ComboFix 08-07-24.1 - Kelly 2008-07-24 18:20:22.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.581 [GMT -5:00] Running from: C:\Documents and Settings\Kelly\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-06-24 to 2008-07-24 ))))))))))))))))))))))))))))))) . 2008-07-22 20:51 . 2008-07-22 20:51 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-07-19 14:37 . 2008-07-18 19:15 36,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-07-17 21:50 . 2008-07-17 21:51 d-------- C:\Program Files\FlySim 2008-07-15 09:08 . 2008-07-15 09:08 d-------- C:\Program Files\Kaspersky Lab 2008-07-15 09:08 . 2008-07-24 17:44 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-07-15 09:08 . 2008-07-24 18:22 8,899,104 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-15 09:08 . 2008-07-24 17:41 119,756 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-15 09:08 . 2008-07-24 18:22 102,176 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-07-15 09:08 . 2008-07-24 08:58 96,559 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-07-15 09:08 . 2008-07-24 08:58 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-07-15 09:08 . 2008-07-24 17:41 10,340 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-07-15 09:06 . 2008-07-15 09:06 d-------- C:\kav 2008-07-13 15:00 . 2008-07-13 15:00 313 --a------ C:\avexport.bat 2008-07-11 10:24 . 2008-07-11 10:24 d-------- C:\Documents and Settings\Kelly\Application Data\abelhadigital.com 2008-07-11 10:24 . 2008-07-11 10:24 d-------- C:\Documents and Settings\All Users\Application Data\abelhadigital.com 2008-07-11 10:21 . 2008-07-13 15:00 6,735,942 --a------ C:\backup.reg 2008-07-09 19:58 . 2008-07-24 17:13 19,286 --a------ C:\cleanup.exe 2008-07-09 19:58 . 2008-07-24 17:13 574 --a------ C:\cleanup.bat 2008-07-09 18:45 . 2008-07-09 18:45 d-------- C:\Program Files\Tall Emu 2008-07-09 18:45 . 2008-07-24 18:16 d-------- C:\Documents and Settings\Kelly\Application Data\OnlineArmor 2008-07-09 18:45 . 2008-07-24 18:08 d-------- C:\Documents and Settings\All Users\Application Data\OnlineArmor 2008-07-09 18:45 . 2008-07-09 19:05 75,776 --a------ C:\WINDOWS\system32\drivers\OADriver.sys 2008-07-09 18:45 . 2008-04-17 05:22 28,872 --a------ C:\WINDOWS\system32\drivers\oanet.sys 2008-07-09 18:45 . 2008-07-09 19:05 25,600 --a------ C:\WINDOWS\system32\drivers\OAmon.sys 2008-07-09 09:55 . 2008-06-20 06:51 361,600 --------- C:\WINDOWS\system32\drivers\tcpip.sys 2008-07-09 09:55 . 2008-06-20 06:08 225,856 --------- C:\WINDOWS\system32\drivers\tcpip6.sys 2008-07-09 09:55 . 2008-06-20 06:40 138,496 --------- C:\WINDOWS\system32\drivers\afd.sys 2008-07-04 14:02 . 2008-07-04 14:02 d-------- C:\Program Files\HostsMan 2008-07-03 22:34 . 2008-07-03 22:34 d-------- C:\Program Files\HD Tune 2008-07-01 01:04 . 2008-07-01 01:04 d-------- C:\WINDOWS\system32\scripting 2008-07-01 01:04 . 2008-07-01 01:04 d-------- C:\WINDOWS\system32\en 2008-07-01 01:04 . 2008-07-01 01:04 d-------- C:\WINDOWS\system32\bits 2008-07-01 01:04 . 2008-07-01 01:04 d-------- C:\WINDOWS\l2schemas 2008-07-01 01:02 . 2008-07-01 01:04 d-------- C:\WINDOWS\ServicePackFiles 2008-07-01 00:48 . 2008-04-13 19:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll 2008-06-28 14:40 . 2008-06-28 14:40 d-------- C:\Program Files\ESET 2008-06-28 14:40 . 2008-06-28 14:40 d-------- C:\Documents and Settings\All Users\Application Data\ESET 2008-06-28 11:59 . 2008-06-28 11:59 39,424 --a------ C:\WINDOWS\zipinst.exe 2008-06-27 23:32 . 2008-06-27 23:32 d-------- C:\Program Files\Common Files\Java 2008-06-27 23:32 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-24 23:06 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-24 03:19 --------- d-----w C:\Program Files\SpywareGuard 2008-07-24 03:19 --------- d-----w C:\Program Files\SpywareBlaster 2008-07-21 15:14 --------- d-----w C:\Program Files\Lavasoft 2008-07-21 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-19 19:38 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware 2008-07-19 00:15 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys 2008-07-16 10:29 118,784 ----a-w C:\WINDOWS\SeaMonkeyUninstall.exe 2008-07-16 10:29 118,784 ----a-w C:\WINDOWS\GREUninstall.exe 2008-07-15 14:16 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys 2008-07-14 16:08 --------- d-----w C:\Program Files\Java 2008-07-10 02:00 --------- d-----w C:\Program Files\HP 2008-07-10 01:52 --------- d-----w C:\Program Files\kontiki 2008-07-10 01:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kontiki 2008-07-04 15:59 --------- d-----w C:\Program Files\SpeedFan 2008-07-02 16:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-02 16:05 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-29 23:15 --------- d-----w C:\Program Files\Napster 2008-06-29 16:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\RunOff 2008-06-29 15:55 --------- d-----w C:\Program Files\MSECache 2008-06-28 22:03 --------- d-----w C:\Program Files\Yahoo! 