Thanks for being so patient. Here's the new Combo log.
ComboFix 10-05-10.02 - Jay 05/10/2010 23:02:02.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1918.840 [GMT -5:00]
Running from: c:\users\Jay\Desktop\ComboFix.exe
Command switches used :: c:\users\Jay\Desktop\CFScript.txt
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2010-04-11 to 2010-05-11 )))))))))))))))))))))))))))))))
.
2010-05-11 04:10 . 2010-05-11 04:10 -------- d-----w- c:\users\Jay\AppData\Local\temp
2010-05-11 04:10 . 2010-05-11 04:10 -------- d-----w- c:\users\Sophia\AppData\Local\temp
2010-05-11 04:10 . 2010-05-11 04:10 -------- d-----w- c:\users\Sarah\AppData\Local\temp
2010-05-11 04:10 . 2010-05-11 04:10 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-11 04:10 . 2010-05-11 04:10 -------- d-----w- c:\users\Profiles\AppData\Local\temp
2010-05-11 04:10 . 2010-05-11 04:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-11 04:10 . 2010-05-11 04:10 -------- d-----w- c:\users\Adriana\AppData\Local\temp
2010-05-09 15:42 . 2010-05-09 15:42 -------- d-----w- c:\windows\Internet Logs
2010-05-09 00:14 . 2010-05-09 00:14 63488 ----a-w- c:\users\Jay\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-05-09 00:14 . 2010-05-09 00:14 52224 ----a-w- c:\users\Jay\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-05-09 00:14 . 2010-05-09 00:14 117760 ----a-w- c:\users\Jay\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-09 00:14 . 2010-05-09 00:14 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2010-05-09 00:13 . 2010-05-09 00:14 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-05-09 00:13 . 2010-05-09 00:13 -------- d-----w- c:\users\Jay\AppData\Roaming\SUPERAntiSpyware.com
2010-05-09 00:09 . 2010-05-09 00:09 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-05-08 23:44 . 2010-05-08 23:45 8206880 ----a-w- c:\users\Jay\SUPERAntiSpyware.exe
2010-05-08 22:13 . 2010-05-08 22:13 -------- d-----w- c:\users\Sophia\AppData\Local\Mozilla
2010-05-08 22:13 . 2010-05-08 22:13 -------- d-----w- c:\users\Sophia\AppData\Roaming\CheckPoint
2010-05-08 21:16 . 2010-05-08 21:16 -------- d-----w- c:\users\Adriana\AppData\Roaming\CheckPoint
2010-05-08 20:46 . 2010-05-08 20:46 -------- d-----w- c:\users\Jay\AppData\Roaming\CheckPoint
2010-05-08 16:44 . 2010-05-08 16:44 -------- d-----w- c:\users\Jay\AppData\Roaming\Malwarebytes
2010-05-08 16:43 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-08 16:43 . 2010-05-08 16:43 -------- d-----w- c:\programdata\Malwarebytes
2010-05-08 16:43 . 2010-05-08 16:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-08 16:43 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-08 16:43 . 2010-05-08 16:43 6153352 ----a-w- c:\users\Jay\mbam-setup-1.46.exe
2010-05-08 04:48 . 2010-05-08 04:48 388096 ----a-r- c:\users\Jay\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-05-08 04:48 . 2010-05-08 04:48 -------- d-----w- c:\program files\Trend Micro
2010-05-08 03:22 . 2010-02-04 15:53 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-08 03:20 . 2010-05-08 03:20 -------- dc-h--w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-05-08 03:20 . 2010-02-04 15:53 2954656 -c--a-w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-05-08 02:20 . 2010-05-08 02:20 -------- d-----w- c:\programdata\PCPitstop
2010-05-08 02:19 . 2010-05-08 02:19 -------- d-----w- c:\program files\PCPitstop
2010-05-08 02:19 . 2010-05-08 02:19 2103688 ----a-w- c:\users\Jay\extermhome-setup-0004.exe
2010-05-05 02:58 . 2010-05-07 03:36 -------- d-----w- c:\users\Jay\AppData\Local\kifrpgaah
2010-04-28 03:13 . 2009-12-23 12:43 171520 ----a-w- c:\windows\system32\wintrust.dll
2010-04-28 03:13 . 2010-02-23 11:32 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-28 03:13 . 2010-02-23 11:32 78848 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-28 03:13 . 2010-02-23 11:32 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-28 03:12 . 2010-01-15 00:04 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-25 16:19 . 2010-05-04 20:17 439816 ----a-w- c:\users\Adriana\AppData\Roaming\Real\Update\setup3.10\setup.exe
2010-04-23 11:30 . 2010-04-23 11:30 690952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-04-20 20:49 . 2010-04-20 20:49 242696 ----a-w- c:\programdata\avg9\update\backup\avgtdix.sys
2010-04-20 20:48 . 2010-04-20 20:48 1689952 ----a-w- c:\programdata\avg9\update\backup\avgupd.dll
2010-04-16 23:30 . 2010-04-16 23:30 -------- d-----w- c:\users\Sarah\AppData\Local\Apple
2010-04-16 23:26 . 2010-04-16 23:26 -------- d-----w- c:\users\Sarah\AppData\Local\Google
