For the tmeeing I removed spybot. When Combo scan initially stated unable to access file being used by another program 3 times them went on to
check 1 complete.
Here is the new combo scan
ComboFix 09-11-15.01 - D 11/14/2009 16:30.5.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1325 [GMT -5:00]
Running from: c:\documents and settings\D\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((( Files Created from 2009-10-14 to 2009-11-14 )))))))))))))))))))))))))))))))
.
2009-11-14 21:14 . 2009-11-14 21:14 -------- d-----w- c:\documents and settings\D\Application Data\KeePass
2009-11-14 20:55 . 2009-11-14 20:55 -------- d-----w- c:\program files\KeePass Password Safe
2009-11-14 20:18 . 2009-10-10 07:07 38208 ----a-w- c:\documents and settings\D\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-11-14 20:18 . 2009-10-10 07:07 38208 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-11-14 20:18 . 2009-11-14 20:18 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-11-14 20:17 . 2009-11-14 20:17 86016 -c--a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-11-14 20:16 . 2009-11-14 20:38 -------- dc----w- c:\documents and settings\All Users\Application Data\NOS
2009-11-13 11:34 . 2009-11-13 11:34 -------- d-----w- c:\program files\Trend Micro
2009-11-13 11:33 . 2009-11-13 04:32 812344 ----a-w- c:\program files\HJTInstall.exe
2009-11-13 02:17 . 2009-11-13 02:17 -------- d-----w- c:\documents and settings\D\Application Data\Malwarebytes
2009-11-13 02:17 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-13 02:17 . 2009-11-13 02:17 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-13 02:17 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-13 02:16 . 2009-11-14 02:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-12 13:44 . 2009-11-10 00:30 4026136 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2009-11-12 13:44 . 2009-11-10 00:30 2016536 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe
2009-11-12 13:44 . 2009-11-10 00:30 1257240 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2009-11-12 13:44 . 2009-11-10 00:30 3963672 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2009-11-12 13:44 . 2009-11-08 03:06 600344 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgnsx.exe
2009-11-12 13:44 . 2009-11-08 03:06 496920 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchjwx.dll
2009-11-10 00:30 . 2009-11-08 03:07 360584 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2009-11-10 00:29 . 2009-11-08 03:06 610072 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2009-11-10 00:29 . 2009-11-08 03:06 1657112 -c--a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2009-11-09 23:07 . 2009-11-09 23:07 240664 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-11-09 22:08 . 2009-11-09 22:08 -------- d-----w- c:\documents and settings\D\Application Data\uniblue
2009-11-09 22:08 . 2009-07-06 04:22 2838442 -c----w- c:\documents and settings\All Users\Application Data\~0\speedupmypc2009.exe
2009-11-09 22:08 . 2009-11-09 22:08 -------- d-----w- c:\program files\Uniblue
2009-11-09 22:07 . 2009-11-09 22:50 -------- dc-h--w- c:\documents and settings\All Users\Application Data\~0
2009-11-09 21:53 . 2009-11-09 21:53 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-11-09 17:25 . 2009-11-09 17:25 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-11-08 03:13 . 2009-10-16 17:12 1119488 -c--a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-11-08 03:07 . 2009-11-08 23:36 -------- dc----w- C:\$AVG
2009-11-08 03:07 . 2009-11-08 03:07 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-08 03:07 . 2009-11-10 00:30 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-08 03:07 . 2009-11-08 03:07 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-08 03:07 . 2009-11-08 03:07 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-11-08 03:07 . 2009-11-14 14:04 -------- d-----w- c:\windows\system32\drivers\Avg
2009-11-08 03:06 . 2009-11-08 03:13 -------- dc----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-11-08 03:06 . 2009-11-08 03:06 -------- dc----w- c:\documents and settings\All Users\Application Data\avg9
2009-11-07 15:26 . 2009-11-14 21:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-04 16:33 . 2009-11-04 16:33 152576 ----a-w- c:\documents and settings\D\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-10-20 07:04 . 2009-10-20 07:04 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2009-10-16 07:02 . 2009-10-16 07:02 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-14 21:29 . 2009-07-31 16:25 -------- d-----w- c:\documents and settings\D\Application Data\Skype
