control Panel'
I mistyped: It was not I who named the above mentioned suspicious txt file.
QUESTIONS:
1. Does ComboFix take care of problems identified with Kaspersky Scan?
2. Are you aware that I do not ever use Outlook email, or Outlook Express? I use Yahoomail. I did deleted all sent mail in yahoomail, and emptied my trash and spam folders in Yahoo, should I will try to open Outlook email now and clean up any emails.
3. Is Netscape/Firefox safer to use as browser than Explorer?