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-11 03:45 . 2009-09-09 02:19 -------- d-----w- c:\program files\CCleaner
2010-05-08 23:51 . 2009-06-01 00:22 680 ----a-w- c:\users\Jay\AppData\Local\d3d9caps.dat
2010-05-08 04:32 . 2007-02-09 14:31 -------- d-----w- c:\program files\Yahoo!
2010-05-08 03:20 . 2007-05-29 04:37 -------- d-----w- c:\program files\Lavasoft
2010-05-08 03:19 . 2008-03-15 02:10 -------- d-----w- c:\programdata\Lavasoft
2010-05-05 04:18 . 2007-02-09 14:13 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-20 20:49 . 2009-03-20 14:49 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-03-27 18:42 . 2010-03-27 18:42 -------- d-----w- c:\users\Sophia\AppData\Roaming\HP
2010-03-21 23:11 . 2010-03-21 23:11 -------- d-----w- c:\users\Sophia\AppData\Roaming\Corel
2010-03-21 23:09 . 2010-03-21 23:09 161784 ----a-w- c:\users\Sophia\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-20 17:15 . 2010-03-20 17:15 -------- d-----w- c:\users\Sarah\AppData\Roaming\Hewlett-Packard
2010-03-20 17:15 . 2010-03-20 17:15 161784 ----a-w- c:\users\Sarah\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-20 16:43 . 2010-03-20 16:43 -------- d-----w- c:\users\Sophia\AppData\Roaming\Hewlett-Packard
2010-03-16 17:24 . 2010-03-16 17:24 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-03-16 17:24 . 2007-12-17 04:46 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-16 17:23 . 2009-03-20 14:49 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-14 17:56 . 2007-10-07 04:17 -------- d-----w- c:\programdata\NVIDIA
2010-03-14 17:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2010-03-14 17:45 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-03-14 17:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-03-14 17:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2010-03-14 17:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2010-03-14 17:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2010-03-14 17:44 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2010-03-14 17:28 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-03-05 14:01 . 2010-04-28 03:14 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-26 04:23 . 2009-12-10 23:24 439816 ----a-w- c:\users\Adriana\AppData\Roaming\Real\Update\setup3.09\setup.exe
2010-02-26 04:23 . 2009-11-19 22:20 439816 ----a-w- c:\users\Adriana\AppData\Roaming\Real\Update\recsetup\setup.exe
2010-02-26 04:23 . 2009-11-19 22:20 118784 ----a-w- c:\users\Adriana\AppData\Roaming\Real\Update\recsetup\install.dll
2010-02-23 06:39 . 2010-04-28 03:14 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-28 03:14 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 06:33 . 2010-04-28 03:14 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 04:55 . 2010-04-28 03:14 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-21 17:14 . 2010-02-21 17:14 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-02-20 23:39 . 2010-03-14 17:01 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:37 . 2010-03-14 17:01 31232 ----a-w- c:\windows\system32\httpapi.dll
2010-02-20 21:18 . 2010-03-14 17:01 411136 ----a-w- c:\windows\system32\drivers\http.sys
2010-02-18 17:36 . 2010-04-28 03:14 902024 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-02-18 17:36 . 2010-04-28 03:14 220040 ----a-w- c:\windows\system32\drivers\netio.sys
2010-02-18 17:36 . 2010-04-28 03:14 98192 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2010-02-18 14:49 . 2010-04-28 03:14 3598216 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-18 14:49 . 2010-04-28 03:14 3545992 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-18 14:11 . 2010-04-28 03:14 190464 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-02-18 13:59 . 2010-04-28 03:14 438272 ----a-w- c:\windows\system32\IKEEXT.DLL
2010-02-18 13:59 . 2010-04-28 03:14 595456 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2010-02-18 13:57 . 2010-04-28 03:14 328704 ----a-w- c:\windows\system32\BFE.DLL
2010-02-18 11:52 . 2010-04-28 03:14 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-02-14 20:23 . 2010-02-14 20:23 15602656 ----a-w- c:\programdata\WildTangent\My HP Game Console\Downloads\en-us\Installers\SetupGamesClient.exe
2007-09-14 15:52 . 2007-05-26 03:13 168 --sha-r- c:\windows\System32\463E71A001.sys
2007-09-26 22:28 . 2007-09-26 22:28 8 --sha-r- c:\windows\System32\62EDB37D45.sys
2007-11-10 03:20 . 2007-05-26 03:13 5586 --sha-w- c:\windows\System32\KGyGaAvL.sys
