ComboFix 10-06-19.03 - Anne512 06/20/2010 10:48:39.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.851 [GMT -4:00]
Running from: c:\users\Anne512\Downloads\ComboFix.exe
Command switches used :: c:\users\Anne512\Desktop\CFScript.txt
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FILE ::
"c:\users\Anne512\AppData\Local\d3d9caps.dat"
"c:\users\Anne512\AppData\Local\prvlcl.dat"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Anne512\AppData\Local\d3d9caps.dat
c:\users\Anne512\AppData\Local\prvlcl.dat
c:\users\Anne512\AppData\Local\temp
c:\users\Anne512\AppData\Local\temp\~DF537E.tmp
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-10315934
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-1pixel-1.gif
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-1pixel-2.gif
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-1pixel-3.gif
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-1pixel.gif
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-counted-1
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-counted-2
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-counted
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-crossdomain-1.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-crossdomain-2.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-crossdomain-3.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-crossdomain-4.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-crossdomain-5.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-crossdomain-6.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-crossdomain.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-1
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-10
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-11
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-12
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-13
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-2
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-3
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-4
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-5
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-6
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-7
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-8
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist-9
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-getPlaylist
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-playlist-1
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-playlist-2
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-playlist
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-1.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-10.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-11.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-2.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-3.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-4.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-5.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-6.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-7.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-8.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant-9.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-quant.swf
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select-1.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select-2.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select-3.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select-4.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select-5.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select-6.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select-7.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select-8.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-select.ashx
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-video
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-videos-1
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-videos-2
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-videos-3
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-videos-4
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-videos-5
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-videos
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi-1.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi-2.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi-3.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi-4.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi-5.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi-6.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi-7.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi-8.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-2\plugin-WMya6q2ZoWwMuKXtLXZogamqxuLZuSgi.xml
c:\users\Anne512\AppData\Local\temp\plugtmp-3\plugin-config.jsp
c:\users\Anne512\AppData\Local\temp\plugtmp-3\plugin-crossdomain.xml
c:\users\Default\AppData\Local\temp
c:\users\Jannah and Aaminah\AppData\Local\temp
c:\users\Jannah and Aaminah\AppData\Local\temp\AdobeARM.log
c:\users\Jannah and Aaminah\AppData\Local\temp\AUInst.log
c:\users\Jannah and Aaminah\AppData\Local\temp\Jannah and Aaminah.bmp
c:\users\Jannah and Aaminah\AppData\Local\temp\jusched.log
c:\users\Paul\AppData\Local\temp
c:\users\Paul\AppData\Local\temp\AdobeARM.log
c:\users\Paul\AppData\Local\temp\AUInst.log
c:\users\Paul\AppData\Local\temp\jusched.log
c:\users\Paul\AppData\Local\temp\Paul.bmp
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SASDIFSV
-------\Legacy_SASKUTIL
-------\Service_SASDIFSV
-------\Service_SASENUM
-------\Service_SASKUTIL
((((((((((((((((((((((((( Files Created from 2010-05-20 to 2010-06-20 )))))))))))))))))))))))))))))))
.
2010-06-20 15:02 . 2010-06-20 15:02 -------- d-----w- c:\users\Anne512\AppData\Local\Temp
2010-06-14 04:10 . 2010-06-14 04:10 41216 ----a-w- c:\windows\system32\drivers\KHCAP.sys
2010-06-14 04:10 . 2010-06-14 04:10 -------- d-----w- c:\windows\ASMBB
2010-06-14 04:09 . 2010-06-14 04:09 -------- d-----w- c:\programdata\ASMSoftware
2010-06-14 04:09 . 2010-06-14 04:28 -------- d-----w- c:\program files\BlackBox
2010-06-14 03:31 . 2010-06-14 04:08 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-06-14 03:31 . 2010-06-14 03:31 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-10 19:20 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-06-02 17:22 . 2010-06-02 17:30 -------- d-----w- C:\5923c4c306690005cbe4
2010-06-02 17:13 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-06-02 17:13 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-06-01 05:31 . 2010-06-02 02:16 -------- d-----w- c:\programdata\Deskshare
