ComboFix 13-03-21.02 - Paul 03/23/2013  10:18:18.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1022.667 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Paul\Application Data\PriceGong
c:\documents and settings\Paul\Application Data\PriceGong\Data\1.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\10.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\11102.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\12884.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\1391.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\16894.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\16961.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\1707.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\17672.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\17781.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\17941.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\1858.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\20384.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\20973.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\2130.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\21410.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\2229.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\2255.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\2967.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\3368.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\412.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\413.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\4343.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\4379.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\4436.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\4457.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\4489.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\450.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\4703.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\473.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\4873.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\5352.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\7033.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\8193.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\83.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\9362.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\9514.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\9566.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\9572.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\9576.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\969.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\a.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\b.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\c.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\d.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\e.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\f.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\g.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\h.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\i.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\j.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\k.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\l.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\m.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Paul\Application Data\PriceGong\Data\n.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\o.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\p.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\q.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\r.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\s.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\t.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\u.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\v.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\w.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\x.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\y.txt
c:\documents and settings\Paul\Application Data\PriceGong\Data\z.txt
c:\documents and settings\Paul\WINDOWS
c:\program files\CouponAlert_2pEI
c:\program files\CouponAlert_2pEI\Installr\1.bin\2pEIPlug.dll
c:\program files\CouponAlert_2pEI\Installr\1.bin\2pEZSETP.dll
c:\program files\CouponAlert_2pEI\Installr\1.bin\NP2pEISb.dll
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\549104fc0527b6f0.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\WindowsUpdate.log
.
.
(((((((((((((((((((((((((   Files Created from 2013-02-23 to 2013-03-23  )))))))))))))))))))))))))))))))
.
.
2013-03-22 07:19 . 2013-03-22 07:19	60872	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{07481442-2323-495A-B9B1-21EECD63150E}\offreg.dll
2013-03-22 07:16 . 2013-03-15 07:21	7108640	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{07481442-2323-495A-B9B1-21EECD63150E}\mpengine.dll
2013-03-21 21:41 . 2013-02-12 00:32	12928	------w-	c:\windows\system32\dllcache\usb8023x.sys
2013-03-21 21:41 . 2013-02-12 00:32	12928	------w-	c:\windows\system32\dllcache\usb8023.sys
2013-03-20 05:34 . 2009-03-19 19:07	14336	----a-w-	c:\windows\system32\dllcache\svchost.exe
2013-03-20 05:34 . 2009-03-19 19:07	169984	----a-w-	c:\windows\system32\dllcache\msconfig.exe
2013-03-20 05:34 . 2009-03-19 19:07	507904	----a-w-	c:\windows\system32\dllcache\winlogon.exe
2013-03-20 05:34 . 2009-03-19 19:07	1414656	----a-w-	c:\windows\system32\dllcache\mmc.exe
2013-03-20 05:34 . 2009-03-19 19:07	514560	----a-w-	c:\windows\system32\dllcache\logonui.exe
2013-03-20 05:34 . 2009-03-19 19:07	13312	----a-w-	c:\windows\system32\dllcache\lsass.exe
2013-03-20 05:34 . 2009-03-19 19:07	15360	----a-w-	c:\windows\system32\dllcache\logoff.exe
2013-03-20 05:34 . 2009-03-19 19:07	389120	----a-w-	c:\windows\system32\dllcache\cmd.exe
2013-03-20 05:34 . 2009-03-19 19:07	146432	----a-w-	c:\windows\system32\dllcache\regedit.exe
2013-03-20 05:34 . 2009-03-19 19:07	1033728	----a-w-	c:\windows\system32\dllcache\explorer.exe
2013-03-20 05:34 . 2009-03-19 19:07	33280	----a-w-	c:\windows\system32\dllcache\rundll32.exe
2013-03-20 05:34 . 2009-03-19 19:07	26112	----a-w-	c:\windows\system32\dllcache\userinit.exe
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-19 09:58 . 2007-03-01 01:36	6954968	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2013-02-12 00:32 . 2008-09-04 20:12	12928	------w-	c:\windows\system32\drivers\usb8023x.sys
2013-02-12 00:32 . 2005-08-16 10:18	12928	----a-w-	c:\windows\system32\drivers\usb8023.sys
2013-02-05 20:05 . 2005-08-16 10:18	916480	----a-w-	c:\windows\system32\wininet.dll
2013-02-05 20:05 . 2005-08-16 10:18	43520	----a-w-	c:\windows\system32\licmgr10.dll
2013-02-05 20:05 . 2005-08-16 10:18	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-02-05 05:53 . 2005-08-16 10:18	385024	----a-w-	c:\windows\system32\html.iec
2013-01-26 03:55 . 2005-08-16 10:18	552448	----a-w-	c:\windows\system32\oleaut32.dll
2013-01-17 06:28 . 2009-10-03 12:24	232336	------w-	c:\windows\system32\MpSigStub.exe
2013-01-07 01:19 . 2005-08-16 10:18	2148864	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-01-07 00:37 . 2004-08-04 04:59	2027520	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-01-04 01:20 . 2005-08-16 10:18	1867264	----a-w-	c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2005-08-16 10:18	1292288	----a-w-	c:\windows\system32\quartz.dll
2008-11-15 01:12 . 2008-11-15 01:12	122880	----a-w-	c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01	122512	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-12-21 519584]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-03-09 17:09	63712	----a-w-	c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-06 07:52	59240	----a-w-	c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-11-28 20:13	59280	----a-w-	c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
2008-04-24 18:25	202560	----a-w-	c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-08-29 03:57	395776	----a-w-	c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 11:20	122940	----a-w-	c:\windows\system32\DLA\DLACTRLW.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2006-07-06 13:15	151552	----a-w-	c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 22:50	221184	----a-w-	c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 22:15	81920	----a-w-	c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-11-29 06:49	151952	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
2008-12-12 18:46	9555968	----a-w-	c:\program files\MySpace\IM\MySpaceIM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2007-09-17 14:07	8491008	----a-w-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-10-25 09:12	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-07-24 16:20	282624	----a-w-	c:\windows\stsystra.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 17:44	248552	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [12/23/2011 5:43 PM 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12/23/2011 5:43 PM 314456]
R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys [12/16/2011 10:18 AM 228208]
R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [3/11/2012 1:48 PM 71440]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [3/11/2012 1:48 PM 164112]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/23/2011 5:43 PM 20568]
R2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [6/11/2012 4:22 PM 193616]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [6/11/2012 4:22 PM 240208]
S3 RapportIaso;RapportIaso;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\28896\RapportIaso.sys [8/8/2011 10:53 AM 21520]
S3 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [3/11/2012 1:48 PM 56208]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-03-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:57]
.
