ComboFix 09-01-21.04 - Victor 2009-01-30 23:00:26.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.583 [GMT 0:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe AV: AVG Anti-Virus *On-access scanning disabled* (Updated) * Created a new restore point . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\alxres.dll . ((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-30 ))))))))))))))))))))))))))))))) . 2009-01-30 22:40 . 2009-01-30 22:50 4,958,588 --a------ c:\windows\{00000005-00000000-00000008-00001102-00000004-20021102}.BAK 2009-01-30 22:39 . 2009-01-30 22:39 d-------- C:\_OTScanIt 2009-01-22 23:04 . 2009-01-30 22:45 280 --a------ c:\windows\system32\PDBootState 2009-01-22 21:29 . 2009-01-22 21:29 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-22 21:29 . 2009-01-22 21:29 d-------- c:\documents and settings\Victor\Application Data\Malwarebytes 2009-01-22 21:29 . 2009-01-22 21:29 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-22 21:29 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-22 21:29 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-01-22 20:12 . 2009-01-22 20:12 d-------- c:\program files\Trend Micro 2009-01-22 18:53 . 2009-01-23 14:23 d-------- c:\program files\SecondLife 2009-01-22 17:52 . 2009-01-22 17:52 d-------- c:\program files\Xvid 2009-01-22 17:52 . 2008-12-13 20:01 77,824 --a------ c:\windows\system32\xvid.ax 2009-01-22 17:48 . 2009-01-22 17:49 d-------- c:\program files\QuickTime 2009-01-15 08:19 . 2009-01-15 08:19 1,253,376 --a------ c:\windows\system32\NvPVEnc.ax 2009-01-13 16:49 . 2009-01-27 21:00 d-------- c:\documents and settings\Victor\Application Data\SecondLife 2009-01-10 21:31 . 2009-01-10 21:31 d-------- c:\program files\Microsoft Silverlight 2009-01-09 22:29 . 2009-01-09 22:29 0 -rahs---- C:\khs 2009-01-08 19:53 . 2009-01-08 19:53 346 --a------ c:\windows\system32\MRT.INI 2009-01-08 19:46 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui 2009-01-05 16:18 . 2009-01-05 16:18 90,112 --a------ c:\windows\system32\QuickTimeVR.qtx 2009-01-05 16:18 . 2009-01-05 16:18 57,344 --a------ c:\windows\system32\QuickTime.qts 2008-12-27 01:59 . 2008-12-27 01:59 d-------- c:\documents and settings\Victor\Application Data\Ascaron Entertainment 2008-12-27 01:59 . 2008-12-27 01:59 53,760 --a------ c:\windows\system32\drivers\SSHDRV76.sys 2008-12-27 01:56 . 2008-12-27 01:56 d-------- c:\program files\Ascaron Entertainment 2008-12-23 23:52 . 2008-12-23 23:52 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-19 15:39 . 2008-12-19 15:39 81,920 --a------ c:\windows\system32\frapsvid.dll 2008-12-18 04:03 . 2008-12-18 04:03 d-------- c:\program files\Real 2008-12-18 04:03 . 2008-12-18 04:03 d-------- c:\program files\Common Files\xing shared 2008-12-18 04:03 . 2008-12-18 04:03 d-------- c:\program files\Common Files\Real 2008-12-16 17:24 . 2008-12-16 17:24 0 --a------ c:\windows\ui.INI 2008-12-16 17:21 . 2004-02-17 01:15 221,184 -ra------ c:\windows\system32\ps1gMiniDrv.dll 2008-12-16 17:21 . 2002-04-24 04:41 196,608 -ra------ c:\windows\system32\PS1DMiniDrv.dll 2008-12-16 17:21 . 2003-02-18 22:38 17,504 -ra------ c:\windows\system32\drivers\gt680x.sys 2008-12-16 17:21 . 2002-09-06 01:29 7,314 -ra------ c:\windows\system32\drivers\PS1Dfw.usb 2008-12-16 17:21 . 2004-04-07 05:19 7,295 -ra------ c:\windows\system32\drivers\PS1gfw.usb 2008-12-16 17:16 . 2008-12-16 17:16 d-------- c:\program files\Trust 2008-12-16 17:16 . 2001-06-09 02:14 332,800 --a------ c:\windows\system\hhctrl.ocx 2008-12-16 17:16 . 2000-06-02 03:41 176,128 --a------ c:\windows\system32\PuzzSaver.scr 2008-12-16 17:16 . 2000-06-02 03:40 172,032 --a------ c:\windows\system32\SpotSaver.scr 2008-12-16 17:16 . 2001-06-09 02:15 169,120 --a------ c:\windows\system\itircl.dll 2008-12-16 17:16 . 1999-12-27 06:05 135,168 --a------ c:\windows\system32\ParaSaver.scr 2008-12-16 17:16 . 2001-06-09 02:15 124,336 --a------ c:\windows\system\itss.dll 2008-12-16 17:03 . 2008-12-16 17:03 0 --a------ c:\windows\WATCH.INI 2008-12-16 16:43 . 2009-01-30 22:42 588 --a------ c:\windows\system32\settingsbkup.sfm 2008-12-16 16:43 . 2009-01-30 22:42 588 --a------ c:\windows\system32\settings.sfm 2008-12-16 15:57 . 2008-12-16 15:57 d-------- c:\program files\Bonjour 2008-12-12 11:18 . 2008-12-12 11:18 87,336 --a------ c:\windows\system32\dns-sd.exe 2008-12-12 11:11 . 2008-12-12 11:11 61,440 --a------ c:\windows\system32\dnssd.dll 2008-12-11 05:25 . 2008-12-11 05:25 d-------- c:\program files\NVIDIA nTune Performance Application 2008-12-09 00:56 . 2008-12-09 00:56 d-------- c:\program files\Common Files\BioWare 2008-12-09 00:40 . 