I forgot to mention that video also isn't working. I posted two Combofix reports because I forgot where the first report was until I ran the second. It seems like there were changes made to the second so I thought it might be important to share. Thanks
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Wednesday, April 29, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Wednesday, April 29, 2009 00:57:39
Records in database: 2088355
——————————————————————————–
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
H:\
I:\
K:\
L:\
Scan statistics:
Files scanned: 366182
Threat name: 12
Infected objects: 32
Suspicious objects: 0
Duration of the scan: 14:02:49
File name / Threat name / Threats count
C:\Documents and Settings\Charles\Desktop\My M Fruit\templates\TM 15000\15492.rar Infected: Trojan-Downloader.JS.Psyme.me 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\digiwet.dll.vir Infected: Trojan-Downloader.Win32.Injecter.cru 1
F:\Desktop\Desktop\exe\ca_setup.exe Infected: not-a-virus:PSWTool.Win32.Cain.281 1
F:\Desktop\Desktop\exe\ca_setup.exe Infected: not-a-virus:PSWTool.Win32.Cain.284 1
F:\Desktop\Desktop\exe\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
F:\Desktop\Desktop\exe\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
F:\Desktop\Desktop\exe\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
F:\Desktop\Desktop\exe\SysinternalsSuite.zip Infected: not-a-virus:RiskTool.Win32.PsKill.ba 1
F:\Desktop\Desktop\password cracker\brutus-aet2.zip Infected: not-a-virus:PSWTool.Win32.Brutus 1
F:\Desktop\Desktop\password cracker\ca_setup.exe Infected: not-a-virus:PSWTool.Win32.Cain.281 2
F:\Desktop\Desktop\password cracker\ca_setup.exe Infected: not-a-virus:PSWTool.Win32.Cain.284 1
F:\Desktop\Desktop\password cracker\ophcrack-win32-installer-2.3.4.exe Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
F:\Desktop\Desktop\password cracker\ophcrack-win32-installer-2.3.4.exe Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
F:\Desktop\Desktop\password cracker\ophcrack-win32-installer-2.3.4.exe Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
F:\Desktop\Desktop\password cracker\rainbowcrack-1.2-win.zip Infected: not-a-virus:PSWTool.Win32.Rainbow.12.a 4
F:\exe\eprs.exe Infected: not-a-virus:PSWTool.Win32.OEPass.l 1
F:\exe\ophcrack-livecd-1.1.3.iso Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
F:\exe\ophcrack-livecd-1.1.3.iso Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
F:\exe\ophcrack-livecd-1.1.3.iso Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
F:\exe\ophcrack-win32-installer-2.3.3.exe Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
F:\exe\ophcrack-win32-installer-2.3.3.exe Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
F:\exe\ophcrack-win32-installer-2.3.3.exe Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
F:\Programs and Games\TM 15000+\15492.rar Infected: Trojan-Downloader.JS.Psyme.me 1
K:\AutoPlay\Programs\Font_Fitting_Room_Deluxe_v2.8.6.8\Font Fitting Room Deluxe v2.8.6.8\ffr_deluxe_setup.exe Infected: Backdoor.Win32.VB.eut 1
The selected area was scanned.
—————————————————————
DDS (Ver_09-03-16.01) - NTFSx86
Run by [removed] at 10:07:08.07 on Wed 04/29/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_13
============== Running Processes ===============
============== Pseudo HJT Report ===============
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://search.orbitdownloader.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: HelperObject Class: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 8\SnagItBHO.dll
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: CDelHotkeys Object: {78875f5c-a685-4405-8dc5-d48dc65452b0} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.16.0\gears.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 8\SnagItIEAddin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: &RoboForm;: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll
TB: Delicious Toolbar: {61d1c847-df80-423a-8c6d-dc03b97e6ebe} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
TB: Copernic Desktop Search - Home Toolbar: {4a1c6093-14f9-44d7-860e-5d265cfca9d9} - c:\program files\copernic desktop search 2\toolbar\ToolbarContainer101000048.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
EB: Copernic Desktop Search - Home Toolbar: {4a1c6093-14f9-44d7-860e-5d265cfca9d9} - c:\program files\copernic desktop search 2\toolbar\ToolbarContainer101000048.dll
EB: Copernic Desktop Search - Home: {9c3fca1f-99e3-48f2-a7f4-dd3931b2f99a} - c:\program files\copernic desktop search 2\DeskbandIntegration301000049.dll
EB: Delicious Sidebar: {9d19c405-ba93-461b-871f-97992cc45972} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMBgMonitor.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [Google Update] "c:\documents and settings\charles\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Taskbar Shuffle] c:\program files\taskbar shuffle\taskbarshuffle.exe
uRun: [Copernic Desktop Search - Home] "c:\program files\copernic desktop search 2\DesktopSearchService.exe" /tray
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [U.S. Robotics Wireless Manager UI] c:\windows\system32\WLTRAY
mRun: [Easy Synchronization] c:\program files\logitech\easy synchronization\LogitechEasySync.exe
mRun: [CloneCDTray] "c:\program files\slysoft\clonecd\CloneCDTray.exe" /s
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [TSM_AutoUpdate] c:\program files\talkswitch\talkswitch configuration 6.10\TSAutoUpdate.exe
mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRunOnce: [Easy Synchronization] c:\program files\logitech\easy synchronization\LogitechEasySync.exe –ports
dRun: [Nokia.PCSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog
StartupFolder: c:\docume~1\charles\startm~1\programs\startup\digsby.lnk - c:\program files\digsby\digsby.exe
StartupFolder: c:\docume~1\charles\startm~1\programs\startup\ding!.lnk - c:\program files\southwest airlines\ding\Ding.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\launchy.lnk - c:\program files\launchy\Launchy.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: &AIM; Toolbar Search - c:\documents and settings\all users\application data\aim toolbar\ietoolbar\resources\en-us\local\search.html
IE: &Download; by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab; video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: Add to EverNote - c:\program files\evernote\evernote\enbar.dll/2000
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Do&wnload; selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load; all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\npjpi160_13.dll
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.16.0\gears.dll
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {2C887991-08F0-11DC-A9B2-0012F0B227DD} - {B8D8B1D0-83AF-451B-8CD9-8F1BF4ED8FEA} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
IE: {2C887992-08F0-11DC-A9B2-0012F0B227DD} - {9D19C405-BA93-461b-871F-97992CC45972} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
IE: {2C887993-08F0-11DC-A9B2-0012F0B227DD} - {4D3D441F-9543-4941-B664-2EDCF9FC1B56} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {36ECAF82-3300-8F84-092E-AFF36D6C7040} - {86529161-034E-4F8A-88D2-3C625E612E04} - c:\program files\winhttrack\WinHTTrackIEBar.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {9DB8BAE2-CDA0-4b06-8E0D-8B2FD46F03D9} - {674CC1A8-3A39-421B-B075-68FA80DDAB9C} - c:\program files\third globe\ifetcher\WFF_IE_TBExtension.dll
IE: {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - {2151DA8C-C5B6-4B4F-86AB-BDA449BF8747} - c:\program files\evernote\evernote\enbar.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {07246F83-6D48-4559-81EC-117CBAE54F1B} - hxxp://workspace.office.live.com/Misc/Microsoft.OfficeLive.Workspace.RichUpload.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} - hxxp://host.cycore.net/plugins/windows/ie/Cult3D_IE_5.3.0.228.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/OnlineScanner.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} - hxxp://support.f-secure.com/ols3beta/fscax.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {94B82441-A413-4E43-8422-D49930E69764} - hxxps://chat2.j2.com/Media/VisitorchatEnu/TLIEFlash.CAB