2008-06-28 22:03 --------- d-----w C:\Program Files\SureThing 2008-06-28 22:03 --------- d-----w C:\Program Files\QuickTime 2008-06-28 22:03 --------- d-----w C:\Program Files\OpenTalk 2008-06-28 22:02 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-28 22:02 --------- d-----w C:\Program Files\Logitech 2008-06-28 22:02 --------- d-----w C:\Program Files\Hewlett-Packard 2008-06-28 22:02 --------- d-----w C:\Program Files\GemMaster 2008-06-28 22:02 --------- d-----w C:\Program Files\Common Files\aolshare 2008-06-28 22:02 --------- d-----w C:\Program Files\Common Files\AOL 2008-06-28 22:02 --------- d-----w C:\Program Files\CD to MP3 Freeware 2008-06-28 22:02 --------- d-----w C:\Program Files\BitComet 2008-06-28 22:02 --------- d-----w C:\Program Files\Audible 2008-06-28 19:34 --------- d-----w C:\Documents and Settings\Kelly\Application Data\SUPERAntiSpyware.com 2008-06-28 19:24 --------- d-----w C:\Program Files\DrWeb 2008-06-28 17:09 --------- d-----w C:\Program Files\WinUpdatesList 2008-06-28 05:19 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-06-24 23:57 --------- d-----w C:\Program Files\Shockwave.com 2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:46 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:46 147,968 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-16 20:01 2,869,536 ----a-w C:\spywareblastersetup41.exe 2008-06-16 02:31 --------- d-----w C:\Program Files\SUPERAntiSpyware 2008-06-16 02:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-12 20:36 --------- d-----w C:\Program Files\iTunes 2008-06-12 20:36 --------- d-----w C:\Documents and Settings\Kelly\Application Data\Apple Computer 2008-06-12 20:35 --------- d-----w C:\Program Files\iPod 2008-06-12 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-06-12 20:29 --------- d-----w C:\Program Files\Apple Software Update 2008-06-12 20:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2008-06-06 13:57 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-06 13:55 23,454,528 ----a-w C:\AdbeRdr812_en_US.exe 2008-06-06 04:32 --------- d-----w C:\Documents and Settings\Kelly\Application Data\Malwarebytes 2008-06-06 04:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-06 04:30 1,756,760 ----a-w C:\mbam-setup.exe 2008-06-05 00:37 --------- d-----w C:\Program Files\Trend Micro 2008-06-05 00:25 --------- d-----w C:\Program Files\7-Zip 2008-06-04 19:37 142,096 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys 2008-05-29 04:22 --------- d-----w C:\Documents and Settings\Kelly\Application Data\AdobeUM 2008-05-28 19:39 --------- d-----w C:\Program Files\MTV Virtual World 2008-05-16 16:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2008-05-09 10:53 90,112 ----a-w C:\WINDOWS\system32\wshext.dll 2008-05-09 10:53 90,112 ------w C:\WINDOWS\system32\dllcache\wshext.dll 2008-05-09 10:53 512,000 ------w C:\WINDOWS\system32\dllcache\jscript.dll 2008-05-09 10:53 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll 2008-05-09 10:53 430,080 ------w C:\WINDOWS\system32\dllcache\vbscript.dll 2008-05-09 10:53 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll 2008-05-09 10:53 180,224 ------w C:\WINDOWS\system32\dllcache\scrobj.dll 2008-05-09 10:53 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll 2008-05-09 10:53 172,032 ------w C:\WINDOWS\system32\dllcache\scrrun.dll 2008-05-08 14:02 203,136 ------w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe 2008-05-08 11:24 155,648 ------w C:\WINDOWS\system32\dllcache\wscript.exe 2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe 2008-05-07 09:07 135,168 ------w C:\WINDOWS\system32\dllcache\cscript.exe 2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-24 03:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-12-17 15:57 1,646 ----a-w C:\Documents and Settings\Kayla\Application Data\wklnhst.dat 2007-10-10 00:49 251 ----a-w C:\Program Files\wt3d.ini 2006-11-28 05:00 22 -csha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232] "HostsMan"="C:\Program Files\HostsMan\hm.exe" [2008-06-16 04:19 2847232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SmartDefrag"="C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2006-11-20 23:59 3920384] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-09 