2008-12-09 00:57 d-------- c:\program files\Mass Effect 2008-12-06 09:04 . 2008-12-06 09:04 d-------- c:\program files\Eidos 2008-12-03 06:46 . 2009-01-30 22:42 30,528 --a------ c:\windows\system32\BMXBkpCtrlState-{00000005-00000000-00000008-00001102-00000004-20021102}.rfx 2008-12-03 06:46 . 2009-01-30 22:42 11,564 --a------ c:\windows\system32\DVCState-{00000005-00000000-00000008-00001102-00000004-20021102}.rfx 2008-12-03 06:38 . 2009-01-15 08:19 206,793 --a------ c:\windows\system32\nvapps.nvb 2008-12-03 06:29 . 2008-12-03 06:29 d-------- c:\program files\SystemRequirementsLab . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-30 22:40 --------- d-----w c:\documents and settings\Victor\Application Data\uTorrent 2009-01-30 01:55 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2009-01-29 02:07 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-01-28 20:52 --------- d-----w c:\documents and settings\Victor\Application Data\Skype 2009-01-28 19:35 --------- d-----w c:\documents and settings\Victor\Application Data\skypePM 2009-01-16 09:31 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-01-13 16:31 --------- d-----w c:\documents and settings\Victor\Application Data\LimeWire 2009-01-11 00:40 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-01-10 22:09 --------- d-----w c:\program files\Google 2009-01-08 09:44 10,520 ----a-w c:\windows\system32\avgrsstx.dll 2009-01-08 09:44 --------- d-----w c:\documents and settings\All Users\Application Data\avg8 2009-01-08 09:43 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys 2009-01-08 09:43 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-01-07 11:28 453,152 ----a-w c:\windows\system32\NVUNINST.EXE 2009-01-02 06:21 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-01-02 06:08 --------- d-----w c:\program files\CCleaner 2008-12-23 23:52 --------- d-----w c:\program files\Java 2008-12-18 04:03 499,712 ----a-w c:\windows\system32\msvcp71.dll 2008-12-16 15:56 --------- d-----w c:\program files\Safari 2008-12-11 05:26 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-11 05:25 --------- d-----w c:\program files\NVIDIA Corporation 2008-12-11 05:25 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-07 19:27 --------- d-----w c:\program files\Common Files\Nero 2008-12-07 19:27 --------- d-----w c:\documents and settings\All Users\Application Data\Nero 2008-12-04 21:46 180,224 ----a-w c:\windows\system32\xvidvfw.dll 2008-12-04 21:42 815,104 ----a-w c:\windows\system32\xvidcore.dll 2008-12-03 06:45 --------- d-----w c:\program files\Creative 2008-12-03 06:44 444,952 ----a-w c:\windows\system32\wrap_oal.dll 2008-12-03 06:44 109,080 ----a-w c:\windows\system32\OpenAL32.dll 2008-12-03 06:40 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-12-03 06:40 --------- d-----w c:\program files\LimeWire 2008-12-03 06:40 --------- d-----w c:\program files\LegendCityOnline 2008-12-03 06:40 --------- d-----w c:\program files\Growler Guncam 2008-12-03 06:40 --------- d-----w c:\program files\exPressit S.E. 2.1 2008-12-03 06:40 --------- d-----w c:\program files\eMule 2008-12-03 06:40 --------- d-----w c:\program files\DivX 2008-12-03 06:40 --------- d-----w c:\program files\Common Files\Vbox 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll 2008-10-27 08:34 108,144 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 14:12 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 14:07 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-07 13:33 286,720 ----a-w c:\windows\system32\nvnt4cpl.dll 2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-03-19 21:39 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat 2008-05-23 05:01 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008052320080524\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-14 68856] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 217544] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952] "NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-23 136600] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-08 1601304] "EPSON Stylus C64 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE" [2003-09-12 99840] "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640] "RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.11\RivaTuner.exe" [2008-09-16 2715648] "RivaTuner"="c:\program files\RivaTuner v2.11\RivaTuner.exe" [2008-09-16 2715648] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 c:\windows\system32\CTXFIHLP.EXE] "nwiz"="nwiz.exe" [2009-01-15 c:\windows\system32\nwiz.exe] "CTHelper"="CTHELPER.EXE" [2008-06-27 c:\windows\system32\CtHelper.