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: avgrsstarter - avgrsstx.dll
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: ShellExecuteHook class: {fe24cd78-7c63-465d-8787-4edf7fc79895} - c:\program files\logitech\easy synchronization\shellexecutehook.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\charles\applic~1\mozilla\firefox\profiles\h5n2m1p0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrie7&query;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.orbitdownloader.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrab&query;=
============= SERVICES / DRIVERS ===============
=============== Created Last 30 ================
2009-04-28 13:10 0 a——- c:\windows\system32\extxerox.dll
2009-04-27 17:14 10,520 a——- c:\windows\system32\avgrsstx.dll
2009-04-27 17:14 325,640 a——- c:\windows\system32\drivers\avgldx86.sys
2009-04-27 17:14 108,552 a——- c:\windows\system32\drivers\avgtdix.sys
2009-04-27 17:14 –d—– c:\windows\system32\drivers\Avg
2009-04-27 17:13 –d—– c:\program files\AVG
2009-04-27 16:39 161,792 a——- c:\windows\SWREG.exe
2009-04-27 16:39 98,816 a——- c:\windows\sed.exe
2009-04-27 12:09 –d—– c:\windows\NV30841144.TMP
2009-04-27 12:07 135,168 a——- c:\windows\system32\RtlCPAPI.dll
2009-04-27 12:05 –d—– c:\windows\system32\Migration
2009-04-27 11:59 2,500 a——- c:\windows\system32\wpa.bak
2009-04-27 11:50 230 a——- c:\windows\system32\spupdsvc.inf
2009-04-25 00:22 664 a——- c:\windows\system32\d3d9caps.dat
2009-04-24 23:52 488 a—hr– c:\windows\system32\logonui.exe.manifest
2009-04-24 23:52 749 a—hr– c:\windows\WindowsShell.Manifest
2009-04-24 23:52 749 a—hr– c:\windows\system32\wuaucpl.cpl.manifest
2009-04-24 23:52 749 a—hr– c:\windows\system32\sapi.cpl.manifest
2009-04-24 23:52 749 a—hr– c:\windows\system32\nwc.cpl.manifest
2009-04-24 23:52 749 a—hr– c:\windows\system32\ncpa.cpl.manifest
2009-04-24 23:24 14,573 a—-r– c:\windows\SET115.tmp
2009-04-24 23:23 13,753 a—-r– c:\windows\SETDA.tmp
2009-04-24 23:23 1,086,058 a—-r– c:\windows\SETC7.tmp
2009-04-24 23:23 1,042,903 a—-r– c:\windows\SETC3.tmp
2009-04-24 23:18 –d—– c:\windows\NV1988684.TMP
2009-04-24 21:32 14,573 a—-r– c:\windows\SET112.tmp
2009-04-24 21:31 13,753 a—-r– c:\windows\SETD5.tmp
2009-04-24 21:31 1,086,058 a—-r– c:\windows\SETC2.tmp
2009-04-24 21:31 1,042,903 a—-r– c:\windows\SETBE.tmp
2009-04-24 20:10 –d—– c:\windows\NV2004640.TMP
2009-04-24 19:17 14,573 a—-r– c:\windows\SET10F.tmp
2009-04-24 19:17 13,753 a—-r– c:\windows\SETD4.tmp
2009-04-24 19:17 1,086,058 a—-r– c:\windows\SETC1.tmp
2009-04-24 19:17 1,042,903 a—-r– c:\windows\SETBD.tmp
2009-04-24 18:33 14,573 a—-r– c:\windows\SET10C.tmp
2009-04-24 18:33 13,753 a—-r– c:\windows\SETD0.tmp
2009-04-24 18:33 1,086,058 a—-r– c:\windows\SETBF.tmp
2009-04-24 18:33 1,042,903 a—-r– c:\windows\SETBB.tmp
2009-04-24 17:15 –d—– c:\windows\NV2008120.TMP
2009-04-24 16:35 14,573 a—-r– c:\windows\SET106.tmp
2009-04-24 16:34 13,753 a—-r– c:\windows\SETCB.tmp
2009-04-24 16:34 1,086,058 a—-r– c:\windows\SETBC.tmp
2009-04-24 16:34 1,042,903 a—-r– c:\windows\SETB8.tmp
2009-04-24 16:18 14,573 a—-r– c:\windows\SET101.tmp
2009-04-24 16:18 13,753 a—-r– c:\windows\SETC6.tmp
2009-04-24 16:18 1,086,058 a—-r– c:\windows\SETBA.tmp
2009-04-24 16:18 1,042,903 a—-r– c:\windows\SETB7.tmp
2009-04-24 16:05 –d—– c:\windows\NV1992512.TMP
2009-04-24 11:53 14,573 a—-r– c:\windows\SET100.tmp
2009-04-24 11:53 13,753 a—-r– c:\windows\SETC5.tmp
2009-04-24 11:53 1,086,058 a—-r– c:\windows\SETB9.tmp
2009-04-24 11:53 1,042,903 a—-r– c:\windows\SETB6.tmp
2009-04-24 11:42 –d—– c:\windows\NV20041536.TMP
2009-04-24 11:20 14,573 a—-r– c:\windows\SET151.tmp
2009-04-24 11:20 13,753 a—-r– c:\windows\SET116.tmp
2009-04-24 11:20 1,086,058 a—-r– c:\windows\SET10A.tmp
2009-04-24 11:20 1,042,903 a—-r– c:\windows\SET107.tmp
2009-04-24 11:20 1,329,700 a——- c:\windows\setupapi.log.2.old
2009-04-22 00:02 156 a——- c:\windows\Twunk001.MTX
2009-04-22 00:02 2 a——- c:\windows\Twain001.Mtx
2009-04-22 00:02 0 a——- c:\windows\Twunk002.MTX
2009-04-20 12:11 –d-h— C:\$AVG8.VAULT$
2009-04-20 11:31 256 a——- c:\windows\system32\pool.bin
2009-04-20 11:31 –d—– c:\docume~1\charles\applic~1\Research In Motion
2009-04-20 09:59 –d—– c:\program files\Roxio
2009-04-20 09:59 –d—– c:\program files\common files\Sonic Shared
2009-04-20 09:59 26,496 a—-r– c:\windows\system32\drivers\RimSerial.sys
2009-04-20 09:58 –d—– c:\program files\common files\Research In Motion
2009-04-20 09:58 –d—– c:\program files\Research In Motion
2009-04-18 19:13 54,156 a—h— c:\windows\QTFont.qfn
2009-04-18 19:13 1,409 a——- c:\windows\QTFont.for
2009-04-18 10:52 –d—– c:\docume~1\alluse~1\applic~1\avg8
2009-04-15 22:17 –d—– c:\program files\TeraCopy
2009-04-15 12:03 2,560 a——- c:\windows\system32\xpsp4res.dll
2009-04-07 18:27 –d—– c:\program files\common files\DivX Shared
2009-04-04 10:03 0 a——- C:\OrbPVR.db
==================== Find3M ====================
2009-04-27 12:06 24,064 a——- c:\windows\autoload.exe
2009-03-20 22:59 60,048 a—h— c:\windows\system32\mlfcache.dat
2009-03-20 11:50 3,358,720 a——- c:\windows\system32\GPhotos.scr
2009-03-16 14:18 517,448 a——- c:\windows\system32\XAudio2_4.dll
2009-03-16 14:18 235,352 a——- c:\windows\system32\xactengine3_4.dll
2009-03-16 14:18 69,448 a——- c:\windows\system32\XAPOFX1_3.dll
2009-03-16 14:18 22,360 a——- c:\windows\system32\X3DAudio1_6.dll
2009-03-09 15:27 4,178,264 a——- c:\windows\system32\D3DX9_41.dll
2009-03-09 15:27 1,846,632 a——- c:\windows\system32\D3DCompiler_41.dll
2009-03-09 15:27 453,456 a——- c:\windows\system32\d3dx10_41.dll
2009-03-09 05:19 410,984 a——- c:\windows\system32\deploytk.dll
2009-03-03 12:19 39,184 a——- c:\windows\system32\drivers\TfSysMon.sys
2009-03-03 12:19 33,040 a——- c:\windows\system32\drivers\TfNetMon.sys
2009-03-03 12:19 12,560 a——- c:\windows\system32\drivers\TfKbMon.sys
2009-03-03 12:19 51,472 a——- c:\windows\system32\drivers\TfFsMon.sys
2009-02-24 12:34 90,112 a——- c:\windows\system32\dpl100.dll
2009-02-24 12:34 823,296 a——- c:\windows\system32\divx_xx0c.dll
2009-02-24 12:34 823,296 a——- c:\windows\system32\divx_xx07.dll
2009-02-24 12:34 815,104 a——- c:\windows\system32\divx_xx0a.dll
2009-02-24 12:34 802,816 a——- c:\windows\system32\divx_xx11.dll
2009-02-24 12:34 684,032 a——- c:\windows\system32\DivX.dll
2008-12-21 12:46 22,328 a——- c:\docume~1\charles\applic~1\PnkBstrK.sys
2008-10-31 23:55 47,360 a——- c:\docume~1\charles\applic~1\pcouffin.sys
2008-10-09 10:42 193,304 a——- c:\windows\inf\windrvr9.sys
2007-12-19 12:36 32 a——- c:\docume~1\alluse~1\applic~1\ezsid.dat
2006-05-03 02:06 163,328 a–shr– c:\windows\system32\flvDX.dll
2007-02-21 03:47 31,232 a–shr– c:\windows\system32\msfDX.dll
2007-12-17 05:43 27,648 a–sh— c:\windows\system32\Smab0.dll
2008-12-03 21:22 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008120320081204\index.dat
============= FINISH: 10:08:13.79 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-03-16.01)
==== Disk Partitions =========================
==== Disabled Device Manager Items =============
==== System Restore Points ===================
No restore point in system.
==== Installed Programs ======================
AAC Decoder
ABBYY FineReader 8.0 Professional Edition
Ad-Aware 2007
Adobe Acrobat 8 Professional - English, Français, Deutsch
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe ConnectNow Add-in
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 8.1.0
Adobe Setup
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Advanced PDF Password Recovery
AI RoboForm (All Users)
AIM 6
AIM Toolbar
Apple Software Update
Audacity 1.2.6
AutoHotkey 1.0.47.06
AutoUpdate
Avanquest update
AVG Free 8.5
Azureus Vuze
BlackBerry Desktop Software 4.7
Bluetooth Remote Control
Bonjour
Call of Duty® 4 - Modern Warfare™
CamStudio
Camtasia Studio 5
CCleaner (remove only)
CDDRV_Installer
ClamWin Free Antivirus 0.94.1
CloneCD
CloneDVD2
Codec Pack - All In 1 6.0.3.0
Command & Conquer
Compatibility Pack for the 2007 Office system
Copernic Desktop Search - Home
Counter-Strike: Source
Crysis®
Delicious Add-on for Internet Explorer
DeskSpace [removed] Trial
Digsby
DING!