17:50 7311360] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "OnlineArmor GUI"="C:\Program Files\Tall Emu\Online Armor\oaui.exe" [2008-04-17 05:22 5606464] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-13 19:12 53760 C:\WINDOWS\system32\narrator.exe] C:\Documents and Settings\Kayla\Start Menu\Programs\Startup\ PinMcLnk.lnk - C:\hp\bin\cloaker.exe [2006-07-31 20:44:35 27136] C:\Documents and Settings\Kelly\Start Menu\Programs\Startup\ SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.SP54"= SP5X_32.DLL [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk] backup=C:\WINDOWS\pss\Updates From HP.lnkCommon Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe] --------- 2006-11-23 17:12 851968 C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp] --a------ 2006-02-16 00:34 249856 C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx] --a------ 2006-11-28 12:47 1040832 C:\Program Files\kontiki\KHost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2006-05-09 17:50 7311360 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PwrUpTweakMe] --a------ 2005-09-12 11:36 45056 C:\WINDOWS\system32\puxptwks.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] --a------ 2005-07-23 00:14 237568 C:\WINDOWS\SMINST\Recguard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-03-11 19:47 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP] --------- 2005-08-03 01:19 77312 C:\WINDOWS\arpwrmsg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Symantec Core LC"=2 (0x2) "SPBBCSvc"=2 (0x2) "SNDSrvc"=2 (0x2) "SAVScan"=3 (0x3) "NSCService"=3 (0x3) "ccSetMgr"=2 (0x2) "ccProxy"=2 (0x2) "ccISPwdSvc"=3 (0x3) "ccEvtMgr"=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "C:\\Program Files\\America Online 9.0\\waol.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"= "C:\\Program Files\\Common Files\\AOL\\1164757353\\EE\\AOLServiceHost.exe"= "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"= "C:\\Program Files\\America Online 9.0a\\waol.exe"= "C:\\Program Files\\Paltalk Messenger\\paltalk.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"= "C:\\Program Files\\kontiki\\KService.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "20566:TCP"= 20566:TCP:BitComet 20566 TCP "20566:UDP"= 20566:UDP:BitComet 20566 UDP R1 OADevice;OADriver;C:\WINDOWS\system32\drivers\OADriver.sys [2008-07-09 19:05] R1 OAmon;OAmon;C:\WINDOWS\system32\drivers\OAmon.sys [2008-07-09 19:05] R1 OAnet;OAnet;C:\WINDOWS\system32\drivers\OAnet.sys [2008-04-17 05:22] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28] R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 13:47] S2 SvcOnlineArmor;Online Armor;C:\Program Files\Tall Emu\Online Armor\oasrv.exe [2008-04-17 05:22] S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\20.tmp [] S4 OYKNVASYNG;OYKNVASYNG;C:\DOCUME~1\Kelly\LOCALS~1\Temp\OYKNVASYNG.exe [] *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-07-18 20:58:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-07-24 22:43:16 C:\WINDOWS\Tasks\SmartDefrag.job" - C:\Program Files\IObit\IObit SmartDefrag\schedule.exeA . - - - - ORPHANS REMOVED - - - - HKCU-Run-updateMgr - C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file) . ------- Supplementary Scan ------- . R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore R1 -: HKCU-Internet Settings,ProxyOverride = 127.0.0.1 O8 -: &AOL Toolbar search - C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 -: &D&ownload &with BitComet O8 -: &D&ownload all video with BitComet O8 -: &D&ownload all with BitComet O8 -: &WordWeb... - C:\WINDOWS\system32\wweb32.dll/lookup.html O8 -: Download with Star Downloader O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd O16 -: {127CE7BA-AD89-4108-A913-C52EFC037C36} - hxxp://kdx.omn.org/securedelivery/omn/PlayerSupport.cab C:\WINDOWS\Downloaded Program Files\PlayerSupport.inf - C:\WINDOWS\Downloaded Program Files\PlayerSupport.osd O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab O16 -: {2776DDE9-D4B2-4BF7-9F98-ADC1A1B80AF5} - hxxp://kdx.omn.org/securedelivery/omn/MediaPublisher.cab ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-24 18:22:14 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\mchInjDrv] "ImagePath"="\??\C:\WINDOWS\TEMP\mc21.tmp" [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MEMSWEEP2] "ImagePath"="\??\C:\WINDOWS\system32\20.tmp" . Completion time: 2008-07-24 18:24:03 ComboFix-quarantined-files.txt 2008-07-24 23:23:26 Pre-Run: 193,253,064,704 bytes free Post-Run: 193,280,118,784 bytes free 284 --- E O F --- 2008-07-09 18:55:03