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Victor\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-14 113664] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-14 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-01-08 09:44 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\[u]0[/u]autocheck autochk * [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk backup=c:\windows\pss\PalTalk.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 01:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] --a------ 2007-01-01 21:22 3739648 c:\program files\Google\Google Talk\googletalk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager] --a------ 2007-02-08 01:12 488984 c:\program files\Common Files\logishrd\LComMgr\Communications_Helper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] --a------ 2007-02-08 01:13 774168 c:\program files\Logitech\QuickCam10\QuickCam10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX] --a------ 2007-02-06 17:43 252704 c:\program files\Common Files\logishrd\LComMgr\LVComSX.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2009-01-05 16:18 413696 c:\program files\QuickTime\QTTask.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\SecondLife\\SLVoice.exe"= "c:\\Program Files\\SecondLife\\SecondLife.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Curious Labs\\Poser 6\\Poser.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Paltalk Messenger\\paltalk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\SpacialAudio\\SAMBC\\SAMBC.exe"= "c:\\Program Files\\GlobalSCAPE\\CuteFTP 8 Professional\\ftpte.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"= "c:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-03-17 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-03-17 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-03-17 107272] R1 SSHDRV76;SSHDRV76;c:\windows\system32\drivers\SSHDRV76.sys [2008-12-27 53760] R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2008-06-27 99352] R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2008-06-27 555032] R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2008-06-27 566296] R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-08 903960] R4 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-08 298264] R4 PD91Agent;PD91Agent;c:\program files\Raxco\PerfectDisk2008\PD91Agent.exe [2008-09-09 693512] R4 SVKP;SVKP;c:\windows\system32\SVKP.sys [2008-03-26 2368] S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2008-06-27 99352] S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2008-06-27 555032] S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2008-06-27 100888] S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2008-06-27 100888] S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2008-06-27 566296] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-08-04 31592] S3 PD91Engine;PD91Engine;c:\program files\Raxco\PerfectDisk2008\PD91Engine.exe [2008-09-09 906504] S3 PD91VMDefrag;PD91VMDefrag;c:\program files\Raxco\PerfectDisk2008\PD91VMDefrag.exe [2008-02-29 226568] S4 PostgreSQL;PostgreSQL Database Server;"c:\program files\PostgreSQL\8.0-beta2-dev3\bin\pg_ctl.exe" runservice -N "PostgreSQL" -D "c:\program files\PostgreSQL\8.0-beta2-dev3\data\" --> c:\program files\PostgreSQL\8.0-beta2-dev3\bin\pg_ctl.exe [?] . Contents of the 'Scheduled Tasks' folder 2009-01-27 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.startrek-gamers.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Victor\Application Data\Mozilla\Firefox\Profiles\fhw30t2e.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.startrek-gamers.com/ FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-30 23:00:34 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = CTHELPER.EXE? scanning hidden files ... ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-776561741-796845957-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:cd,79,bf,50,5a,c3,0a,69,77,ac,58,d9,02,3e,8a,78,41,e9,9c,e6,67,2f,0a, f1,7b,92,dd,64,cf,11,5f,88,f1,63,97,c1,cb,33,21,ac,ab,7c,0a,6d,09,ad,91,ff,\ "??"=hex:cf,f6,2c,fb,e5,13,f3,85,ec,4f,8d,0e,8b,05,f6,75 [HKEY_USERS\S-1-5-21-776561741-796845957-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:5b,ca,43,48,65,ff,82,42,bc,91,bf,c6,e7,e5,37,92,ed,a3,a7,b2,f6, 47,01,7d,b9,e9,c2,24,1f,a5,3c,99,6d,03,c8,40,f1,0c,71,40,52,a0,c1,b0,75,0f,\ "rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb . Completion time: 2009-01-30 23:03:46 ComboFix-quarantined-files.txt 2009-01-30 23:02:29 Pre-Run: 60,998,344,704 bytes free Post-Run: 61,053,722,624 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 283