Direct Show Ogg Vorbis Filter (remove only)
Disc2Phone
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Dropbox
DVD Flick [removed]
DVICO FusionHDTV 3.63.01
eFax Messenger
ElectricSheep 2.6.6
eMusic Download Manager 3.0
ESET Online Scanner
EverNote
EVGA Display Driver
F.lux
Far Cry 2
ffdshow [rev 2280] [2008-11-02]
FileZilla Client 3.1.0.1
Flickr Uploadr 3.0.5
FLV Player
Focus Magic
Fraps
GameSpy Comrade
Gears of War
GOM Player
Google Chrome
Google Gears
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
GoToMeeting 4.0.0.320
Graboid Video 1.3
GreenCheck 1.6.8
H.264 Decoder
Hamachi 1.0.2.1
HijackThis 2.0.2
Hotfix for Windows XP (KB916089)
iFetcher 1.2
ImgBurn
innotek VirtualBox
InterActual Player
Java™ 6 Update 13
KhalInstallWrapper
LaCie Backup Software v1.5.2378
LanUpdate
Launchy 2.1.2
LightScribe System Software 1.10.13.1
LightScribe Template Designs - Art Pack 1
LightScribe Template Designs - Business Pack 1
Logitech Desktop Messenger
Logitech Legacy USB Camera Driver Package
Logitech QuickCam
Logitech QuickCam Driver Package
Logitech SetPoint
Magic DVD Copier Version 4.9 build 5
Magic ISO Maker v5.3 (build 0216)
Malwarebytes' Anti-Malware
MediaMonkey 3.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft ActiveSync
Microsoft Games for Windows - LIVE Redistributable
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office FrontPage 2003
Microsoft Office Live Add-in beta
Microsoft Office Professional Edition 2003
Microsoft Office Visio Professional 2003
Microsoft SharedView
Microsoft Silverlight
Microsoft Virtual PC 2007
Microsoft Visual C++ 2005 Redistributable
MKV Splitter
Mobile Phone Suite Easy Synchronization
Mozilla ActiveX Control v1.7.12
Mozilla Firefox (3.0.9)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
MSXML 6 Service Pack 2 (KB954459)
MVision
Nero 8
Netgear Update Assistant
Nokia Connectivity Cable Driver
Nokia PC Suite
NVIDIA Drivers
NVIDIA PhysX v8.09.04
ooVoo
Opera 9.63
Orb
Orbit Downloader
PC Connectivity Solution
PDF Settings
Photosynth 2.0.1519.13
Picasa 3
Polyglot 3000 (Version 2.3)
PowerISO
PunkBuster Services
QuickBooks Premier: Mfg and Whsle Edition 2008
QuickTime
Rainmeter (remove only)
RapidLeecher Ultimate 2007
RealPlayer
Realtek High Definition Audio Driver
RescueTime 1.0.5
Rhapsody Player Engine
Roxio Media Manager
Safari
Security Update for CAPICOM (KB931906)
Security Update for Windows XP (KB923789)
Serious Samurize
SetPointPatch
Skype™ 4.0
Skype™ for Pocket PC 2.2
SmartFTP Client
SmartFTP Client 3.0 Setup Files (remove only)
SnagIt 8
Sony Ericsson Bluetooth Remote Control 3.01
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
SpywareBlaster 4.1
Start Killer
Sun™ Download Manager 2.0
SUPER © Version 2008.bld.30 (Mar 22, 2008)
SupportSoft Assisted Service
TalkSwitch 6.10
TalkSwitch USB Driver 2.0
Taskbar Shuffle version 2.5
TBS WMP Plug-in
TeamViewer 4
TeraCopy 2.0 beta 4a
The KMPlayer (remove only)
ThreatFire
Twingly Screensaver
U.S. Robotics Wireless MAXg Adapter
UltraISO Premium V8.62
Update Service
VC80CRTRedist - 8.0.50727.762
VideoLAN VLC media player 0.8.6d
Viewpoint Media Player
Visual C++ 8.0 ATL (x86) WinSXS MSM Beta2
Visual C++ 8.0 ATL.Policy (x86) WinSXS MSM Beta2
Visual C++ 8.0 CRT (x86) WinSXS MSM Beta2
Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM Beta2
Visual C++ 8.0 MFC (x86) WinSXS MSM Beta2
Visual C++ 8.0 MFC.Policy (x86) WinSXS MSM Beta2
WebFldrs XP
WIDCOMM Bluetooth Software
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
Windows Driver Package - Dvico (AvsBluebird) Media (06/22/2007 6.1.13.0)
Windows Driver Package - Dvico (CX88VID) Media (07/25/2007 6.1.00.1)
Windows Driver Package - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)
Windows Driver Package - Nokia Modem (02/15/2007 3.1)
Windows Driver Package - Nokia Modem (05/24/2007 6.84.0.1)
Windows Genuine Advantage Notifications (KB905474)
Windows Installer 3.1 (KB893803)
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Player 11
WinHTTrack Website Copier 3.41-3
WinPcap 4.0.2
WinRAR archiver
WinZip
WM Recorder 11.0
Write-N-Cite
XP Codec Pack
Xvid 1.1.3 final uninstall
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar
==== End Of File ===========================
ComboFix 09-04-27.02 - Charles 04/28/2009 13:06.7 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Charles\Desktop\CFScript.txt
FILE ::
c:\windows\system32\mscmotr.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\charles\local settings\application data\{A955A35E-59CA-42B9-B36B-4C046B1C2ACA}
c:\documents and settings\charles\local settings\application data\{A955A35E-59CA-42B9-B36B-4C046B1C2ACA}\chrome.manifest
c:\documents and settings\charles\local settings\application data\{A955A35E-59CA-42B9-B36B-4C046B1C2ACA}\chrome\content\_cfg.js
c:\documents and settings\charles\local settings\application data\{A955A35E-59CA-42B9-B36B-4C046B1C2ACA}\chrome\content\c.js
c:\documents and settings\charles\local settings\application data\{A955A35E-59CA-42B9-B36B-4C046B1C2ACA}\chrome\content\overlay.xul
c:\documents and settings\charles\local settings\application data\{A955A35E-59CA-42B9-B36B-4C046B1C2ACA}\install.rdf
c:\windows\IE4 Error Log.txt
c:\windows\Nqemoxazexowa.bin
c:\windows\Tlecihafewo.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Service_kbdclasss
((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-28 )))))))))))))))))))))))))))))))
.
