ComboFix 09-12-16.05 - Robert 12/17/2009 12:53:24.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2446 [GMT -8:00]
Running from: c:\downloads\KittyFix.exe
AV: avast! antivirus 4.8.1368 [VPS 091217-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\CrucialSoft Ltd
c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090208212818062.log
c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090208215416046.log
c:\documents and settings\Robert\Application Data\ShoppingReport
c:\documents and settings\Robert\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\Robert\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\Robert\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\Robert\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\Robert\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\Robert\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\Robert\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
c:\program files\ShoppingReport
c:\program files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll
c:\program files\ShoppingReport\Uninst.exe
c:\windows\system32\gaopdxcounter
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GAOPDXSERV.SYS
-------\Service_gaopdxserv.sys
((((((((((((((((((((((((( Files Created from 2009-11-17 to 2009-12-17 )))))))))))))))))))))))))))))))
.
2009-12-17 18:55 . 2009-12-17 18:55 -------- d-----w- c:\program files\CCleaner
2009-12-16 16:11 . 2009-12-16 16:11 -------- d-----w- c:\program files\TrendMicro
2009-12-15 04:55 . 2009-12-15 04:55 -------- d-----w- c:\documents and settings\Robert\Application Data\ManyCam
2009-12-14 04:18 . 2009-12-14 04:18 -------- d-----w- c:\documents and settings\Robert\Local Settings\Application Data\CometNetwork
2009-12-14 04:18 . 2009-12-14 04:18 -------- d-----w- c:\documents and settings\Robert\Application Data\CometNetwork
2009-12-14 04:17 . 2009-12-17 18:33 -------- d-----w- c:\program files\CometBird
2009-12-14 00:38 . 2009-12-14 00:40 -------- d-----w- c:\documents and settings\Robert\Application Data\Nero
2009-12-14 00:37 . 2009-12-14 00:37 -------- d-----w- c:\program files\Nero
2009-12-14 00:37 . 2009-12-14 00:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-12-14 00:37 . 2009-12-14 00:37 -------- d-----w- c:\program files\Common Files\Nero
2009-12-09 15:22 . 2009-10-20 16:20 265728 -c----w- c:\windows\system32\dllcache\http.sys
2009-12-06 07:45 . 2009-12-06 07:45 -------- d-----w- c:\program files\DivX
2009-12-06 07:45 . 2009-12-06 07:45 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-02 18:01 . 2009-12-02 18:01 -------- d-----w- c:\program files\Western Digital Corporation
2009-12-02 15:41 . 2009-12-17 20:48 -------- d-----w- c:\program files\Service Estimator
2009-11-29 05:38 . 2009-12-15 15:47 -------- d-----w- c:\documents and settings\Robert\Application Data\vlc
2009-11-29 03:53 . 2009-11-29 03:53 -------- d-----w- c:\program files\VideoLAN
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-17 20:58 . 2009-01-30 19:31 82304 ----a-w- c:\documents and settings\Robert\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-17 20:46 . 2009-11-07 01:28 -------- d-----w- c:\program files\BitComet
2009-12-17 17:21 . 2009-02-07 23:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-16 16:11 . 2009-12-16 16:11 388096 ----a-r- c:\documents and settings\Robert\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2009-12-14 04:16 . 2009-12-14 04:16 1032192 ----a-w- c:\documents and settings\Robert\Application Data\Mozilla\Firefox\Profiles\g7brkuiw.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash\components\IBitCometExtension.dll
2009-12-14 01:25 . 2009-05-27 00:31 -------- d-----w- c:\documents and settings\Robert\Application Data\FileZilla
2009-12-11 21:00 . 2009-10-15 15:52 -------- d-----w- c:\documents and settings\Robert\Application Data\Skype
2009-12-11 19:07 . 2009-10-15 15:53 -------- d-----w- c:\documents and settings\Robert\Application Data\skypePM
2009-12-11 02:21 . 2009-09-22 01:21 3695616 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-12-09 16:12 . 2009-07-09 23:24 60744 ----a-w- c:\documents and settings\Robert\g2mdlhlpx.exe
2009-12-06 07:46 . 2009-02-20 06:24 -------- d-----w- c:\program files\Google