2009-11-14 21:21 . 2007-08-27 05:32 -------- d-----w- c:\documents and settings\D\Application Data\WTablet
2009-11-14 21:18 . 2009-09-04 16:39 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-14 20:29 . 2008-02-20 04:50 -------- d-----w- c:\program files\Java
2009-11-14 20:25 . 2007-08-26 13:59 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-14 15:45 . 2009-07-31 16:26 -------- d-----w- c:\documents and settings\D\Application Data\skypePM
2009-11-13 08:12 . 2009-07-17 22:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-09 22:28 . 2008-04-07 10:36 -------- d-----w- c:\documents and settings\D\Application Data\uTorrent
2009-11-09 21:53 . 2007-09-03 12:08 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-11-09 21:52 . 2009-08-24 23:53 -------- dc----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-11-08 03:06 . 2008-06-17 03:20 -------- d-----w- c:\program files\AVG
2009-11-07 23:49 . 2007-08-03 05:26 -------- d-----w- c:\program files\Lavasoft
2009-11-07 00:36 . 2009-07-18 00:55 -------- d-----w- c:\program files\Vuze
2009-10-25 06:40 . 2009-09-19 20:40 25 ----a-w- c:\windows\popcinfot.dat
2009-10-21 23:39 . 2009-09-01 00:36 -------- d-----w- c:\program files\MilkShape 3D 1.8.5
2009-10-16 20:23 . 2007-07-18 01:13 103320 -c--a-w- c:\documents and settings\D\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-11 09:17 . 2009-08-19 04:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-04 18:59 . 2009-08-27 21:00 -------- d-----w- c:\program files\s3pe
2009-10-02 22:41 . 2009-08-27 21:01 -------- d-----w- c:\program files\s3oc
2009-09-24 16:21 . 2007-11-04 16:42 -------- d-----w- c:\documents and settings\D\Application Data\U3
2009-09-21 16:20 . 2009-09-21 16:20 -------- d-----w- c:\program files\WinSCP
2009-09-21 00:04 . 2009-07-15 17:20 -------- d-----w- c:\program files\NVIDIA Corporation
2009-09-21 00:04 . 2007-07-18 01:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-21 00:03 . 2009-07-15 17:20 151552 ----a-w- c:\windows\system32\nvRegDev.dll
2009-09-19 18:56 . 2009-09-19 18:56 -------- dc----w- c:\documents and settings\All Users\Application Data\PopCap Games
2009-09-19 17:45 . 2009-09-19 17:41 -------- d-----w- c:\documents and settings\D\Application Data\Sony
2009-09-19 17:44 . 2009-09-19 17:44 -------- d-----w- c:\program files\Common Files\Sony Shared
2009-09-19 17:44 . 2009-09-19 17:43 -------- d-----w- c:\program files\Sony
2009-09-19 17:44 . 2009-09-19 17:44 10134 ----a-r- c:\documents and settings\D\Application Data\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
2009-09-19 17:43 . 2009-09-19 17:43 -------- dc----w- c:\documents and settings\All Users\Application Data\Sony Corporation
2009-09-19 17:41 . 2009-09-19 17:41 -------- d-----w- c:\documents and settings\D\Application Data\Sony Setup
2009-09-19 17:40 . 2009-09-19 17:40 -------- d-----w- c:\program files\Sony Setup
2009-09-11 21:41 . 2008-06-07 02:15 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-09-11 14:18 . 2004-08-04 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 12:03 . 2009-09-04 12:03 488968 ----a-w- c:\documents and settings\D\Application Data\Real\Update\setup\setup.exe
2009-08-29 08:08 . 2006-03-04 03:33 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2004-08-04 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-19 04:38 . 2009-08-19 04:38 152576 ------w- c:\documents and settings\D\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-18 03:33 . 2009-08-18 03:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25607976]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-12 2020120]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-12 7626752]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-05 185896]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-12 86016]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-12 1519616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-08 03:07 12464 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Abacast\\Abaclient.exe"=
"c:\\Program Files\\e frontier\\Poser 7\\Poser.exe"=
"c:\\Program Files\\Autodesk\\Maya2008\\bin\\maya.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Crazybump Beta Test\\CrazyBump.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\WINDOWS\\system32\\Tablet.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/7/2009 10:07 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/7/2009 10:07 PM 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/7/2009 10:06 PM 285392]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe --> c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [?]
