Tim - 06-11-26 8:49:55.21 Service Pack 2
ComboFix 06.11.26 - Running from: "C:\hjt"
((((((((((((((((((((((((((((((( Files Created from 2006-10-26 to 2006-11-26 ))))))))))))))))))))))))))))))))))
2006-11-25 11:04
d-------- C:\!KillBox
2006-11-25 09:35 d-------- C:\hjt
2006-11-25 08:55 d-------- C:\VundoFix Backups
2006-11-18 03:06 d-------- C:\Program Files\MSXML 4.0
2006-11-18 03:05 d--hs---- C:\Config.Msi
2006-11-18 03:05 d-------- C:\8badbca53c55aa2d362b4bca
2006-11-17 13:32 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2006-11-17 13:32 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2006-11-17 13:32 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2006-11-13 06:45 126,996 --a------ C:\WINDOWS\system32\rjmjsnsk.dll
2006-11-12 21:50 d-------- C:\WINDOWS\system32\appmgmt
2006-11-04 14:14 1,245,696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-03 06:59 49,428 --a------ C:\WINDOWS\system32\sembokgt.dll
2006-11-02 20:45 d-------- C:\Documents and Settings\Tim\Application Data\Motive
2006-11-01 20:38 49,428 --a------ C:\WINDOWS\system32\mwagnbtt.dll
2006-10-29 13:09 684,032 --a------ C:\WINDOWS\system32\libeay32.dll
2006-10-29 13:09 21,568 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2006-10-29 13:09 21,056 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2006-10-29 13:09 20,544 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys
2006-10-29 13:09 155,648 --a------ C:\WINDOWS\system32\ssleay32.dll
2006-10-29 13:09 128,064 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2006-10-29 13:09 d-------- C:\Program Files\Webroot
2006-10-29 13:00 d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2006-10-29 12:57 d-------- C:\Documents and Settings\Tim\Application Data\Webroot
2006-10-29 09:20 d-------- C:\WINDOWS\CSC
2006-10-26 20:59 49,428 --a------ C:\WINDOWS\system32\feyjhnru.dll
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-11-26 08:37 6229 --ahs---- C:\Documents and Settings\Tim\Application Data\889A3C138ABD4EFF9D4F3832B14D7682.sta
2006-11-26 08:37 43932 --ahs---- C:\Documents and Settings\Tim\Application Data\889A3C138ABD4EFF9D4F3832B14D7682.rul
2006-11-22 16:25 -------- d-------- C:\Documents and Settings\Tim\Application Data\Macromedia
2006-11-18 03:02 -------- d-------- C:\Program Files\Internet Explorer
2006-11-17 13:33 -------- d-------- C:\Documents and Settings\Tim\Application Data\Adobe
2006-11-13 06:42 -------- d-------- C:\Program Files\Pure Networks
2006-11-13 06:42 -------- d-------- C:\Program Files\Common Files
2006-11-12 21:58 -------- d-------- C:\Program Files\Common Files\AOL
2006-11-12 21:56 -------- d-------- C:\Documents and Settings\Tim\Application Data\AOL
2006-11-12 21:49 -------- d-------- C:\Program Files\Privacy Crusader Full
2006-10-29 16:09 -------- d-------- C:\Program Files\em
2006-10-29 12:58 920 --a------ C:\WINDOWS\system32\winpfg32.sys
2006-10-24 05:07 122900 --a------ C:\WINDOWS\system32\aaejcivy.dll
2006-10-23 19:55 122900 --a------ C:\WINDOWS\system32\ghwlxqek.dll
2006-10-23 18:26 122900 --a------ C:\WINDOWS\system32\tjryoewh.dll
2006-10-22 08:35 12056 --a------ C:\PPCleanDeleteAtReboot.bat
2006-10-21 00:49 122900 --a------ C:\WINDOWS\system32\dmsqvmyb.dll
2006-10-19 19:52 172132 --a------ C:\WINDOWS\system32\qwinlpem.exe
2006-10-14 06:59 -------- d-------- C:\Program Files\Google