2009-12-01 19:44 . 2009-06-24 02:20 -------- d-----w- c:\program files\ContentWatch
2009-12-01 16:43 . 2009-06-24 02:20 975872 ----a-w- c:\windows\system32\libxml2_CW.dll
2009-12-01 16:43 . 2009-06-24 02:20 151552 ----a-w- c:\windows\system32\libexpat.dll
2009-12-01 16:43 . 2009-06-24 02:20 668672 ----a-w- c:\windows\system32\cwalsp.dll
2009-12-01 16:43 . 2009-06-24 02:20 1859584 ----a-w- c:\windows\system32\AltaRecovery.exe
2009-12-01 16:43 . 2009-06-24 02:20 991232 ----a-w- c:\windows\system32\wxcode_msw28u_wxcurl_CW.dll
2009-12-01 16:43 . 2009-06-24 02:20 81920 ----a-w- c:\windows\system32\wxcode_msw28u_wxjson_CW.dll
2009-11-24 23:54 . 2009-03-06 06:38 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-03-06 06:38 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2009-03-06 06:38 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2009-03-06 06:38 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-03-06 06:38 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-03-06 06:38 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-03-06 06:38 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-03-06 06:38 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-03-06 06:38 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-17 03:11 . 2009-11-17 00:39 -------- d-----w- c:\program files\ATI
2009-11-17 03:09 . 2009-01-30 18:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-17 02:55 . 2009-11-17 00:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Cyberlink
2009-11-17 00:45 . 2009-11-17 00:45 -------- d-----w- c:\documents and settings\Robert\Application Data\CyberLink
2009-11-17 00:42 . 2009-11-17 00:42 -------- d-----w- c:\program files\DIFX
2009-11-17 00:39 . 2009-11-17 00:39 9158 ----a-r- c:\documents and settings\Robert\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-11-17 00:39 . 2009-11-17 00:39 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-11-17 00:39 . 2009-11-17 00:38 -------- d-----w- c:\program files\USB TV
2009-11-11 08:28 . 2009-11-11 08:28 247280 ----a-w- c:\documents and settings\Robert\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-11-05 03:22 . 2009-11-05 03:07 -------- d-----w- c:\program files\guru's Yahoo Group Downloader Demo
2009-11-05 03:19 . 2009-11-05 03:19 -------- d-----w- c:\documents and settings\Robert\Application Data\YDownloader2 Debug
2009-11-05 03:08 . 2009-11-05 03:08 -------- d-----w- c:\documents and settings\Robert\Application Data\YDownloader2
2009-11-03 20:45 . 2009-02-08 04:15 -------- d-----w- c:\program files\Java
2009-11-03 20:44 . 2009-11-03 20:44 152576 ----a-w- c:\documents and settings\Robert\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-02 15:46 . 2009-02-12 01:41 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-11-02 15:44 . 2009-04-01 00:02 -------- d-----w- c:\documents and settings\Robert\Application Data\ESTsoft
2009-11-02 15:44 . 2009-04-01 00:01 -------- d-----w- c:\documents and settings\All Users\Application Data\ESTsoft
2009-10-30 19:40 . 2009-02-14 05:28 -------- d-----w- c:\program files\MSECache
2009-10-29 07:45 . 2008-04-23 03:35 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-27 16:51 . 2009-02-15 20:22 -------- d-----w- c:\program files\Microsoft Works
2009-10-27 15:57 . 2009-10-27 15:57 35840 ------w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\0542BFF0C7A449DEAF051AB2D4F66F51\SkypeTwitterUpdate.exe
2009-10-27 15:57 . 2009-10-27 15:57 180224 ------w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\0542BFF0C7A449DEAF051AB2D4F66F51\Interop.SKYPE4COMLib.dll
2009-10-26 14:43 . 2009-08-02 18:43 -------- d-----w- c:\program files\IPRental
2009-10-26 14:43 . 2009-08-02 18:43 -------- d-----w- c:\documents and settings\Robert\Application Data\IPRental
2009-10-25 22:52 . 2009-10-25 22:52 73728 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\263AF18BA8E6473194D1E386FDADB7DE\clubInstaller.exe
2009-10-25 22:44 . 2009-10-25 22:44 -------- d-----w- c:\program files\Common Files\Innerpass
2009-10-25 22:44 . 2009-10-25 22:44 143360 ----a-w- c:\windows\system32\unzip32.dll
2009-10-25 22:40 . 2009-10-25 22:40 1962496 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\C528FFB1B9EC473792CF67849E25EDB6\JyveNotifier.exe
