ComboFix 08-04-10.9 - f.a.moyle 2008-04-12 7:19:22.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.385 [GMT 1:00] Running from: C:\stella\ComboFix.exe Command switches used :: C:\stella\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\system32\eephhont.ini C:\WINDOWS\system32\emqoasow.ini C:\WINDOWS\system32\qvobgnoz.exe C:\WINDOWS\system32\tnohhpee.dll_old . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\uzsrmtyd C:\Program Files\vidica C:\Program Files\vidica\INSTALL.LOG C:\WINDOWS\system32\eephhont.ini C:\WINDOWS\system32\emqoasow.ini C:\WINDOWS\system32\qvobgnoz.exe . ((((((((((((((((((((((((( Files Created from 2008-03-12 to 2008-04-12 ))))))))))))))))))))))))))))))) . 2008-04-12 06:41 . 2008-04-12 06:41 d-------- C:\Program Files\Lavasoft 2008-04-12 06:41 . 2008-04-12 06:42 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-10 13:49 . 2008-04-11 16:00 496 --a------ C:\WINDOWS\wininit.ini 2008-04-10 13:15 . 2008-04-10 13:15 d-------- C:\Program Files\Spybot - Search & Destroy 2008-04-10 13:15 . 2008-04-10 14:28 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-04-10 08:54 . 2008-04-10 08:54 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-04-10 08:54 . 2008-04-10 08:54 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-04-10 08:24 . 2008-04-10 08:24 d-------- C:\WINDOWS\ERUNT 2008-04-10 08:22 . 2004-09-30 11:07 d-------- C:\Documents and Settings\Administrator\WINDOWS 2008-04-10 08:22 . 2004-09-30 11:18 d-------- C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver 2008-04-10 08:22 . 2004-09-30 11:20 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2008-04-10 08:19 . 2008-04-10 08:51 d-------- C:\temp\116-FIO-notes 2008-04-10 08:19 . 2008-04-10 08:43 d-------- C:\SDFix 2008-04-10 08:17 . 2008-04-12 07:19 d-------- C:\stella 2008-04-10 08:16 . 2008-04-12 07:15 d-------- C:\temp 2008-04-08 12:13 . 2008-04-08 12:13 d-------- C:\Documents and Settings\f.a.moyle\Application Data\TmpRecentIcons 2008-03-21 19:16 . 2008-03-21 19:16 d-------- C:\Program Files\Windows Sidebar 2008-03-21 19:14 . 2008-03-21 20:16 d-------- C:\Program Files\Norton Internet Security 2008-03-21 17:29 . 2008-03-21 19:33 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-03-21 17:29 . 2008-03-21 19:33 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-03-21 17:29 . 2008-03-21 19:33 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-03-21 17:29 . 2008-03-21 19:33 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-12 05:56 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-04-12 05:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-04-12 05:40 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-03-21 18:33 --------- d-----w C:\Program Files\Symantec 2008-03-21 18:19 --------- d-----w C:\Documents and Settings\f.a.moyle\Application Data\Symantec 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-06 21:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf 2008-03-06 21:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys 2008-03-06 21:32 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat 2008-03-01 17:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:55 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-02-29 08:55 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:32 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:32 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll . ((((((((((((((((((((((((((((( snapshot@2008-04-11_16.59.54.93 ))))))))))))))))))))))))))))))))))))))))) . + 2007-12-07 02:21:45 124,928 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\advpack.dll + 2007-12-19 23:01:06 347,136 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtmsft.dll + 2007-12-07 02:21:45 214,528 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtrans.dll + 2007-12-07 02:21:45 133,120 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\extmgr.dll + 2007-12-07 02:21:45 63,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\icardie.dll + 2007-12-06 11:00:57 70,656 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ie4uinit.exe + 2007-12-07 02:21:45 153,088 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakeng.dll + 2007-12-07 02:21:45 230,400 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieaksie.dll + 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakui.dll + 2007-12-07 02:21:45 383,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieapfltr.dll + 2007-12-07 02:21:45 384,512 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iedkcs32.dll + 2007-12-07 02:21:46 6,066,176 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieframe.dll + 2007-12-07 02:21:46 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iernonce.dll + 2007-12-07 02:21:46 267,776 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iertutil.dll + 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieudinit.exe + 2007-12-06 11:01:25 625,664 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe + 2007-12-07 02:21:47 27,648 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\jsproxy.dll + 2007-12-07 02:21:47 459,264 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeeds.dll + 2007-12-07 02:21:47 52,224 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeedsbs.dll + 2007-12-08 05:21:48 3,592,192 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtml.dll + 2007-12-07 02:21:47 478,208 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtmled.dll + 2007-12-07 02:21:48 193,024 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msrating.dll + 2007-12-07 02:21:48 671,232 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mstime.dll + 2007-12-07 02:21:48 102,912 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\occache.dll + 2008-01-11 05:53:32 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\pngfilt.dll + 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe + 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\updspapi.dll + 2007-12-07 02:21:48 105,984 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\url.dll + 2007-12-07 02:21:48 1,159,680 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\urlmon.dll + 2007-12-07 02:21:48 233,472 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\webcheck.dll + 2007-12-07 02:21:48 824,832 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll - 2008-03-21 17:34:45 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2008-04-11 16:49:51 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2008-03-21 17:34:45 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe + 2008-04-11 16:49:51 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe - 2008-03-21 17:34:45 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe + 2008-04-11 16:49:51 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2008-03-21 17:34:45 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2008-04-11 16:49:51 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe - 2008-03-21 17:34:45 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2008-04-11 16:49:51 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2008-03-21 17:34:45 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe + 2008-04-11 16:49:51 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe - 2008-03-21 17:34:45 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe + 2008-04-11 16:49:51 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe - 2008-03-21 17:34:45 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2008-04-11 16:49:51 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2008-03-21 17:34:45 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe + 2008-04-11 16:49:51 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe - 2008-03-21 17:34:45 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2008-04-11 16:49:50 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2008-04-12 05:41:15 1,038,336 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe + 2008-04-12 05:41:15 178,688 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe + 2008-04-12 05:41:15 171,008 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe + 2008-04-12 05:41:15 8,704 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe - 2007-12-07 02:21:45 124,928 ----a-w C:\WINDOWS\system32\advpack.dll + 2008-03-01 13:06:20 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2007-12-07 02:21:45 124,928 ----a-w C:\WINDOWS\system32\dllcache\advpack.dll + 2008-03-01 13:06:20 124,928 ----a-w C:\WINDOWS\system32\dllcache\advpack.dll - 2007-12-19 23:01:06 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-03-01 13:06:21 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2007-12-07 02:21:45 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-03-01 13:06:21 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2007-12-07 02:21:45 133,120 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2008-03-01 13:06:21 133,120 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll - 2007-12-07 02:21:45 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll + 2008-03-01 13:06:21 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll - 2007-12-07 02:21:45 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2008-03-01 13:06:21 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2007-12-07 02:21:45 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2008-03-01 13:06:21 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2007-12-07 02:21:45 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll + 2008-03-01 13:06:22 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll - 2007-12-07 02:21:45 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2008-03-01 13:06:22 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2007-12-07 02:21:46 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll + 2008-03-01 13:06:24 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll - 2007-12-07 02:21:46 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll + 2008-03-01 13:06:24 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll - 2007-12-07 02:21:46 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll + 2008-03-01 13:06:25 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll - 2007-12-07 02:21:47 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-03-01 13:06:25 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2007-12-07 02:21:47 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll + 2008-03-01 13:06:26 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll - 2007-12-07 02:21:47 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll + 2008-03-01 13:06:26 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll - 2007-12-07 02:21:47 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-03-01 13:06:28 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2007-12-07 02:21:48 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2008-03-01 13:06:28 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll - 2007-12-07 02:21:48 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2008-03-01 13:06:29 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll - 2007-12-07 02:21:48 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll + 2008-03-01 13:06:29 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll - 2008-01-11 05:53:32 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-03-01 13:06:29 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2007-12-07 02:21:48 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll + 2008-03-01 13:06:29 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll - 2007-12-07 02:21:48 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2008-03-01 13:06:30 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll - 2007-12-07 02:21:48 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll + 2008-03-01 13:06:30 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll - 2007-12-07 02:21:48 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-03-01 13:06:31 826,368 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll - 2006-06-26 17:37:10 148,480 ----a-w C:\WINDOWS\system32\dnsapi.dll + 2008-02-20 05:32:43 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll + 2007-07-11 12:37:26 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys + 2007-08-07 11:58:08 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys + 2007-08-07 11:56:58 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys - 2007-12-19 23:01:06 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2008-03-01 13:06:21 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2007-12-07 02:21:45 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2008-03-01 13:06:21 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2007-12-07 02:21:45 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll + 2008-03-01 13:06:21 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll - 2007-04-06 17:42:21 221,632 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-04-12 05:36:45 221,632 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2007-12-07 02:21:45 63,488 ----a-w C:\WINDOWS\system32\icardie.dll + 2008-03-01 13:06:21 63,488 ----a-w C:\WINDOWS\system32\icardie.dll - 2007-12-06 11:00:57 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2008-02-29 08:55:23 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe - 2007-12-07 02:21:45 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2008-03-01 13:06:21 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll - 2007-12-07 02:21:45 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2008-03-01 13:06:21 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll - 2007-12-06 04:59:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll + 2008-02-15 05:44:25 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll - 2007-12-07 02:21:45 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll + 2008-03-01 13:06:22 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2007-12-07 02:21:45 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2008-03-01 13:06:22 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll - 2007-12-07 02:21:46 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll + 2008-03-01 13:06:24 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll - 2007-12-07 02:21:46 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll + 2008-03-01 13:06:24 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll - 2007-12-07 02:21:46 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll + 2008-03-01 13:06:25 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2007-12-06 11:00:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2008-02-22 10:00:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe - 2007-12-07 02:21:47 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2008-03-01 13:06:25 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2007-12-14 10:32:52 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe + 2008-04-05 21:56:22 19,836,024 ----a-w C:\WINDOWS\system32\MRT.exe - 2007-12-07 02:21:47 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2008-03-01 13:06:26 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll - 2007-12-07 02:21:47 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2008-03-01 13:06:26 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll - 2007-12-08 05:21:48 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-03-01 17:36:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll - 2007-12-07 02:21:47 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2008-03-01 13:06:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2007-12-07 02:21:48 193,024 ----a-w C:\WINDOWS\system32\msrating.dll + 2008-03-01 13:06:28 193,024 ----a-w C:\WINDOWS\system32\msrating.dll - 2007-12-07 02:21:48 671,232 ----a-w C:\WINDOWS\system32\mstime.dll + 2008-03-01 13:06:29 671,232 ----a-w C:\WINDOWS\system32\mstime.dll - 2007-12-07 02:21:48 102,912 ----a-w C:\WINDOWS\system32\occache.dll + 2008-03-01 13:06:29 102,912 ----a-w C:\WINDOWS\system32\occache.dll - 2008-01-11 05:53:32 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-03-01 13:06:29 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2007-12-07 02:21:48 105,984 ----a-w C:\WINDOWS\system32\url.dll + 2008-03-01 13:06:29 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2007-12-07 02:21:48 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-03-01 13:06:30 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll - 2007-12-07 02:21:48 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll + 2008-03-01 13:06:30 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll - 2007-12-07 02:21:48 824,832 ----a-w C:\WINDOWS\system32\wininet.dll + 2008-03-01 13:06:31 826,368 ----a-w C:\WINDOWS\system32\wininet.dll + 2008-04-12 05:45:51 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_ba4.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1BF71CDB-D4B5-48AB-B52F-D8DA7229EF0B}] C:\WINDOWS\system32\jkkKdbBQ.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CAB59B4-55A3-4737-9FD5-B93C6430BF75}] C:\WINDOWS\system32\aogagjoo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50E8CC4E-858E-4B2E-96FD-C929138B99BB}] C:\WINDOWS\temlxopqftg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}] 2007-08-25 04:51 316784 --a------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}] 2008-03-21 19:32 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BE1EB109-6BE2-4272-ACCE-E9B7A3D0831D}] C:\WINDOWS\system32\cbXRJYSm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D66354ED-F8D6-4063-8A8D-2B953621CC19}] C:\WINDOWS\system32\nnnnMGXN.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2007-08-25 04:51 316784] [HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [2007-08-25 04:51 316784] [HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 11:40 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-03 16:42 98304] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-09-30 11:24 180269] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 12:01 51048] "osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-08-25 05:53 714608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 08:56 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACTIVBOARD] --a------ 2003-05-02 11:31 24576 c:\apps\ABoard\ABoard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] --a------ 2008-02-14 12:01 51048 C:\Program Files\Common Files\Symantec Shared\ccApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 08:56 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HdReg] --a------ 2004-08-09 18:45 24576 C:\APPS\HDREG\HDREGAPP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2004-12-18 00:20 278528 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE] c:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck] --a------ 2007-08-25 05:53 714608 C:\Program Files\Norton Internet Security\osCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] --a------ 2004-08-12 11:06 81920 c:\Apps\Powercinema\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2005-07-03 16:42 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Windows KeyHook] --a------ 2004-04-16 15:53 249856 C:\WINDOWS\System32\keyhook.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper] E:\SpySweeper\SpySweeper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2004-02-22 23:44 32881 C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkTalk] --a------ 2005-08-16 00:12 192512 C:\Program Files\TalkTalk\bin\sprtcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2004-09-30 11:24 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "LiveUpdate Notice Service"=2 (0x2) "LiveUpdate Notice Ex"=2 (0x2) "LiveUpdate"=3 (0x3) "ccEvtMgr"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [] R3 Cap7134;ASUS TV7134 WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-07-18 10:17] R3 PhTVTune;ASUS WDM TV Tuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-07-18 03:23] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 22:32] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c193e6b3-f327-11db-84fd-00038a000015}] \Shell\AutoRun\command - E:\healthcheck.exe *Newly Created Service* - AAWSERVICE *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-04-12 05:50:03 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE "2008-04-12 05:38:17 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - f.a.moyle.job" - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK: . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-12 07:21:48 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-12 7:22:39 ComboFix-quarantined-files.txt 2008-04-12 06:22:20 ComboFix2.txt 2008-04-11 16:01:33 Pre-Run: 54,687,490,048 bytes free Post-Run: 54,675,021,824 bytes free . 2008-04-11 16:51:00 --- E O F ---