dzmr5s
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, July 23, 2010
Operating system: Microsoft Windows Vista Home Basic Edition, 32-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, July 23, 2010 19:58:01
Records in database: 4227171
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Kaspersky Log:
Scan area My Computer
C:\
D:\
Scan statistics
Objects scanned 176124
Threats found 2
Infected objects found 2
Suspicious objects found 0
Scan duration 04:16:28
File name Threat Threats count
C:\Qoobox\Quarantine\[4]-Submit_2010-07-23_13.19.53.zip Infected: Trojan-Downloader.Win32.FraudLoad.xeku 1
C:\Users\Wayne\Desktop\ComboFix.exe Infected: Trojan-Clicker.Win32.Wistler.a 1
Malwarebytes:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4339
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928
7/23/2010 5:05:21 PM
mbam-log-2010-07-23 (17-05-21).txt
Scan type: Quick scan
Objects scanned: 125012
Time elapsed: 7 minute(s), 38 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
ComboFix:
ComboFix 10-07-22.06 - Wayne 07/23/2010 16:04:20.3.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.893.410 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Wayne\Desktop\CFScript.txt
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2010-06-23 to 2010-07-23 )))))))))))))))))))))))))))))))
.
2010-07-23 20:11 . 2010-07-23 20:11 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-07-23 20:11 . 2010-07-23 20:11 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-07-23 01:46 . 2010-07-23 01:46 ——– d—–w- c:\program files\ESET
2010-07-22 20:20 . 2010-07-22 20:20 ——– d—–w- c:\users\Wayne\AppData\Roaming\Malwarebytes
2010-07-22 20:20 . 2010-04-29 19:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-22 20:20 . 2010-07-22 20:20 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-22 20:20 . 2010-07-22 20:20 ——– d—–w- c:\programdata\Malwarebytes
2010-07-22 20:20 . 2010-04-29 19:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-29 23:56 . 2010-06-29 23:56 ——– d—–w- c:\program files\MSECache
2010-06-26 07:03 . 2010-06-26 07:03 ——– d—–w- c:\program files\Microsoft.NET
2010-06-24 07:01 . 2009-11-08 14:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-24 07:01 . 2009-11-08 14:55 49472 —-a-w- c:\windows\system32\netfxperf.dll
2010-06-24 07:01 . 2009-11-08 14:55 297808 —-a-w- c:\windows\system32\mscoree.dll
2010-06-24 07:01 . 2009-11-08 14:55 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2010-06-24 07:01 . 2009-11-08 14:55 1130824 —-a-w- c:\windows\system32\dfshim.dll
2010-06-24 02:10 . 2010-04-16 16:43 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-06-24 02:10 . 2010-04-16 14:39 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-19 04:59 . 2008-06-16 01:14 680 —-a-w- c:\users\Wayne\AppData\Local\d3d9caps.dat
2010-07-14 07:02 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-06-23 01:27 . 2010-06-23 01:27 501936 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtbD0BD.tmp.exe
2010-06-09 08:06 . 2010-06-09 08:06 976832 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
2010-05-26 17:06 . 2010-06-11 21:36 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-11 21:36 289792 —-a-w- c:\windows\system32\atmfd.dll
2010-05-21 18:14 . 2010-02-08 02:46 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-05-04 05:59 . 2010-06-11 21:37 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-11 21:37 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55 . 2010-06-11 21:37 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31 . 2010-06-11 21:37 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-11 21:36 2037248 —-a-w- c:\windows\system32\win32k.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-07-23_14.54.41 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-27 19:58 . 2010-07-23 14:31 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-27 19:58 . 2010-07-23 19:16 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-27 19:58 . 2010-07-23 19:16 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-27 19:58 . 2010-07-23 14:31 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-27 19:58 . 2010-07-23 19:16 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-27 19:58 . 2010-07-23 14:31 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-23 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"WorksFUD"="c:\program files\Microsoft Works\wkfud.exe" [2001-10-06 24576]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2001-08-23 331830]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2004-06-04 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-8-7 24633]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(
:c9,88,c7,49,31,81,ca,01
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 135664]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 18:14]
2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 18:14]
2010-07-23 c:\windows\Tasks\User_Feed_Synchronization-{057D6622-AEF5-40A5-8ECC-762BE0A5D5D9}.job
- c:\windows\system32\msfeedssync.exe [2010-06-11 04:30]
.
.
——- Supplementary Scan ——-
.