S3 axskbus;axskbus;c:\windows\system32\DRIVERS\axskbus.sys --> c:\windows\system32\DRIVERS\axskbus.sys [?]
S3 QCAbsee;Logitech QuickCam Web (0801);c:\windows\system32\drivers\OVCA.sys [10/3/2007 11:56 PM 25088]
S3 XDva011;XDva011;\??\c:\windows\system32\XDva011.sys --> c:\windows\system32\XDva011.sys [?]
S3 XDva020;XDva020;\??\c:\windows\system32\XDva020.sys --> c:\windows\system32\XDva020.sys [?]
S3 XDva090;XDva090;\??\c:\windows\system32\XDva090.sys --> c:\windows\system32\XDva090.sys [?]
S3 XDva190;XDva190;\??\c:\windows\system32\XDva190.sys --> c:\windows\system32\XDva190.sys [?]
--- Other Services/Drivers In Memory ---
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\D\Application Data\Mozilla\Firefox\Profiles\fa8cq251.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-11-14 16:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys spnw.sys hal.dll >>UNKNOWN [0x8A881938]<<
kernel: MBR read successfully
user & kernel MBR OK
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.net
atapi.sys @ 0x0 0x0 bytes
\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xBA609B40 atapi.sys
\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xBA609B40 atapi.sys
\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xBA609B40 atapi.sys
\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xBA609B40 atapi.sys
\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xBA609B40 atapi.sys
\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xBA609B40 atapi.sys
\Driver\atapi IRP hooks detected !
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,20,2e,d3,83,e0,a8,f3,4f,b1,92,7e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,20,2e,d3,83,e0,a8,f3,4f,b1,92,7e,\
[HKEY_USERS\S-1-5-21-602162358-1177238915-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{83CF03DE-408E-5F6E-94BF-9582B7C2E820}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaanmcphgmojbepbhm"=hex:6a,61,64,6f,70,65,6b,6f,6c,68,6a,6b,65,6c,6d,61,67,67,
70,6a,00,f0
"hagncbooklchmfoh"=hex:6a,61,64,6f,6b,65,6c,70,65,68,6c,69,64,6e,68,63,69,6d,
70,6d,00,e2
"handeiegdejkdelb"=hex:64,63,6a,62,6b,67,67,6d,62,64,65,70,68,6d,69,67,62,62,
6f,63,6d,6e,69,61,6d,6c,62,6a,6a,66,6c,65,6b,64,6b,6d,68,69,61,62,69,68,6f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{83CF03DE-408E-5F6E-94BF-9582B7C2E820}\InProcServer32*]
"jacnhpplokjcbfdgfape"=hex:6a,61,64,6f,70,65,6b,6f,6c,68,6a,6b,65,6c,6d,61,67,
67,70,6a,00,00
"iacnbpfbdhommnmdio"=hex:6a,61,64,6f,6b,65,6c,70,65,68,6c,69,64,6e,68,63,69,6d,
70,6d,00,e2
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(848)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-11-14 16:48
ComboFix-quarantined-files.txt 2009-11-14 21:48
Pre-Run: 45,013,123,072 bytes free
Post-Run: 45,007,212,544 bytes free
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 4CC4B45DF6B027FBD1E132B2B239E9F8