2009-04-28 20:10 . 2009-04-28 20:10 0 —-a-w c:\windows\system32\extxerox.dll
2009-04-28 00:14 . 2009-04-28 00:14 10520 —-a-w c:\windows\system32\avgrsstx.dll
2009-04-28 00:14 . 2009-04-28 00:14 108552 —-a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-28 00:14 . 2009-04-28 00:14 325640 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-28 00:14 . 2009-04-28 16:57 ——– d—–w c:\windows\system32\drivers\Avg
2009-04-25 07:22 . 2009-04-25 07:22 664 —-a-w c:\windows\system32\d3d9caps.dat
2009-04-25 06:18 . 2009-04-25 06:18 ——– d—–w c:\windows\NV1988684.TMP
2009-04-25 06:07 . 2006-02-28 12:00 13312 -c–a-w c:\windows\system32\dllcache\irclass.dll
2009-04-25 06:07 . 2006-02-28 12:00 13312 —-a-w c:\windows\system32\irclass.dll
2009-04-25 06:07 . 2006-02-28 12:00 24661 -c–a-w c:\windows\system32\dllcache\spxcoins.dll
2009-04-25 06:07 . 2006-02-28 12:00 24661 —-a-w c:\windows\system32\spxcoins.dll
2009-04-25 03:10 . 2009-04-25 03:10 ——– d—–w c:\windows\NV2004640.TMP
2009-04-25 00:15 . 2009-04-25 00:16 ——– d—–w c:\windows\NV2008120.TMP
2009-04-24 23:05 . 2009-04-24 23:05 ——– d—–w c:\windows\NV1992512.TMP
2009-04-24 18:42 . 2009-04-24 18:42 ——– d—–w c:\windows\NV20041536.TMP
2009-04-23 04:18 . 2009-04-27 19:13 ——– d—–w c:\documents and settings\Charles\Local Settings\Application Data\MediaMonkey
2009-04-23 03:19 . 2009-04-23 03:19 ——– d—–w c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-04-22 07:02 . 2009-04-22 07:02 ——– d—–w c:\documents and settings\LocalService\Application Data\Roxio
2009-04-22 07:02 . 2009-04-22 07:05 ——– d—–w c:\documents and settings\Charles\Application Data\Roxio
2009-04-20 19:11 . 2009-04-28 19:54 ——– d–h–w C:\$AVG8.VAULT$
2009-04-20 18:31 . 2009-04-28 20:18 256 —-a-w c:\windows\system32\pool.bin
2009-04-20 18:31 . 2009-04-20 18:31 ——– d—–w c:\documents and settings\Charles\Application Data\Research In Motion
2009-04-20 17:01 . 2009-04-20 17:01 ——– d—–w c:\documents and settings\All Users\Application Data\InstallShield
2009-04-20 17:01 . 2009-04-20 17:01 ——– d—–w c:\documents and settings\All Users\Application Data\Sonic
2009-04-20 16:59 . 2009-04-20 16:59 ——– d—–w c:\program files\Common Files\Sonic Shared
2009-04-20 16:59 . 2009-04-25 05:29 ——– d—–w c:\documents and settings\All Users\Application Data\Roxio
2009-04-20 16:59 . 2009-04-20 17:00 ——– d—–w c:\program files\Roxio
2009-04-20 16:59 . 2009-04-20 17:00 ——– d—–w c:\program files\Common Files\Roxio Shared
2009-04-20 16:59 . 2007-01-18 17:24 26496 —-a-r c:\windows\system32\drivers\RimSerial.sys
2009-04-20 16:58 . 2009-04-20 16:58 ——– d—–w c:\program files\Common Files\Research In Motion
2009-04-20 16:58 . 2009-04-20 16:58 ——– d—–w c:\program files\Research In Motion
2009-04-18 17:52 . 2009-04-28 00:14 ——– d—–w c:\documents and settings\All Users\Application Data\avg8
2009-04-16 05:17 . 2009-04-16 05:17 ——– d—–w c:\program files\TeraCopy
2009-04-15 19:03 . 2008-05-03 11:55 2560 —-a-w c:\windows\system32\xpsp4res.dll
2009-04-08 01:27 . 2009-04-08 01:27 ——– d—–w c:\program files\Common Files\DivX Shared
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-28 20:17 . 2008-12-02 06:05 ——– d—–w c:\program files\Taskbar Shuffle
2009-04-28 20:03 . 2008-06-01 07:10 ——– d—–w c:\program files\Java
2009-04-28 00:13 . 2009-04-28 00:13 ——– d—–w c:\program files\AVG
2009-04-27 21:49 . 2007-09-22 02:56 92256 —-a-w c:\documents and settings\Charles\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-27 19:56 . 2007-09-22 05:40 ——– d—–w c:\program files\MediaMonkey
2009-04-27 19:07 . 2007-09-22 03:01 ——– d—–w c:\program files\Realtek
2009-04-27 19:06 . 2007-09-22 01:33 24064 —-a-w c:\windows\autoload.exe
2009-04-27 19:06 . 2007-09-22 06:46 ——– d—–w c:\program files\Google
2009-04-25 06:52 . 2003-03-31 12:00 67 –sha-w c:\windows\Fonts\desktop.ini
2009-04-23 04:22 . 2009-01-16 21:36 ——– d—–w c:\program files\The KMPlayer
2009-04-20 16:59 . 2007-09-19 06:41 ——– d—–w c:\program files\Common Files\InstallShield
2009-04-11 04:05 . 2008-12-05 23:36 ——– d—–w c:\program files\Digsby
2009-04-08 01:27 . 2008-04-11 19:26 ——– d—–w c:\program files\DivX
2009-04-05 20:52 . 2007-09-24 01:05 ——– d—–w c:\program files\Orbitdownloader
2009-03-22 04:47 . 2009-03-22 04:28 ——– d—–w c:\program files\CamStudio
2009-03-22 04:19 . 2007-10-18 02:46 ——– d—–w c:\program files\WMR11
2009-03-22 04:17 . 2007-10-18 02:49 ——– d—–w c:\program files\WinPcap
2009-03-21 19:24 . 2007-09-23 09:36 ——– d—–w c:\program files\Copernic Desktop Search 2
2009-03-21 05:59 . 2008-11-11 05:45 60048 —ha-w c:\windows\system32\mlfcache.dat
2009-03-20 18:50 . 2009-03-20 18:50 3358720 —-a-w c:\windows\system32\GPhotos.scr
2009-03-16 21:18 . 2009-04-23 04:28 69448 —-a-w c:\windows\system32\XAPOFX1_3.dll
2009-03-16 21:18 . 2009-04-23 04:28 517448 —-a-w c:\windows\system32\XAudio2_4.dll
2009-03-16 21:18 . 2009-04-23 04:28 235352 —-a-w c:\windows\system32\xactengine3_4.dll
2009-03-16 21:18 . 2009-04-23 04:28 22360 —-a-w c:\windows\system32\X3DAudio1_6.dll
2009-03-10 17:03 . 2009-01-16 21:27 ——– d—–w c:\program files\ThreatFire
2009-03-09 22:27 . 2009-04-23 04:28 453456 —-a-w c:\windows\system32\d3dx10_41.dll
2009-03-09 22:27 . 2009-04-23 04:28 4178264 —-a-w c:\windows\system32\D3DX9_41.dll
2009-03-09 22:27 . 2009-04-23 04:28 1846632 —-a-w c:\windows\system32\D3DCompiler_41.dll
2009-03-09 12:19 . 2008-10-08 06:48 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-04 07:11 . 2009-03-04 07:11 ——– d—–w c:\program files\Common Files\Skype
2009-03-04 07:11 . 2007-12-19 19:35 ——– d—–r c:\program files\Skype
2009-03-04 07:09 . 2007-09-22 22:49 ——– d—–w c:\program files\Azureus
2009-03-03 20:22 . 2007-09-22 06:47 ——– d—–w c:\program files\DVD Flick
2009-03-03 19:19 . 2009-01-16 21:27 39184 —-a-w c:\windows\system32\drivers\TfSysMon.sys
2009-03-03 19:19 . 2009-01-16 21:27 33040 —-a-w c:\windows\system32\drivers\TfNetMon.sys
2009-03-03 19:19 . 2009-01-16 21:27 12560 —-a-w c:\windows\system32\drivers\TfKbMon.sys
2009-03-03 19:19 . 2009-01-16 21:27 51472 —-a-w c:\windows\system32\drivers\TfFsMon.sys
2009-02-24 19:34 . 2009-02-24 19:34 90112 —-a-w c:\windows\system32\dpl100.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 —-a-w c:\windows\system32\divx_xx0c.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 —-a-w c:\windows\system32\divx_xx07.dll
2009-02-24 19:34 . 2009-02-24 19:34 815104 —-a-w c:\windows\system32\divx_xx0a.dll
2009-02-24 19:34 . 2009-02-24 19:34 802816 —-a-w c:\windows\system32\divx_xx11.dll
2009-02-24 19:34 . 2009-02-24 19:34 684032 —-a-w c:\windows\system32\DivX.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 —-a-w c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 —-a-w c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 —-a-w c:\program files\opera\program\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 —-a-w c:\program files\opera\program\plugins\ssldivx.dll
2008-09-22 02:07 . 2007-12-02 02:19 48 –sh–w c:\windows\SB68DC6FF.tmp
2006-05-03 09:06 . 2007-10-15 17:53 163328 –sha-r c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2007-10-15 17:53 31232 –sha-r c:\windows\system32\msfDX.dll
2007-12-17 12:43 . 2008-02-17 02:59 27648 –sha-w c:\windows\system32\Smab0.dll
.