2009-10-21 05:38 . 2008-04-14 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2008-04-14 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2008-04-14 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-20 14:53 . 2009-10-20 14:53 -------- d-----w- c:\documents and settings\Robert\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-10-19 19:27 . 2009-10-19 19:27 -------- d-----w- c:\program files\Microsoft File Transfer Manager
2009-10-18 23:44 . 2009-10-18 23:26 -------- d-----w- c:\documents and settings\Robert\Application Data\Winamp
2009-10-18 23:30 . 2009-10-18 23:30 -------- d-----w- c:\program files\Common Files\NSV
2009-10-18 23:26 . 2009-10-18 23:26 -------- d-----w- c:\program files\Winamp
2009-10-16 01:21 . 2009-06-23 01:23 2353992 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-10-15 15:53 . 2009-10-15 15:53 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-13 10:30 . 2008-04-14 12:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-13 02:58 . 2008-04-23 14:21 150016 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:28 . 2008-04-14 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-11 14:58 . 2009-10-11 14:58 38208 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-11 14:58 . 2009-06-28 14:22 38208 ----a-w- c:\documents and settings\Robert\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-11 12:17 . 2009-02-08 06:30 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-29 20:36 . 2009-09-29 20:36 626688 ----a-w- c:\documents and settings\Robert\Application Data\Adobe\Shockwave Player 11\xtras\download\metaioGmbH\UnifeyeViewer\msvcr80.dll
2009-09-29 20:36 . 2009-09-29 20:36 933888 ----a-w- c:\documents and settings\Robert\Application Data\Adobe\Shockwave Player 11\xtras\download\metaioGmbH\UnifeyeViewer\cxcore100.dll
2009-09-29 20:36 . 2009-09-29 20:36 724992 ----a-w- c:\documents and settings\Robert\Application Data\Adobe\Shockwave Player 11\xtras\download\metaioGmbH\UnifeyeViewer\cv100.dll
2009-09-29 20:36 . 2009-09-29 20:36 598016 ----a-w- c:\documents and settings\Robert\Application Data\Adobe\Shockwave Player 11\xtras\download\metaioGmbH\UnifeyeViewer\highgui100.dll
2009-09-29 20:36 . 2009-09-29 20:36 548864 ----a-w- c:\documents and settings\Robert\Application Data\Adobe\Shockwave Player 11\xtras\download\metaioGmbH\UnifeyeViewer\msvcp80.dll
2009-09-29 20:36 . 2009-09-29 20:36 24064 ----a-w- c:\documents and settings\Robert\Application Data\Adobe\Shockwave Player 11\xtras\download\metaioGmbH\UnifeyeViewer\ESMlib.dll
2009-06-17 22:48 . 2009-06-17 22:48 4637952 ----a-w- c:\program files\Common Files\lpuninstall.exe
2009-09-23 16:56 . 2009-09-23 16:56 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-09-23 16:56 . 2009-09-23 16:56 126360 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-09-23 16:56 . 2009-09-23 16:56 46408 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll
2009-09-23 16:56 . 2009-09-23 16:56 98712 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-10 01:40 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F533E300-85E2-46FA-9CD9-5358BF11EE42}]
2009-06-25 14:32 390656 ----a-w- c:\windows\system32\TwebstBHO.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-10 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-10 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-01-17 01:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-29 39408]
"Google Update"="c:\documents and settings\Robert\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-08 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
"nwiz"="nwiz.exe" [2009-01-15 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-03-17 1040384]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"RCScheduleCheck"="c:\program files\VCOM\Recovery Commander\RCSCHED.EXE" [2003-10-21 151552]
"Fix-It AV"="c:\progra~1\VCOM\SYSTEM~1\MemCheck.exe" [2003-06-12 32768]
"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-31 286720]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-09-22 520024]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"cwcptray"="c:\program files\ContentWatch\Internet Protection\cwtray.exe" [2009-12-01 352064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BDARemote.lnk - c:\program files\USB TV\EM28XX\BDARemote.exe [2009-11-16 81997]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-3-10 805392]