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-23 16:12
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-07-23 16:15:26
ComboFix-quarantined-files.txt 2010-07-23 20:15
ComboFix2.txt 2010-07-23 19:08
ComboFix3.txt 2010-07-23 14:58
Pre-Run: 41,719,918,592 bytes free
Post-Run: 41,704,083,456 bytes free
- - End Of File - - EB536D8A6EB6E400BF03F67BC44AB214
Friday, July 23, 2010
Operating system: Microsoft Windows Vista Home Basic Edition, 32-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, July 23, 2010 19:58:01
Records in database: 4227171
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Kaspersky Log:
Scan area My Computer
C:\
D:\
Scan statistics
Objects scanned 176124
Threats found 2
Infected objects found 2
Suspicious objects found 0
Scan duration 04:16:28
File name Threat Threats count
C:\Qoobox\Quarantine\[4]-Submit_2010-07-23_13.19.53.zip Infected: Trojan-Downloader.Win32.FraudLoad.xeku 1
C:\Users\Wayne\Desktop\ComboFix.exe Infected: Trojan-Clicker.Win32.Wistler.a 1
Malwarebytes:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4339
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928
7/23/2010 5:05:21 PM
mbam-log-2010-07-23 (17-05-21).txt
Scan type: Quick scan
Objects scanned: 125012
Time elapsed: 7 minute(s), 38 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
ComboFix:
ComboFix 10-07-22.06 - Wayne 07/23/2010 16:04:20.3.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.893.410 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Wayne\Desktop\CFScript.txt
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2010-06-23 to 2010-07-23 )))))))))))))))))))))))))))))))
.
2010-07-23 20:11 . 2010-07-23 20:11 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-07-23 20:11 . 2010-07-23 20:11 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-07-23 01:46 . 2010-07-23 01:46 ——– d—–w- c:\program files\ESET
2010-07-22 20:20 . 2010-07-22 20:20 ——– d—–w- c:\users\Wayne\AppData\Roaming\Malwarebytes
2010-07-22 20:20 . 2010-04-29 19:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-22 20:20 . 2010-07-22 20:20 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-22 20:20 . 2010-07-22 20:20 ——– d—–w- c:\programdata\Malwarebytes
2010-07-22 20:20 . 2010-04-29 19:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-29 23:56 . 2010-06-29 23:56 ——– d—–w- c:\program files\MSECache
2010-06-26 07:03 . 2010-06-26 07:03 ——– d—–w- c:\program files\Microsoft.NET
2010-06-24 07:01 . 2009-11-08 14:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-24 07:01 . 2009-11-08 14:55 49472 —-a-w- c:\windows\system32\netfxperf.dll
2010-06-24 07:01 . 2009-11-08 14:55 297808 —-a-w- c:\windows\system32\mscoree.dll
2010-06-24 07:01 . 2009-11-08 14:55 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2010-06-24 07:01 . 2009-11-08 14:55 1130824 —-a-w- c:\windows\system32\dfshim.dll
2010-06-24 02:10 . 2010-04-16 16:43 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-06-24 02:10 . 2010-04-16 14:39 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-19 04:59 . 2008-06-16 01:14 680 —-a-w- c:\users\Wayne\AppData\Local\d3d9caps.dat
2010-07-14 07:02 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-06-23 01:27 . 2010-06-23 01:27 501936 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtbD0BD.tmp.exe
2010-06-09 08:06 . 2010-06-09 08:06 976832 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
2010-05-26 17:06 . 2010-06-11 21:36 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-11 21:36 289792 —-a-w- c:\windows\system32\atmfd.dll
2010-05-21 18:14 . 2010-02-08 02:46 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-05-04 05:59 . 2010-06-11 21:37 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-11 21:37 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55 . 2010-06-11 21:37 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31 . 2010-06-11 21:37 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-11 21:36 2037248 —-a-w- c:\windows\system32\win32k.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-07-23_14.54.41 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-27 19:58 . 2010-07-23 14:31 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-27 19:58 . 2010-07-23 19:16 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-27 19:58 . 2010-07-23 19:16 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-27 19:58 . 2010-07-23 14:31 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-27 19:58 . 2010-07-23 19:16 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-27 19:58 . 2010-07-23 14:31 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-23 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"WorksFUD"="c:\program files\Microsoft Works\wkfud.exe" [2001-10-06 24576]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2001-08-23 331830]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2004-06-04 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-8-7 24633]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(
:c9,88,c7,49,31,81,ca,01R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 135664]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 18:14]
2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 18:14]
2010-07-23 c:\windows\Tasks\User_Feed_Synchronization-{057D6622-AEF5-40A5-8ECC-762BE0A5D5D9}.job
- c:\windows\system32\msfeedssync.exe [2010-06-11 04:30]
.
.
——- Supplementary Scan ——-
.
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-23 16:12
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-07-23 16:15:26
ComboFix-quarantined-files.txt 2010-07-23 20:15
ComboFix2.txt 2010-07-23 19:08
ComboFix3.txt 2010-07-23 14:58
Pre-Run: 41,719,918,592 bytes free
Post-Run: 41,704,083,456 bytes free
- - End Of File - - EB536D8A6EB6E400BF03F67BC44AB214
I really appreciate all of your help!
Thank you!! 
dzmr5s