——- Sigcheck ——-
[-] 2007-06-27 14:40 824320 D6ED5E042C5207553E7F5E842918137F c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
[-] 2007-08-20 10:02 825344 357D54BF94FE9D6D8505A96B5C2A3BCA c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
[-] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 03:35 827392 41546B396A526918DA7995A02EA04E51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2008-08-26 09:08 827904 77C192FE56A70D7FA0247BA0A6201C32 c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
[-] 2008-10-16 20:24 827904 0D5B75171FF51775B630A431B6C667E8 c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[-] 2008-12-20 23:56 827904 044E0A4E9FE97C0FB9AFE9C89E2A82E6 c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[-] 2009-03-03 00:17 828416 C8667854873938CA13C986F16B0CD183 c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll
[7] 2004-08-04 07:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB939653$\wininet.dll
[-] 2007-08-14 01:54 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\ie7updates\KB939653-IE7\wininet.dll
[-] 2007-08-20 10:04 824832 774435E499D8E9643EC961A6103C361F c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-04-23 04:16 826368 F6589BE784647CFDBC22EA51CCB1A57A c:\windows\ie7updates\KB956390-IE7\wininet.dll
[-] 2008-08-26 07:24 826368 EF8EBA98145BFA44E80D17A3B3453300 c:\windows\ie7updates\KB958215-IE7\wininet.dll
[-] 2008-10-16 20:38 826368 6741EAF7B7F110E803A6E38F6E5FA6B0 c:\windows\ie7updates\KB961260-IE7\wininet.dll
[-] 2008-12-20 23:15 826368 A82935D32D0672E8FF4E91AE398E901C c:\windows\ie7updates\KB963027-IE7\wininet.dll
[-] 2007-06-26 14:35 665600 E1A3DD68B5380B360A7310A64D9BB188 c:\windows\SoftwareDistribution\Download\
00f4dcdbcc87699e75212b885cb6bebf\sp2qfe\wininet.dll
[-] 2007-08-20 10:04 824832 774435E499D8E9643EC961A6103C361F c:\windows\SoftwareDistribution\Download\
0eda838ef8ec599d822155030a70ecac\SP2GDR\wininet.dll
[-] 2007-08-20 10:02 825344 357D54BF94FE9D6D8505A96B5C2A3BCA c:\windows\SoftwareDistribution\Download\
0eda838ef8ec599d822155030a70ecac\SP2QFE\wininet.dll
[-] 2009-03-03 00:18 826368 28775945CCD53DEE280EF58DEA1A94C4 c:\windows\SoftwareDistribution\Download\263159e92061f273983a0f9531635ce0\sp3gdr\wininet.dll
[-] 2009-03-03 00:17 828416 C8667854873938CA13C986F16B0CD183 c:\windows\SoftwareDistribution\Download\263159e92061f273983a0f9531635ce0\sp3qfe\wininet.dll
[-] 2007-08-22 12:55 665600 A1BC17EB3758D73C3938B2318820F5B4 c:\windows\system32\wininet.dll
[-] 2007-08-22 12:55 665600 A1BC17EB3758D73C3938B2318820F5B4 c:\windows\system32\dllcache\wininet.dll
[-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\termsrv.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-04-27_23.47.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-28 20:17 . 2009-04-28 20:17 16384 c:\windows\TEMP\Perflib_Perfdata_180.dat
+ 2006-02-28 12:00 . 2005-05-03 19:58 15360 c:\windows\system32\msisip.dll
+ 2006-02-28 12:00 . 2005-05-03 19:58 78848 c:\windows\system32\msiexec.exe
+ 2009-04-28 00:14 . 2009-04-28 00:14 27656 c:\windows\system32\drivers\avgmfx86.sys
+ 2006-02-28 12:00 . 2005-05-03 19:58 15360 c:\windows\system32\dllcache\msisip.dll
+ 2006-02-28 12:00 . 2005-05-03 19:58 78848 c:\windows\system32\dllcache\msiexec.exe
+ 2007-09-22 03:14 . 2006-02-28 12:00 44032 c:\windows\$MSI31Uninstall_KB893803v2$\msisip.dll
- 2007-09-22 03:14 . 2004-08-04 07:56 44032 c:\windows\$MSI31Uninstall_KB893803v2$\msisip.dll
+ 2007-09-22 03:14 . 2006-02-28 12:00 77312 c:\windows\$MSI31Uninstall_KB893803v2$\msiexec.exe
- 2007-09-22 03:14 . 2004-08-04 07:56 77312 c:\windows\$MSI31Uninstall_KB893803v2$\msiexec.exe
+ 2006-02-28 12:00 . 2005-05-03 19:58 884736 c:\windows\system32\msimsg.dll
- 2006-02-28 12:00 . 2006-02-28 12:00 884736 c:\windows\system32\msimsg.dll
+ 2006-02-28 12:00 . 2005-05-03 19:58 271360 c:\windows\system32\msihnd.dll
- 2006-02-28 12:00 . 2006-02-28 12:00 884736 c:\windows\system32\dllcache\msimsg.dll
+ 2006-02-28 12:00 . 2005-05-03 19:58 884736 c:\windows\system32\dllcache\msimsg.dll
+ 2006-02-28 12:00 . 2005-05-03 19:58 271360 c:\windows\system32\dllcache\msihnd.dll
+ 2007-09-22 03:14 . 2005-05-03 19:58 371936 c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll
- 2007-09-22 03:14 . 2005-05-04 21:45 371936 c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll
- 2007-09-22 03:14 . 2005-05-04 21:45 209632 c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe
+ 2007-09-22 03:14 . 2005-05-03 19:58 209632 c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe
- 2007-09-22 03:14 . 2004-08-04 07:56 884736 c:\windows\$MSI31Uninstall_KB893803v2$\msimsg.dll
+ 2007-09-22 03:14 . 2006-02-28 12:00 884736 c:\windows\$MSI31Uninstall_KB893803v2$\msimsg.dll
+ 2007-09-22 03:14 . 2006-02-28 12:00 331264 c:\windows\$MSI31Uninstall_KB893803v2$\msihnd.dll
- 2007-09-22 03:14 . 2004-08-04 07:56 331264 c:\windows\$MSI31Uninstall_KB893803v2$\msihnd.dll
+ 2006-02-28 12:00 . 2006-10-11 22:11 2829824 c:\windows\system32\msi.dll
+ 2006-02-28 12:00 . 2006-10-11 22:11 2829824 c:\windows\system32\dllcache\msi.dll
- 2007-09-22 03:14 . 2004-08-04 07:56 2804224 c:\windows\$MSI31Uninstall_KB893803v2$\msi.dll
+ 2007-09-22 03:14 . 2006-02-28 12:00 2804224 c:\windows\$MSI31Uninstall_KB893803v2$\msi.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 —-a-w c:\program files\Dropbox\DropboxExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 —-a-w c:\program files\Dropbox\DropboxExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 —-a-w c:\program files\Dropbox\DropboxExt.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-02-28 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Google Update"="c:\documents and settings\Charles\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-12 133104]
"Taskbar Shuffle"="c:\program files\Taskbar Shuffle\taskbarshuffle.exe" [2008-04-17 818176]
"Copernic Desktop Search - Home"="c:\program files\Copernic Desktop Search 2\DesktopSearchService.exe" [2008-12-11 1588224]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-14 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U.S. Robotics Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"Easy Synchronization"="c:\program files\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 53248]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 57344]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"TSM_AutoUpdate"="c:\program files\TalkSwitch\TalkSwitch Configuration 6.10\TSAutoUpdate.exe" [2008-10-09 169256]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-03-03 263440]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-11-04 615696]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-09-19 236016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-28 1932568]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-17 1657376]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-10-10 69632]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-12-19 15797248]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Easy Synchronization"="c:\program files\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 53248]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
c:\documents and settings\Charles\Start Menu\Programs\Startup\
Digsby.lnk - c:\program files\Digsby\digsby.exe [2008-10-10 137728]
DING!.lnk - c:\program files\Southwest Airlines\Ding\Ding.exe [2006-6-22 462848]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-29 561213]
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2008-11-4 1545488]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-12-1 286720]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-21 809488]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FE24CD78-7C63-465D-8787-4EDF7FC79895}"= "c:\program files\Logitech\Easy Synchronization\shellexecutehook.dll" [2005-10-05 69632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-11-07 23:41 72208 —-a-w c:\program files\common files\logitech\bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-28 00:14 10520 —-a-w c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^eFax 4.4.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\eFax 4.4.lnk
backup=c:\windows\pss\eFax 4.4.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^hamachi.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\hamachi.lnk
backup=c:\windows\pss\hamachi.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^Rainmeter.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\Rainmeter.lnk
backup=c:\windows\pss\Rainmeter.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^TalkSwitch Registration Reminder.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\TalkSwitch Registration Reminder.lnk
backup=c:\windows\pss\TalkSwitch Registration Reminder.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\ElectricSheep.scr"=
"c:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\WinHTTrack\\WinHTTrack.exe"=
"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"c:\\Program Files\\messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\ooVoo\\ooVoo.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Charles\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Charles\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\xmltv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443
"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675
R2 gupdate1c9c0b5d8e56948;Google Update Service (gupdate1c9c0b5d8e56948);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-19 133104]
R3 AvsBluebird;FusionHDTV USB, AVStream Capture;c:\windows\system32\drivers\bluebird2.sys [2007-12-18 403712]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-03-03 51472]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-03-03 39184]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-28 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-28 108552]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2008-02-21 40928]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2008-02-21 27776]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-28 298264]
S2 QuickBooksDB18;QuickBooksDB18;c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe [2006-09-13 128536]
S2 ThreatFire;ThreatFire; [x]
S2 TSUDPLogger;Talkswitch UDP Logger Service;c:\program files\TalkSwitch\UDPLogger\UDPLogger.exe [2008-10-09 188416]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-03-03 33040]
— Other Services/Drivers In Memory —
*Deregistered* - aawservice
*Deregistered* - AegisP
*Deregistered* - AFD
*Deregistered* - Arp1394
*Deregistered* - avg8wd
*Deregistered* - AvgLdx86
*Deregistered* - AvgMfx86
*Deregistered* - AvgTdiX
*Deregistered* - Beep
*Deregistered* - Bonjour Service
*Deregistered* - BridgeMP
*Deregistered* - Browser
*Deregistered* - BTDriver
*Deregistered* - BTKRNL
*Deregistered* - btwdins
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ElbyCDIO
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - gupdate1c9c0b5d8e56948
*Deregistered* - hamachi
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - ISODrive
*Deregistered* - JavaQuickStarterService
*Deregistered* - Kbdclass
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LBTServ
*Deregistered* - LightScribeService
*Deregistered* - LmHosts
*Deregistered* - Logitech Easy Synchronization
*Deregistered* - LVCOMSer
*Deregistered* - LVPr2Mon
*Deregistered* - LVPrcSrv
*Deregistered* - LVSrvLauncher
*Deregistered* - LVUSBSta
*Deregistered* - mchInjDrv
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - Modem
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - Nero BackItUp Scheduler 3
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - NMIndexingService
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - PartMgr
*Deregistered* - pcouffin
*Deregistered* - PnkBstrA
*Deregistered* - PnkBstrB
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - QBCFMonitorService
*Deregistered* - QuickBooksDB18
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RDPWD
*Deregistered* - RemoteRegistry
*Deregistered* - RimVSerPort
*Deregistered* - Roxio Upnp Server 9
*Deregistered* - RoxLiveShare9
*Deregistered* - RoxWatch9
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - SCDEmu
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - ServiceLayer
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - ssdpsrv
*Deregistered* - StarWindService
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TDTCP
*Deregistered* - TermService
*Deregistered* - TfFsMon
*Deregistered* - TfNetMon
*Deregistered* - TfSysMon
*Deregistered* - Themes
*Deregistered* - ThreatFire
*Deregistered* - TrkWks
*Deregistered* - TSUDPLogger
*Deregistered* - Update
*Deregistered* - VBoxDrv
*Deregistered* - VBoxUSBMon
*Deregistered* - VgaSave
*Deregistered* - Viewpoint Manager Service
*Deregistered* - vmm
*Deregistered* - VolSnap
*Deregistered* - VPCNetS2
*Deregistered* - vsbus
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - WinDriver6
*Deregistered* - windrvNT
*Deregistered* - wltrysvc
*Deregistered* - WS2IFSL
*Deregistered* - WudfPf
*Deregistered* - WudfSvc
*Deregistered* - WZCSVC
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - WDSetup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df714447-b03d-11dd-a14e-00301b43e83b}]
\Shell\Shell00\Command - H:\Start.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f024fa4c-36a8-11dd-a0c9-00301b43e83b}]
\Shell\AutoRun\command - WDSetup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
2009-04-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 00:57]
2009-04-28 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-19 06:12]
2009-04-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-115176313-2146432963-1003.job
- c:\documents and settings\Charles\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-12 07:11]
.