2013-03-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
2013-03-23 c:\windows\Tasks\User_Feed_Synchronization-{B2FCF550-DBC3-4B69-A4C5-4DB8897E4B7C}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
------- Supplementary Scan -------
.
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0061117
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MI1933~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 8.8.8.8 8.8.4.4 [removed]
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{B2BF7B3F-BF0B-4C48-AEC6-F92C51BE63E1} - (no file)
MSConfigStartUp-AVG_TRAY - c:\program files\AVG\AVG2012\avgtray.exe
MSConfigStartUp-COMODO Internet Security - c:\program files\COMODO\COMODO Internet Security\cfp.exe
MSConfigStartUp-vProt - c:\program files\AVG Secure Search\vprot.exe
AddRemove-HijackThis - c:\bwht202\HijackThis.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-03-23 10:38
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-343818398-1004336348-839522115-500_Classes\Software\CLASSES\CLSID\{25EB5E92-21B4-AF9A-CF56-99DD81D12200}*\InprocServer32]
"{25EB5E92-21B4-AF9A-CF56-99DD81D12200}"=hex:c9,18,b0,bc,db,b6,1f,e3,12,b4,43,
   1d,1a,b0,db,42,db,fb,44,f4,2e,b6,32,c6,c9,18,b0,bc,db,b6,1f,e3,c9,18,b0,bc,\
.
[HKEY_USERS\S-1-5-21-343818398-1004336348-839522115-500_Classes\Software\CLASSES\CLSID\{772C157C-6EA6-0BEC-779D-78172C930E9F}*\InprocServer32]
"{772C157C-6EA6-0BEC-779D-78172C930E9F}"=hex:ce,fb,c2,cb,c4,83,53,66,bd,cb,18,
   95,5a,e8,36,85,2e,dd,7c,f1,80,2c,d7,e7,ce,fb,c2,cb,c4,83,53,66,ce,fb,c2,cb,\
.
[HKEY_USERS\S-1-5-21-343818398-1004336348-839522115-500_Classes\Software\CLASSES\CLSID\{7FFBE496-6CB5-91E2-7653-8972D7475AFE}*\InprocServer32]
"{7FFBE496-6CB5-91E2-7653-8972D7475AFE}"=hex:1e,0f,d1,30,6c,e5,63,8f,39,9c,3d,
   dc,41,2b,12,26,92,c9,ec,f8,ef,3d,9c,ee,1e,0f,d1,30,6c,e5,63,8f,1e,0f,d1,30,\
.
[HKEY_USERS\S-1-5-21-343818398-1004336348-839522115-500_Classes\Software\CLASSES\CLSID\{9DBE6176-ED89-74C1-8C99-1FAA08DDDE0A}*\InprocServer32]
"{9DBE6176-ED89-74C1-8C99-1FAA08DDDE0A}"=hex:47,83,88,a8,ca,21,f4,e8,72,8b,96,
   66,5b,ba,36,7e,de,b9,a3,3d,d2,71,4c,a1,47,83,88,a8,ca,21,f4,e8,47,83,88,a8,\
.
[HKEY_USERS\S-1-5-21-343818398-1004336348-839522115-500_Classes\Software\CLASSES\CLSID\{BE1F9496-943E-3CC1-DCDE-7313DE3E1097}*\InprocServer32]
"{BE1F9496-943E-3CC1-DCDE-7313DE3E1097}"=hex:b7,5d,70,6a,df,96,53,09,3d,7a,1d,
   d4,4d,96,35,93,1d,1d,11,b3,98,76,71,48,b7,5d,70,6a,df,96,53,09,b7,5d,70,6a,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2264)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2013-03-23  10:52:32 - machine was rebooted
ComboFix-quarantined-files.txt  2013-03-23 15:52
.
Pre-Run: 189,872,779,264 bytes free
Post-Run: 190,211,694,592 bytes free
.
- - End Of File - - 8B186552700083A3AAF2C50E000918CE