ComboFix 12-04-01.01 - Admin 04/02/2012   8:14.5.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1014.359 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Admin\My Documents\~WRL0003.tmp
.
.
(((((((((((((((((((((((((   Files Created from 2012-03-02 to 2012-04-02  )))))))))))))))))))))))))))))))
.
.
2012-03-29 17:39 . 2012-03-29 17:39	--------	d-----w-	c:\documents and settings\Administrator\Local Settings\Application Data\Apple
2012-03-29 14:58 . 2012-03-29 14:58	--------	d-----w-	c:\documents and settings\Admin\.amu
2012-03-19 18:13 . 2012-03-19 18:13	592824	----a-w-	c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-19 18:13 . 2012-03-19 18:13	44472	----a-w-	c:\program files\Mozilla Firefox\mozglue.dll
2012-03-08 20:22 . 2012-03-08 20:22	--------	d-sh--w-	c:\documents and settings\Administrator\PrivacIE
2012-03-08 16:00 . 2012-03-08 16:00	--------	d-----w-	c:\program files\ESET
2012-03-08 13:00 . 2012-03-08 13:00	--------	d-sh--w-	c:\documents and settings\Administrator\IETldCache
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-06 23:15 . 2010-06-29 12:09	41184	----a-w-	c:\windows\avastSS.scr
2012-03-06 23:15 . 2010-04-16 19:08	201352	----a-w-	c:\windows\system32\aswBoot.exe
2012-03-06 23:03 . 2011-04-12 19:39	612184	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2012-03-06 23:03 . 2010-04-16 19:08	337880	----a-w-	c:\windows\system32\drivers\aswSP.sys
2012-03-06 23:02 . 2010-04-16 19:08	35672	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2012-03-06 23:01 . 2010-04-16 19:08	53848	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2012-03-06 23:01 . 2010-04-16 19:08	95704	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2012-03-06 23:01 . 2010-04-16 19:08	89048	----a-w-	c:\windows\system32\drivers\aswmon.sys
2012-03-06 23:01 . 2010-04-16 19:08	20696	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2012-03-06 22:58 . 2010-04-16 19:08	24920	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2012-03-01 16:40 . 2011-05-20 12:14	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-03 09:22 . 2004-08-11 22:00	1860096	----a-w-	c:\windows\system32\win32k.sys
2012-01-11 19:46 . 2007-12-10 19:13	3833856	----a-w-	c:\windows\system32\cdintf300.dll
2012-01-11 19:06 . 2012-02-15 03:32	3072	------w-	c:\windows\system32\iacenc.dll
2012-01-09 16:20 . 2004-08-11 22:11	139784	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-03-19 18:13 . 2011-04-29 18:47	97208	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15	123536	----a-w-	c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 249856]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-07-05 421888]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2011-09-30 2215768]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-11-01 273528]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2011-11-9 5927768]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2011-11-9 1156968]
QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks 2011\QBW32.EXE [2011-11-9 1178984]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2012-03-01 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-07 11:59	548352	----a-w-	c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	lsdelete\0aswBoot.exe /M:9de00e492c
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\klmdb.sys]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-03-09 15:09	63712	----a-w-	c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 20:07	2260480	-c----w-	c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2012-03-01 16:34	4617600	----a-w-	c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-08-12 18:08	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"DefWatch"=2 (0x2)
"Norton AntiVirus Server"=2 (0x2)
"gusvc"=2 (0x2)
"gupdate1ca1b7814002fe4"=2 (0x2)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"getPlus(R) Helper"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2011\\QBDBMgrN.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/1/2009 11:24 AM 64160]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/12/2011 3:39 PM 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/16/2010 3:08 PM 337880]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [9/3/2008 3:07 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/3/2008 3:07 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [7/7/2010 7:57 AM 116608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/16/2010 3:08 PM 20696]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\nlssrv32.exe [1/11/2012 9:51 AM 63488]
R2 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe [11/9/2011 11:59 AM 1248256]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [12/30/2009 4:01 PM 173880]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S2 FileOpenManagerSvc;FileOpenManagerSvc;c:\documents and settings\All Users\Application Data\FileOpen\Services\FileOpenManagerSvc32.exe [3/9/2011 6:02 PM 212352]
S3 DM150Drv;DM150Drv;c:\windows\system32\DRIVERS\DM150Drv.sys --> c:\windows\system32\DRIVERS\DM150Drv.sys [?]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [3/2/2012 10:35 AM 27064]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/3/2008 3:07 PM 12872]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
S4 gupdate1ca1b7814002fe4;Google Update Service (gupdate1ca1b7814002fe4);c:\program files\Google\Update\GoogleUpdate.exe [8/12/2009 2:09 PM 133104]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 58229048
*NewlyCreated* - 85248713
*NewlyCreated* - 95522647
*Deregistered* - 58229048
*Deregistered* - 85248713
*Deregistered* - 95522647
*Deregistered* - aswMBR
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-04-02 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 16:20]
.
2012-04-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-12 21:56]
.
2012-03-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-4215862493-3628503015-1209958882-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-03-30 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-4215862493-3628503015-1209958882-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-04-01 c:\windows\Tasks\User_Feed_Synchronization-{AF93C447-799D-4F27-8EA4-58669910ECD3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Supplementary Scan -------
.
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc-rel&channel=us
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{B9BE426B-2943-4A18-93A0-04B503EA33CB}: NameServer = 10.4.0.242
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\42okgmqg.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - yahoo.com
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-02 08:22
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(732)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2012-04-02  08:28:04
ComboFix-quarantined-files.txt  2012-04-02 12:28
.
Pre-Run: 88,887,410,688 bytes free
Post-Run: 88,875,266,048 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 722B19455E69EC0C13DE675DCA0AEBB7