Microsoft Office.lnk - c:\program files\Microsoft Office 2000\Office\OSA9.EXE [1999-2-17 65588]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2009-12-17 908248]
Shortcut to MAP_SIG.ahk.lnk - c:\program files\AutoHotKey\MAP_SIG.ahk [2009-6-11 3446]
SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2006-11-8 6366792]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{a5780613-492e-4a2a-a7fd-549610edf6cc}"= "c:\program files\VCOM\Recovery Commander\RCHOOK.DLL" [2003-07-08 102400]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 09:42 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\Robert\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Documents and Settings\\Robert\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\MSACCESS.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16440:TCP"= 16440:TCP:BitComet 16440 TCP
"16440:UDP"= 16440:UDP:BitComet 16440 UDP
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [3/5/2009 6:21 PM 64160]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [6/10/2008 2:33 AM 150568]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [3/5/2009 10:38 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/5/2009 10:38 PM 20560]
R2 CwAltaService20;ContentWatch;c:\program files\ContentWatch\Internet Protection\cwsvc.exe [6/23/2009 6:20 PM 2072384]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 1:34 PM 1028432]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [3/4/2008 6:30 PM 34128]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [8/24/2009 7:00 AM 234888]
S2 gupdate1c9a59b89f56226;Google Update Service (gupdate1c9a59b89f56226);c:\program files\Google\Update\GoogleUpdate.exe [3/15/2009 10:26 AM 133104]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Robert\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\Robert\LOCALS~1\Temp\ALSysIO.sys [?]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = 127.0.0.1
uInternet Settings,ProxyServer = 127.0.0.1:9666
IE: {{578FC4E3-151E-456c-AF8E-B63061EFE228} - c:\program files\GhostSurf\LaunchPCC.exe
LSP: c:\windows\system32\cwalsp.dll
Trusted Zone: socialmediascience.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {2AD0C02D-3A2E-4192-BD8A-19C89BD0DFF1} - file:///C:/Documents%20and%20Settings/All%20Users/Application%20Data/Skype/Plugins/Plugins/263AF18BA8E6473194D1E386FDADB7DE/4USclub.cab
FF - ProfilePath - c:\documents and settings\Robert\Application Data\Mozilla\Firefox\Profiles\g7brkuiw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - TweetGrid Search
FF - prefs.js: browser.startup.homepage - hxxp://mail.google.com/mail/?zx=1e29u367hrgvz&shva=1#inbox
FF - component: c:\documents and settings\Robert\Application Data\Mozilla\Firefox\Profiles\g7brkuiw.default\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\documents and settings\Robert\Application Data\Mozilla\Firefox\Profiles\g7brkuiw.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Robert\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Robert\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npDimdimControl.dll
---- FIREFOX POLICIES ----
.
- - - - ORPHANS REMOVED - - - -
Toolbar-Locked - (no file)
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-IBP - (no file)
Notify-AtiExtEvent - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2009-12-17 12:59
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-507921405-1500820517-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(696)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
- - - - - - - > 'lsass.exe'(752)
c:\windows\system32\cwalsp.dll
c:\windows\system32\wxbase28u_vc_CW.dll
- - - - - - - > 'explorer.exe'(404)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\AutoHotKey\AutoHotkey.exe
c:\program files\TechSmith\SnagIt 8\TSCHelp.exe
c:\program files\TechSmith\SnagIt 8\SnagPriv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\progra~1\VCOM\SYSTEM~1\MXTask.exe
c:\windows\system32\SearchIndexer.exe
c:\progra~1\VCOM\SYSTEM~1\mxtask.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Completion time: 2009-12-17 13:02:25 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-17 21:02
Pre-Run: 603,891,474,432 bytes free
Post-Run: 603,786,792,960 bytes free
- - End Of File - - 3610D0A05A17B157C543AA3CC94FC953