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\users\Jay\AppData\Local\kifrpgaah ----
---- Directory of c:\windows\system32\config\systemprofile\AppData\Local\fgahubprm ----
((((((((((((((((((((((((((((( SnapShot@2010-05-09_06.07.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-02-09 14:44 . 2010-05-10 23:26 70446 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2010-05-10 23:26 76446 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-04-17 16:12 . 2010-05-10 23:26 20094 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-98606152-2322820237-3812329491-1001_UserData.bin
+ 2007-04-16 00:23 . 2010-05-10 04:26 16194 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-98606152-2322820237-3812329491-1000_UserData.bin
+ 2010-05-09 06:14 . 2010-05-09 06:14 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
- 2007-04-16 00:30 . 2010-05-09 05:34 65536 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-04-16 00:30 . 2010-05-11 03:45 65536 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-05-09 06:14 . 2010-05-09 06:14 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat
+ 2010-05-09 06:14 . 2010-05-09 06:14 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat
+ 2010-05-09 06:14 . 2010-05-09 06:12 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012010050920100510\index.dat
- 2007-04-16 00:30 . 2010-05-09 05:34 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-04-16 00:30 . 2010-05-11 03:45 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-05-06 21:54 . 2010-05-10 23:28 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-05-06 21:54 . 2010-05-08 20:40 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-05-06 21:54 . 2010-05-10 23:28 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-05-06 21:54 . 2010-05-08 20:40 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-05-06 21:54 . 2010-05-10 23:28 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-05-06 21:54 . 2010-05-08 20:40 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-06-13 21:31 . 2010-05-09 05:34 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-06-13 21:31 . 2010-05-10 23:23 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-06-13 21:31 . 2010-05-09 05:34 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-06-13 21:31 . 2010-05-10 23:23 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-06-13 21:31 . 2010-05-09 05:34 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-06-13 21:31 . 2010-05-10 23:23 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2006-11-02 10:25 . 2010-05-08 20:45 51200 c:\windows\inf\infpub.dat
+ 2006-11-02 10:25 . 2010-05-09 15:27 51200 c:\windows\inf\infpub.dat
+ 2005-03-21 16:00 . 2005-03-21 16:00 4096 c:\windows\System32\sabprocenum.sys
- 2010-05-09 05:34 . 2010-05-09 05:34 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-05-10 23:23 . 2010-05-10 23:23 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-05-10 23:23 . 2010-05-10 23:23 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-05-09 05:34 . 2010-05-09 05:34 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-10-22 21:57 . 2010-05-10 12:17 224770 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2006-11-02 10:33 . 2010-05-09 05:41 600026 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2010-05-10 23:29 600026 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-05-09 05:41 102704 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2010-05-10 23:29 102704 c:\windows\System32\perfc009.dat
+ 2009-05-02 22:04 . 2010-05-11 03:22 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-05-02 22:04 . 2010-05-09 05:34 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2006-11-02 10:25 . 2010-05-09 15:27 143360 c:\windows\inf\infstrng.dat
- 2006-11-02 10:25 . 2010-05-08 20:45 143360 c:\windows\inf\infstrng.dat
+ 2006-11-02 10:25 . 2010-05-09 15:27 143360 c:\windows\inf\infstor.dat
- 2006-11-02 10:25 . 2010-05-08 20:45 143360 c:\windows\inf\infstor.dat
+ 2009-05-14 20:41 . 2009-05-14 20:41 380144 c:\windows\Downloaded Program Files\sabspx.dll