2006-10-13 07:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 07:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 07:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-13 05:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys
2006-10-12 18:35 78848 --a------ C:\WINDOWS\ms0317792982006.exe
2006-10-12 18:35 69165 --a------ C:\pp4ico.exe
2006-10-12 09:14 78848 --a------ C:\WINDOWS\system32\nsq11.dll
2006-10-12 09:14 78848 --a------ C:\WINDOWS\system32\nsj59.dll
2006-10-10 19:39 78848 --a------ C:\WINDOWS\system32\nst38.dll
2006-10-02 18:13 -------- d-------- C:\Program Files\Scholastic
2006-10-02 11:15 629264 --a------ C:\WINDOWS\system32\drivers\VetEFile.sys
2006-10-02 11:15 108592 --a------ C:\WINDOWS\system32\drivers\VetEBoot.sys
2006-09-24 13:38 128 --a------ C:\Documents and Settings\Tim\Application Data\wklnhst.dat
2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-05 23:04 74864 --a------ C:\WINDOWS\system32\VetRedir.dll
2006-09-05 23:04 115824 --a------ C:\WINDOWS\UnVet32.exe
2006-09-05 23:04 111728 --a------ C:\WINDOWS\AVShlExt.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"TOSCDSPD"="\"C:\\Program Files\\TOSHIBA\\TOSCDSPD\\toscdspd.exe\""
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"TFncKy"="TFncKy.exe"
"TDispVol"="TDispVol.exe"
"MCUpdateExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcupdate.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"THotkey"="\"C:\\Program Files\\Toshiba\\Toshiba Applet\\thotkey.exe\""
"SynTPLpr"="\"C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe\""
"SynTPEnh"="\"C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe\""
"LtMoh"="\"C:\\Program Files\\ltmoh\\Ltmoh.exe\""
"AGRSMMSG"="AGRSMMSG.exe"
"NDSTray.exe"="NDSTray.exe"
"Tvs"="\"C:\\Program Files\\Toshiba\\Tvs\\TvsTray.exe\""
"TPSMain"="TPSMain.exe"
"PadTouch"="C:\\Program Files\\TOSHIBA\\Touch and Launch\\PadExe.exe"
"SmoothView"="\"C:\\Program Files\\TOSHIBA\\TOSHIBA Zooming Utility\\SmoothView.exe\""
"dla"="C:\\WINDOWS\\system32\\dla\\DLACTRLW.exe"
"Pinger"="\"c:\\toshiba\\ivp\\ism\\pinger.exe\" /run"
"IntelZeroConfig"="\"C:\\Program Files\\Intel\\Wireless\\bin\\ZCfgSvc.exe\""
"IntelWireless"="\"C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe\" /tf Intel PROSet/Wireless"
"Motive SmartBridge"="C:\\PROGRA~1\\SBCSEL~1\\SMARTB~1\\MotiveSB.exe"
"CFSServ.exe"="CFSServ.exe -NoClient"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"YBrowser"="C:\\PROGRA~1\\Yahoo!\\browser\\ybrwicon.exe"
"BJCFD"="\"C:\\Program Files\\BroadJump\\Client Foundation\\CFD.exe\""
"IPInSightLAN 02"="\"C:\\Program Files\\Visual Networks\\Visual IP InSight\\SBC\\IPClient.exe\" -l"
"IPInSightMonitor 02"="\"C:\\Program Files\\Visual Networks\\Visual IP InSight\\SBC\\IPMon32.exe\""
"CaAvTray"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVTray.exe\""
"CAVRID"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVRID.exe\""
"YOP"="\"C:\\PROGRA~1\\Yahoo!\\YOP\\yop.exe\" /autostart"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"PrivacyCrusaderFull"="C:\\Program Files\\Privacy Crusader Full\\PrivacyCrusaderFull"
"SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\javaodbc
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService
~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
backup-20061125-105825-791
O4 - HKLM\..\Run: [mmcrat06] C:\WINDOWS\mmputt.exe
backup-20061125-105825-219
O4 - HKLM\..\Run: [{D7-7F-F9-93-ZN}] C:\windows\system32\okdsregn.exe ELT001
Completion time: 06-11-26 8:55:19.70
C:\ComboFix.txt ... 06-11-26 08:55