.
——- Supplementary Scan ——-
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://search.orbitdownloader.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM; Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Download; by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab; video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to EverNote - c:\program files\EverNote\EverNote\enbar.dll/2000
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Do&wnload; selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load; all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {{9DB8BAE2-CDA0-4b06-8E0D-8B2FD46F03D9} - {674CC1A8-3A39-421B-B075-68FA80DDAB9C} - c:\program files\Third Globe\iFetcher\WFF_IE_TBExtension.dll
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {07246F83-6D48-4559-81EC-117CBAE54F1B} - hxxp://workspace.office.live.com/Misc/Microsoft.OfficeLive.Workspace.RichUpload.cab
FF - ProfilePath - c:\documents and settings\Charles\Application Data\Mozilla\Firefox\Profiles\h5n2m1p0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrie7&query;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.orbitdownloader.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrab&query;=
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-04-28 13:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
C:\sccfg.sys 358 bytes
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_USERS\S-1-5-21-839522115-115176313-2146432963-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4CD7EEF1-A3AF-4DAC-1C02-BA55E6768907}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abebopkeejibahagaaoimecohhnpoldilh"=hex:6a,61,6e,6e,6f,70,6c,62,64,65,65,62,
6a,67,66,64,67,6c,6c,6a,00,d3
"pacbohmnihjaoidbeohanhcdadlocegl"=hex:6a,61,6c,6e,6c,66,6f,62,6a,6a,62,64,64,
6e,6f,65,6d,6e,6c,6a,00,c0
[HKEY_USERS\S-1-5-21-839522115-115176313-2146432963-1003\Software\SecuROM\License information*]
"datasecu"=hex:f8,b9,2f,18,3c,2b,71,a9,09,07,05,b6,64,82,7f,3e,10,da,d1,0e,fc,
0f,12,a6,c2,00,ac,46,4a,bf,e4,fc,fb,90,d0,0b,57,10,aa,5f,b6,04,4f,5a,57,df,\
"rkeysecu"=hex:16,43,3a,cb,e7,93,41,14,35,78,6e,3d,ec,f7,42,11
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(1820)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\windows\System32\BCMLogon.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll
- - - - - - - > 'lsass.exe'(1884)
c:\windows\System32\BCMLogon.dll
c:\program files\ThreatFire\TFWAH.dll
- - - - - - - > 'explorer.exe'(7956)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Dropbox\DropboxExt.dll
c:\windows\system32\btmmhook.dll
c:\program files\ThreatFire\TFNI.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng-us.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Taskbar Shuffle\tbhookin.dll
c:\program files\Copernic Desktop Search 2\DesktopSearchSystem301000049.dll
.
———————— Other Running Processes ————————
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Logitech\Bluetooth\LBTServ.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Logitech\Easy Synchronization\servicestub.exe
c:\windows\system32\wltray.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Digsby\lib\digsby-app.exe
c:\program files\Common Files\LogiShrd\KHAL2\KHALMNPR.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
c:\program files\ThreatFire\TFService.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\NclBTHandler.exe
c:\progra~1\MICROS~2\OFFICE11\WINWORD.EXE
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\Microsoft\Office Live\OfficeLiveSignIn.exe
c:\program files\Digsby\lib\aspell\bin\aspell.exe
.
**************************************************************************
.
Completion time: 2009-04-28 13:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-28 20:32
ComboFix2.txt 2009-04-28 00:01
ComboFix3.txt 2008-12-01 08:46
Pre-Run: 46,266,044,416 bytes free
Post-Run: 46,265,036,800 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
636 — E O F — 2009-04-16 06:55
———————————————————————————
ComboFix 09-04-27.02 - Charles 04/29/2009 10:14.8 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\extxerox.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-29 )))))))))))))))))))))))))))))))
.
2009-04-28 00:14 . 2009-04-28 00:14 10520 —-a-w c:\windows\system32\avgrsstx.dll
2009-04-28 00:14 . 2009-04-28 00:14 108552 —-a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-28 00:14 . 2009-04-28 00:14 325640 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-28 00:14 . 2009-04-29 17:05 ——– d—–w c:\windows\system32\drivers\Avg
2009-04-25 07:22 . 2009-04-25 07:22 664 —-a-w c:\windows\system32\d3d9caps.dat
2009-04-25 06:18 . 2009-04-25 06:18 ——– d—–w c:\windows\NV1988684.TMP
2009-04-25 06:07 . 2006-02-28 12:00 13312 -c–a-w c:\windows\system32\dllcache\irclass.dll
2009-04-25 06:07 . 2006-02-28 12:00 13312 —-a-w c:\windows\system32\irclass.dll
2009-04-25 06:07 . 2006-02-28 12:00 24661 -c–a-w c:\windows\system32\dllcache\spxcoins.dll
2009-04-25 06:07 . 2006-02-28 12:00 24661 —-a-w c:\windows\system32\spxcoins.dll
2009-04-25 03:10 . 2009-04-25 03:10 ——– d—–w c:\windows\NV2004640.TMP
2009-04-25 00:15 . 2009-04-25 00:16 ——– d—–w c:\windows\NV2008120.TMP
2009-04-24 23:05 . 2009-04-24 23:05 ——– d—–w c:\windows\NV1992512.TMP
2009-04-24 18:42 . 2009-04-24 18:42 ——– d—–w c:\windows\NV20041536.TMP
2009-04-23 04:18 . 2009-04-27 19:13 ——– d—–w c:\documents and settings\Charles\Local Settings\Application Data\MediaMonkey
2009-04-23 03:19 . 2009-04-23 03:19 ——– d—–w c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-04-22 07:02 . 2009-04-22 07:02 ——– d—–w c:\documents and settings\LocalService\Application Data\Roxio
2009-04-22 07:02 . 2009-04-22 07:05 ——– d—–w c:\documents and settings\Charles\Application Data\Roxio
2009-04-20 19:11 . 2009-04-28 19:54 ——– d–h–w C:\$AVG8.VAULT$
2009-04-20 18:31 . 2009-04-29 17:06 256 —-a-w c:\windows\system32\pool.bin
2009-04-20 18:31 . 2009-04-20 18:31 ——– d—–w c:\documents and settings\Charles\Application Data\Research In Motion
2009-04-20 17:01 . 2009-04-20 17:01 ——– d—–w c:\documents and settings\All Users\Application Data\InstallShield
2009-04-20 17:01 . 2009-04-20 17:01 ——– d—–w c:\documents and settings\All Users\Application Data\Sonic
2009-04-20 16:59 . 2009-04-20 16:59 ——– d—–w c:\program files\Common Files\Sonic Shared
2009-04-20 16:59 . 2009-04-25 05:29 ——– d—–w c:\documents and settings\All Users\Application Data\Roxio
2009-04-20 16:59 . 2009-04-20 17:00 ——– d—–w c:\program files\Roxio
2009-04-20 16:59 . 2009-04-20 17:00 ——– d—–w c:\program files\Common Files\Roxio Shared
2009-04-20 16:59 . 2007-01-18 17:24 26496 —-a-r c:\windows\system32\drivers\RimSerial.sys
2009-04-20 16:58 . 2009-04-20 16:58 ——– d—–w c:\program files\Common Files\Research In Motion
2009-04-20 16:58 . 2009-04-20 16:58 ——– d—–w c:\program files\Research In Motion
2009-04-18 17:52 . 2009-04-28 00:14 ——– d—–w c:\documents and settings\All Users\Application Data\avg8
2009-04-16 05:17 . 2009-04-16 05:17 ——– d—–w c:\program files\TeraCopy