- 2007-04-16 00:30 . 2010-05-09 05:34 2375680 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-04-16 00:30 . 2010-05-11 03:45 2375680 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-04-16 00:30 . 2010-05-08 02:03 3516560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2007-04-16 00:30 . 2010-05-10 15:31 3516560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-08 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Google Update"="c:\users\Jay\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-01-18 135664]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2006-11-20 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"OmniForm OFPA"="c:\program files\ScanSoft\OmniForm 5.1\OFPA.exe" [2004-10-22 40960]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"eFax 4.3"="c:\program files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 116224]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-05-23 526880]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"ReminderApp"="c:\program files\Nova Development\Greeting Card Factory Photo Card Maker\ReminderApp.exe" [2006-11-02 156160]
c:\users\Jay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote Table Of Contents.onetoc2 [2007-4-23 3656]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
eFax 4.3.lnk - c:\program files\eFax Messenger 4.3\J2GTray.exe [2007-12-30 629248]
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=c:\windows\pss\Acrobat Assistant.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^File Equalization.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\File Equalization.lnk
backup=c:\windows\pss\File Equalization.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Connections.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Connections.lnk
backup=c:\windows\pss\HP Connections.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Jay^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\users\Jay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2006-10-05 21:00 976472 ----a-w- c:\program files\Common Files\Adobe\Updater\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPADVISOR]
2009-08-05 17:27 1644088 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 15:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
2007-12-07 07:33 8720384 ----a-w- c:\program files\MySpace\IM\MySpaceIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 11:24 286720 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-01-15 16:26 4874240 ----a-w- c:\windows\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-30 22:43 4670704 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
2008-09-12 23:46 160160 ----a-w- c:\program files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiSpywareOverride"=dword:00000001
"VistaSp2"=hex(b):df,97,e9,2b,9f,ad,ca,01
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 135664]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-05-08 1285864]
R4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [2008-10-21 77312]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-02-04 64288]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-03-16 216200]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-04-20 242896]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-06 68168]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-03-16 308064]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2009-03-20 391168]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
2010-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 02:30]
2010-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 02:30]
2010-05-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-98606152-2322820237-3812329491-1000Core.job
- c:\users\Jay\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-18 00:24]
2010-05-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-98606152-2322820237-3812329491-1000UA.job
- c:\users\Jay\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-18 00:24]
2010-05-10 c:\windows\Tasks\User_Feed_Synchronization-{A33FFD7E-FEBA-4F4C-B531-771E4DA0075F}.job
- c:\windows\system32\msfeedssync.exe [2010-04-28 04:54]
2010-05-11 c:\windows\Tasks\User_Feed_Synchronization-{BF3CA32A-137A-48CC-BECC-909820732A8B}.job
- c:\windows\system32\msfeedssync.exe [2010-04-28 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?hl=en
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: microsoft.com\office
FF - ProfilePath - c:\users\Jay\AppData\Roaming\Mozilla\Firefox\Profiles\7ls655jk.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Sony Online Entertainment\npsoe.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Jay\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-05-10 23:10
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-05-10 23:13:06
ComboFix-quarantined-files.txt 2010-05-11 04:13
ComboFix2.txt 2010-05-10 04:39
ComboFix3.txt 2010-05-09 06:11
Pre-Run: 396,162,977,792 bytes free
Post-Run: 396,114,362,368 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 0801F8E4797ADA3F0AA09939D1501A23