2010-06-01 05:31 . 2010-06-01 05:31 -------- d-----w- c:\users\Anne512\AppData\Local\Xenocode
2010-06-01 05:23 . 2010-06-01 05:23 -------- d-----w- c:\program files\Pechora
2010-06-01 05:09 . 2010-06-01 05:09 -------- d-----w- c:\program files\Digi-Watcher.com
2010-06-01 01:40 . 2010-06-01 01:40 -------- d-----w- c:\users\Anne512\AppData\Roaming\SUPERAntiSpyware.com
2010-06-01 01:40 . 2010-06-01 01:40 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2010-05-22 23:30 . 2010-05-23 00:00 -------- d-----w- c:\users\Jannah and Aaminah\AppData\Local\Powercinema
2010-05-22 23:30 . 2010-05-22 23:30 -------- d-----w- c:\users\Jannah and Aaminah\AppData\Roaming\CyberLink
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-20 15:00 . 2007-11-15 09:10 12 ----a-w- c:\windows\bthservsdp.dat
2010-06-02 17:17 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-06-02 13:24 . 2010-02-10 01:35 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-02 13:24 . 2010-02-10 01:35 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-06-01 05:20 . 2007-12-05 07:13 -------- d-----w- c:\program files\OpenOffice.org 2.3
2010-05-31 03:18 . 2010-03-14 10:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-26 17:06 . 2010-06-10 19:19 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-10 19:19 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-19 22:10 . 2010-02-15 16:23 -------- d-----w- c:\users\Jannah and Aaminah\AppData\Roaming\KidZui
2010-05-15 13:02 . 2010-02-10 01:35 -------- d-----w- c:\programdata\AVG Security Toolbar
2010-05-10 04:31 . 2008-11-01 12:53 -------- d-----w- c:\users\Anne512\AppData\Roaming\ZoomBrowser EX
2010-05-10 04:28 . 2008-11-01 12:36 -------- d-----w- c:\programdata\ZoomBrowser
2010-05-07 12:52 . 2010-05-07 12:52 -------- d-----w- c:\users\Paul\AppData\Roaming\Research In Motion
2010-05-07 00:08 . 2010-02-07 05:08 -------- d-----w- c:\users\Anne512\AppData\Roaming\Facebook
2010-05-04 05:59 . 2010-06-10 19:19 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-10 19:19 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 05:55 . 2010-06-10 19:19 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 04:31 . 2010-06-10 19:19 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-10 19:19 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-04-30 15:31 . 2007-11-15 09:30 -------- d-----w- c:\program files\Roxio
2010-04-29 19:39 . 2010-03-14 10:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2010-03-14 10:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-25 12:54 . 2010-04-25 12:54 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-19 01:35 . 2010-03-13 12:16 18432 ----a-w- c:\users\Anne512\fbchathistory.dat
2007-11-15 09:26 . 2007-11-15 09:26 76 --sh--r- c:\windows\CT4CET.bin
2007-11-15 17:03 . 2007-11-15 16:53 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-02-23 18:04 1664256 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"P2kAutostart"="" [BU]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-04-18 159744]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-08-29 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-02 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-02 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-02 133912]
"Logitech Hardware Abstraction Layer"="c:\program files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2007-01-12 101136]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2008-10-24 79136]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-04-16 184320]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2007-08-30 205480]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-12 101136]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-02 2065248]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-06-25 405504]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-27 202256]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-04-02 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
c:\users\Jannah and Aaminah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\users\Anne512\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2010-3-10 1819992]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-3 703280]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-11-15 50688]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2007-7-20 1180952]
SetPoint.lnk - c:\program files\SetPoint\SetPoint.exe [2007-11-21 679936]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"FirewallOverride"=dword:00000001
"VistaSp2"=hex(b):b4,36,a3,f9,e1,c1,ca,01
R0 ntcdrdrv;ntcdrdrv;c:\windows\system32\DRIVERS\ntcdrdrv.sys [x]
R0 tclondrv;tclondrv;c:\windows\system32\DRIVERS\tclondrv.sys [x]
R2 gupdate1ca8c7b719e9220;Google Update Service (gupdate1ca8c7b719e9220);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 133104]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [2009-03-21 32408]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-03-13 216200]
S1 AvgTdiX;AVG Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-06-02 242896]
S2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-03-13 308064]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 waudit;waudit;c:\windows\ASMBB\win32\waudit.exe [2010-06-14 1056768]
S3 KHCAP;KHCap Packet Driver (KHCAP);c:\windows\system32\drivers\KHCAP.sys [2010-06-14 41216]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
Contents of the 'Scheduled Tasks' folder
2010-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 13:48]
2010-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 13:48]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://wapp.verizon.net/bookmarks/bmred ... ho_centraluInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) =
hxxp://my.netzero.net/s/search?r=minisearchIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\windows\system32\wpclsp.dll
Trusted Zone: netzero.com
Trusted Zone: netzero.net
FF - ProfilePath - c:\users\Anne512\AppData\Roaming\Mozilla\Firefox\Profiles\a143cmwe.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
hxxp://www.yahoo.com/FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\users\Anne512\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\users\Anne512\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
**************************************************************************
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(292)
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\windows\system32\STacSV.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\ASMBB\win32\wauditu.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2010-06-20 11:15:00 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-20 15:14
ComboFix2.txt 2010-06-18 14:44
Pre-Run: 101,141,016,576 bytes free
Post-Run: 100,911,886,336 bytes free
- - End Of File - - C3B22F9D600E49E2652C9D0893536446