2009-04-15 19:03 . 2008-05-03 11:55 2560 —-a-w c:\windows\system32\xpsp4res.dll
2009-04-08 01:27 . 2009-04-08 01:27 ——– d—–w c:\program files\Common Files\DivX Shared
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-29 17:03 . 2008-12-02 06:05 ——– d—–w c:\program files\Taskbar Shuffle
2009-04-28 20:03 . 2008-06-01 07:10 ——– d—–w c:\program files\Java
2009-04-28 00:13 . 2009-04-28 00:13 ——– d—–w c:\program files\AVG
2009-04-27 21:49 . 2007-09-22 02:56 92256 —-a-w c:\documents and settings\Charles\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-27 19:56 . 2007-09-22 05:40 ——– d—–w c:\program files\MediaMonkey
2009-04-27 19:07 . 2007-09-22 03:01 ——– d—–w c:\program files\Realtek
2009-04-27 19:06 . 2007-09-22 01:33 24064 —-a-w c:\windows\autoload.exe
2009-04-27 19:06 . 2007-09-22 06:46 ——– d—–w c:\program files\Google
2009-04-25 06:52 . 2003-03-31 12:00 67 –sha-w c:\windows\Fonts\desktop.ini
2009-04-23 04:22 . 2009-01-16 21:36 ——– d—–w c:\program files\The KMPlayer
2009-04-20 16:59 . 2007-09-19 06:41 ——– d—–w c:\program files\Common Files\InstallShield
2009-04-11 04:05 . 2008-12-05 23:36 ——– d—–w c:\program files\Digsby
2009-04-08 01:27 . 2008-04-11 19:26 ——– d—–w c:\program files\DivX
2009-04-05 20:52 . 2007-09-24 01:05 ——– d—–w c:\program files\Orbitdownloader
2009-03-22 04:47 . 2009-03-22 04:28 ——– d—–w c:\program files\CamStudio
2009-03-22 04:19 . 2007-10-18 02:46 ——– d—–w c:\program files\WMR11
2009-03-22 04:17 . 2007-10-18 02:49 ——– d—–w c:\program files\WinPcap
2009-03-21 19:24 . 2007-09-23 09:36 ——– d—–w c:\program files\Copernic Desktop Search 2
2009-03-21 05:59 . 2008-11-11 05:45 60048 —ha-w c:\windows\system32\mlfcache.dat
2009-03-20 18:50 . 2009-03-20 18:50 3358720 —-a-w c:\windows\system32\GPhotos.scr
2009-03-16 21:18 . 2009-04-23 04:28 69448 —-a-w c:\windows\system32\XAPOFX1_3.dll
2009-03-16 21:18 . 2009-04-23 04:28 517448 —-a-w c:\windows\system32\XAudio2_4.dll
2009-03-16 21:18 . 2009-04-23 04:28 235352 —-a-w c:\windows\system32\xactengine3_4.dll
2009-03-16 21:18 . 2009-04-23 04:28 22360 —-a-w c:\windows\system32\X3DAudio1_6.dll
2009-03-10 17:03 . 2009-01-16 21:27 ——– d—–w c:\program files\ThreatFire
2009-03-09 22:27 . 2009-04-23 04:28 453456 —-a-w c:\windows\system32\d3dx10_41.dll
2009-03-09 22:27 . 2009-04-23 04:28 4178264 —-a-w c:\windows\system32\D3DX9_41.dll
2009-03-09 22:27 . 2009-04-23 04:28 1846632 —-a-w c:\windows\system32\D3DCompiler_41.dll
2009-03-09 12:19 . 2008-10-08 06:48 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-04 07:11 . 2009-03-04 07:11 ——– d—–w c:\program files\Common Files\Skype
2009-03-04 07:11 . 2007-12-19 19:35 ——– d—–r c:\program files\Skype
2009-03-04 07:09 . 2007-09-22 22:49 ——– d—–w c:\program files\Azureus
2009-03-03 20:22 . 2007-09-22 06:47 ——– d—–w c:\program files\DVD Flick
2009-03-03 19:19 . 2009-01-16 21:27 39184 —-a-w c:\windows\system32\drivers\TfSysMon.sys
2009-03-03 19:19 . 2009-01-16 21:27 33040 —-a-w c:\windows\system32\drivers\TfNetMon.sys
2009-03-03 19:19 . 2009-01-16 21:27 12560 —-a-w c:\windows\system32\drivers\TfKbMon.sys
2009-03-03 19:19 . 2009-01-16 21:27 51472 —-a-w c:\windows\system32\drivers\TfFsMon.sys
2009-02-24 19:34 . 2009-02-24 19:34 90112 —-a-w c:\windows\system32\dpl100.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 —-a-w c:\windows\system32\divx_xx0c.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 —-a-w c:\windows\system32\divx_xx07.dll
2009-02-24 19:34 . 2009-02-24 19:34 815104 —-a-w c:\windows\system32\divx_xx0a.dll
2009-02-24 19:34 . 2009-02-24 19:34 802816 —-a-w c:\windows\system32\divx_xx11.dll
2009-02-24 19:34 . 2009-02-24 19:34 684032 —-a-w c:\windows\system32\DivX.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 —-a-w c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 —-a-w c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 —-a-w c:\program files\opera\program\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 —-a-w c:\program files\opera\program\plugins\ssldivx.dll
2008-09-22 02:07 . 2007-12-02 02:19 48 –sh–w c:\windows\SB68DC6FF.tmp
2006-05-03 09:06 . 2007-10-15 17:53 163328 –sha-r c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2007-10-15 17:53 31232 –sha-r c:\windows\system32\msfDX.dll
2007-12-17 12:43 . 2008-02-17 02:59 27648 –sha-w c:\windows\system32\Smab0.dll
.
——- Sigcheck ——-
[-] 2007-06-27 14:40 824320 D6ED5E042C5207553E7F5E842918137F c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
[-] 2007-08-20 10:02 825344 357D54BF94FE9D6D8505A96B5C2A3BCA c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
[-] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 03:35 827392 41546B396A526918DA7995A02EA04E51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2008-08-26 09:08 827904 77C192FE56A70D7FA0247BA0A6201C32 c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
[-] 2008-10-16 20:24 827904 0D5B75171FF51775B630A431B6C667E8 c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[-] 2008-12-20 23:56 827904 044E0A4E9FE97C0FB9AFE9C89E2A82E6 c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[-] 2009-03-03 00:17 828416 C8667854873938CA13C986F16B0CD183 c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll
[7] 2004-08-04 07:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB939653$\wininet.dll
[-] 2007-08-14 01:54 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\ie7updates\KB939653-IE7\wininet.dll
[-] 2007-08-20 10:04 824832 774435E499D8E9643EC961A6103C361F c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-04-23 04:16 826368 F6589BE784647CFDBC22EA51CCB1A57A c:\windows\ie7updates\KB956390-IE7\wininet.dll
[-] 2008-08-26 07:24 826368 EF8EBA98145BFA44E80D17A3B3453300 c:\windows\ie7updates\KB958215-IE7\wininet.dll
[-] 2008-10-16 20:38 826368 6741EAF7B7F110E803A6E38F6E5FA6B0 c:\windows\ie7updates\KB961260-IE7\wininet.dll
[-] 2008-12-20 23:15 826368 A82935D32D0672E8FF4E91AE398E901C c:\windows\ie7updates\KB963027-IE7\wininet.dll
[-] 2007-06-26 14:35 665600 E1A3DD68B5380B360A7310A64D9BB188 c:\windows\SoftwareDistribution\Download\
00f4dcdbcc87699e75212b885cb6bebf\sp2qfe\wininet.dll
[-] 2007-08-20 10:04 824832 774435E499D8E9643EC961A6103C361F c:\windows\SoftwareDistribution\Download\
0eda838ef8ec599d822155030a70ecac\SP2GDR\wininet.dll
[-] 2007-08-20 10:02 825344 357D54BF94FE9D6D8505A96B5C2A3BCA c:\windows\SoftwareDistribution\Download\
0eda838ef8ec599d822155030a70ecac\SP2QFE\wininet.dll
[-] 2009-03-03 00:18 826368 28775945CCD53DEE280EF58DEA1A94C4 c:\windows\SoftwareDistribution\Download\263159e92061f273983a0f9531635ce0\sp3gdr\wininet.dll
[-] 2009-03-03 00:17 828416 C8667854873938CA13C986F16B0CD183 c:\windows\SoftwareDistribution\Download\263159e92061f273983a0f9531635ce0\sp3qfe\wininet.dll
[-] 2007-08-22 12:55 665600 A1BC17EB3758D73C3938B2318820F5B4 c:\windows\system32\wininet.dll
[-] 2007-08-22 12:55 665600 A1BC17EB3758D73C3938B2318820F5B4 c:\windows\system32\dllcache\wininet.dll
[-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\termsrv.dll
.
((((((((((((((((((((((((((((( SnapShot_2009-04-28_20.19.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-29 17:02 . 2009-04-29 17:02 16384 c:\windows\TEMP\Perflib_Perfdata_56c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 —-a-w c:\program files\Dropbox\DropboxExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 —-a-w c:\program files\Dropbox\DropboxExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 —-a-w c:\program files\Dropbox\DropboxExt.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-02-28 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Google Update"="c:\documents and settings\Charles\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-12 133104]
"Taskbar Shuffle"="c:\program files\Taskbar Shuffle\taskbarshuffle.exe" [2008-04-17 818176]
"Copernic Desktop Search - Home"="c:\program files\Copernic Desktop Search 2\DesktopSearchService.exe" [2008-12-11 1588224]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-14 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U.S. Robotics Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"Easy Synchronization"="c:\program files\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 53248]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 57344]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"TSM_AutoUpdate"="c:\program files\TalkSwitch\TalkSwitch Configuration 6.10\TSAutoUpdate.exe" [2008-10-09 169256]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-03-03 263440]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-11-04 615696]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-09-19 236016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-28 1932568]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-17 1657376]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-10-10 69632]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-12-19 15797248]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
c:\documents and settings\Charles\Start Menu\Programs\Startup\
Digsby.lnk - c:\program files\Digsby\digsby.exe [2008-10-10 137728]
DING!.lnk - c:\program files\Southwest Airlines\Ding\Ding.exe [2006-6-22 462848]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-29 561213]
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2008-11-4 1545488]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-12-1 286720]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-21 809488]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FE24CD78-7C63-465D-8787-4EDF7FC79895}"= "c:\program files\Logitech\Easy Synchronization\shellexecutehook.dll" [2005-10-05 69632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-11-07 23:41 72208 —-a-w c:\program files\common files\logitech\bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-28 00:14 10520 —-a-w c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^eFax 4.4.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\eFax 4.4.lnk
backup=c:\windows\pss\eFax 4.4.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^hamachi.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\hamachi.lnk
backup=c:\windows\pss\hamachi.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^Rainmeter.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\Rainmeter.lnk
backup=c:\windows\pss\Rainmeter.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Charles^Start Menu^Programs^Startup^TalkSwitch Registration Reminder.lnk]
path=c:\documents and settings\Charles\Start Menu\Programs\Startup\TalkSwitch Registration Reminder.lnk
backup=c:\windows\pss\TalkSwitch Registration Reminder.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\ElectricSheep.scr"=
"c:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\WinHTTrack\\WinHTTrack.exe"=
"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"c:\\Program Files\\messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\ooVoo\\ooVoo.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Charles\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Charles\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\xmltv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443
"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675
R2 gupdate1c9c0b5d8e56948;Google Update Service (gupdate1c9c0b5d8e56948);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-19 133104]
R3 AvsBluebird;FusionHDTV USB, AVStream Capture;c:\windows\system32\drivers\bluebird2.sys [2007-12-18 403712]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-03-03 51472]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-03-03 39184]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-28 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-28 108552]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2008-02-21 40928]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2008-02-21 27776]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-28 298264]
S2 QuickBooksDB18;QuickBooksDB18;c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe [2006-09-13 128536]
S2 ThreatFire;ThreatFire; [x]
S2 TSUDPLogger;Talkswitch UDP Logger Service;c:\program files\TalkSwitch\UDPLogger\UDPLogger.exe [2008-10-09 188416]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-03-03 33040]
— Other Services/Drivers In Memory —
*Deregistered* - aawservice
*Deregistered* - AegisP
*Deregistered* - AFD
*Deregistered* - Arp1394
*Deregistered* - avg8wd
*Deregistered* - AvgLdx86
*Deregistered* - AvgMfx86
*Deregistered* - AvgTdiX
*Deregistered* - Beep
*Deregistered* - Bonjour Service
*Deregistered* - BridgeMP
*Deregistered* - Browser
*Deregistered* - BTDriver
*Deregistered* - BTKRNL
*Deregistered* - btwdins
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ElbyCDIO
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FLEXnet Licensing Service
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - gupdate1c9c0b5d8e56948
*Deregistered* - hamachi
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - ISODrive
*Deregistered* - JavaQuickStarterService
*Deregistered* - Kbdclass
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LBTServ
*Deregistered* - LightScribeService
*Deregistered* - LmHosts
*Deregistered* - Logitech Easy Synchronization
*Deregistered* - LVCOMSer
*Deregistered* - LVPr2Mon
*Deregistered* - LVPrcSrv
*Deregistered* - LVSrvLauncher
*Deregistered* - LVUSBSta
*Deregistered* - mchInjDrv
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - Modem
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - Nero BackItUp Scheduler 3
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - NMIndexingService
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - PartMgr
*Deregistered* - pcouffin
*Deregistered* - PnkBstrA
*Deregistered* - PnkBstrB
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - QBCFMonitorService
*Deregistered* - QuickBooksDB18
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RDPWD
*Deregistered* - RemoteRegistry
*Deregistered* - RimVSerPort
*Deregistered* - Roxio Upnp Server 9
*Deregistered* - RoxLiveShare9
*Deregistered* - RoxWatch9
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - SCDEmu
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - ServiceLayer
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - ssdpsrv
*Deregistered* - StarWindService
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TDTCP
*Deregistered* - TermService
*Deregistered* - TfFsMon
*Deregistered* - TfNetMon
*Deregistered* - TfSysMon
*Deregistered* - Themes
*Deregistered* - ThreatFire
*Deregistered* - TrkWks
*Deregistered* - TSUDPLogger
*Deregistered* - Update
*Deregistered* - VBoxDrv
*Deregistered* - VBoxUSBMon
*Deregistered* - VgaSave
*Deregistered* - Viewpoint Manager Service
*Deregistered* - vmm
*Deregistered* - VolSnap
*Deregistered* - VPCNetS2
*Deregistered* - vsbus
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - WinDriver6
*Deregistered* - windrvNT
*Deregistered* - wltrysvc
*Deregistered* - WS2IFSL
*Deregistered* - WudfPf
*Deregistered* - WudfSvc
*Deregistered* - WZCSVC
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - WDSetup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df714447-b03d-11dd-a14e-00301b43e83b}]
\Shell\Shell00\Command - H:\Start.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f024fa4c-36a8-11dd-a0c9-00301b43e83b}]
\Shell\AutoRun\command - WDSetup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
2009-04-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 00:57]
2009-04-29 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-19 06:12]
2009-04-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-115176313-2146432963-1003.job
- c:\documents and settings\Charles\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-12 07:11]
.
.
——- Supplementary Scan ——-
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://search.orbitdownloader.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM; Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Download; by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab; video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to EverNote - c:\program files\EverNote\EverNote\enbar.dll/2000
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Do&wnload; selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load; all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {{9DB8BAE2-CDA0-4b06-8E0D-8B2FD46F03D9} - {674CC1A8-3A39-421B-B075-68FA80DDAB9C} - c:\program files\Third Globe\iFetcher\WFF_IE_TBExtension.dll
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {07246F83-6D48-4559-81EC-117CBAE54F1B} - hxxp://workspace.office.live.com/Misc/Microsoft.OfficeLive.Workspace.RichUpload.cab
FF - ProfilePath - c:\documents and settings\Charles\Application Data\Mozilla\Firefox\Profiles\h5n2m1p0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrie7&query;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.orbitdownloader.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrab&query;=
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-04-29 10:22
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
C:\sccfg.sys 358 bytes
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_USERS\S-1-5-21-839522115-115176313-2146432963-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4CD7EEF1-A3AF-4DAC-1C02-BA55E6768907}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abebopkeejibahagaaoimecohhnpoldilh"=hex:6a,61,6e,6e,6f,70,6c,62,64,65,65,62,
6a,67,66,64,67,6c,6c,6a,00,d3
"pacbohmnihjaoidbeohanhcdadlocegl"=hex:6a,61,6c,6e,6c,66,6f,62,6a,6a,62,64,64,
6e,6f,65,6d,6e,6c,6a,00,c0
[HKEY_USERS\S-1-5-21-839522115-115176313-2146432963-1003\Software\SecuROM\License information*]
"datasecu"=hex:f8,b9,2f,18,3c,2b,71,a9,09,07,05,b6,64,82,7f,3e,10,da,d1,0e,fc,
0f,12,a6,c2,00,ac,46,4a,bf,e4,fc,fb,90,d0,0b,57,10,aa,5f,b6,04,4f,5a,57,df,\
"rkeysecu"=hex:16,43,3a,cb,e7,93,41,14,35,78,6e,3d,ec,f7,42,11
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(1728)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\windows\System32\BCMLogon.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll
- - - - - - - > 'lsass.exe'(1796)
c:\windows\System32\BCMLogon.dll
c:\program files\ThreatFire\TFWAH.dll
.
Completion time: 2009-04-29 10:27
ComboFix-quarantined-files.txt 2009-04-29 17:25
ComboFix2.txt 2009-04-28 20:34
ComboFix3.txt 2009-04-28 00:01
ComboFix4.txt 2008-12-01 08:46
Pre-Run: 45,501,841,408 bytes free
Post-Run: 46,222,323,712 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
532 — E O F — 2009-04-16 06:55
