ComboFix 09-01-21.04 - Greg Masie 2009-01-25 15:33:12.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.400 [GMT -7:00]
Running from: c:\documents and settings\Greg Masie\My Documents\Downloads\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Greg Masie\Start Menu\Programs\System Security
c:\windows\IE4 Error Log.txt
c:\windows\system32\bbfaeededfbfcddc.dll
c:\windows\system32\ntnet.drv
c:\windows\system32\sysaudio.sys
c:\windows\system32\vumer.dll
c:\windows\system32\wdmaud.sys
.
((((((((((((((((((((((((( Files Created from 2008-12-25 to 2009-01-25 )))))))))))))))))))))))))))))))
.
2009-01-25 14:46 . 2009-01-25 14:49 250 --a------ c:\windows\gmer.ini
2009-01-25 13:36 . 2009-01-25 13:36
d-------- c:\windows\LastGood.Tmp
2009-01-25 12:31 . 2009-01-25 12:31 d-------- c:\program files\Trend Micro
2009-01-21 18:46 . 2009-01-21 18:46 d-------- C:\VundoFix Backups
2009-01-21 17:58 . 2009-01-25 13:30 d-------- c:\program files\Spybot - Search & Destroy
2009-01-21 17:58 . 2009-01-25 13:30 d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-20 20:41 . 2009-01-20 20:41 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-20 20:40 . 2009-01-20 20:40 d-------- c:\program files\Java
2009-01-20 20:40 . 2009-01-20 20:40 0 --a------ c:\windows\system32\REN71.tmp
2009-01-20 20:40 . 2009-01-20 20:40 0 --a------ c:\windows\system32\REN70.tmp
2009-01-20 20:40 . 2009-01-20 20:40 0 --a------ c:\windows\system32\REN6F.tmp
2009-01-20 20:32 . 2009-01-20 20:38 d-------- c:\documents and settings\Greg Masie\.SunDownloadManager
2009-01-20 18:10 . 2009-01-25 13:24 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-20 18:10 . 2009-01-20 18:10 d-------- c:\documents and settings\Greg Masie\Application Data\Malwarebytes
2009-01-20 18:10 . 2009-01-20 18:10 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-14 18:19 . 2009-01-14 18:19 d-------- c:\windows\ie8updates
2009-01-12 20:55 . 2009-01-12 20:55 d--hs---- c:\documents and settings\Greg Masie\PrivacIE
2009-01-12 20:45 . 2009-01-12 20:47 d--h-c--- c:\windows\ie8
2009-01-12 20:13 . 2009-01-20 20:41 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-30 10:48 . 2009-01-21 18:00 d-------- c:\program files\Norton Security Scan
2008-12-29 18:35 . 2008-12-29 18:43 d-------- c:\windows\system32\Adobe
2008-12-29 12:41 . 2008-12-29 12:42 d-------- c:\program files\iTunes
2008-12-29 12:41 . 2008-12-29 12:41 d-------- c:\program files\iPod
2008-12-29 12:41 . 2008-12-29 12:42 d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-29 12:38 . 2008-12-29 12:39 d-------- c:\program files\QuickTime
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-25 22:35 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-25 20:37 --------- d-----w c:\documents and settings\Greg Masie\Application Data\OpenOffice.org2
2009-01-25 20:32 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-25 20:20 --------- d-----w c:\program files\Hewlett-Packard
2009-01-11 19:17 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-01-11 19:17 124,464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-01-11 19:17 10,635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-01-11 19:17 --------- d-----w c:\program files\Symantec
2009-01-07 03:14 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-29 23:59 --------- d-----w c:\program files\PokerStars
2008-12-29 19:41 --------- d-----w c:\program files\Common Files\Apple
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-10 18:05 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-05 00:44 --------- d-----w c:\documents and settings\Greg Masie\Application Data\Move Networks
2007-08-30 16:15 0 ----a-w c:\documents and settings\Greg Masie\Application Data\wklnhst.dat
2006-09-21 02:01 90,112 ----a-w c:\documents and settings\Greg Masie\IDHWTSS1.dll
2006-09-21 02:01 81,920 ----a-w c:\documents and settings\Greg Masie\hobjni.dll
2006-09-08 02:29 36,868 ----a-w c:\documents and settings\Greg Masie\PrtDLL.dll
2008-09-03 01:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090220080903\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Google Update"="c:\documents and settings\Greg Masie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-12-29 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-11-23 163840]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"Home Theater SchSvr"="c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2004-11-02 106496]
"WINREMOTE"="c:\program files\InterVideo\Common\Bin\WinRemote.exe" [2004-11-02 233472]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-01 53248]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-06 718704]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 172032]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 49152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-20 136600]
"AGRSMMSG"="AGRSMMSG.exe" [2004-08-24 c:\windows\AGRSMMSG.exe]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 c:\windows\system32\bthprops.cpl]
c:\documents and settings\Greg Masie\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-06-08 169472]
Windows Desktop Search.lnk - c:\program files\MSN Toolbar Suite\DS\[u]0[/u]2.05.0001.1119\en-us\bin\WindowsSearch.exe [2005-09-20 18:10:04 238080]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= wdmaud.sys
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R1 eabfiltr;EABFiltr;c:\windows\system32\drivers\eabfiltr.sys [2005-01-25 7432]
R1 eeCtrl;Symantec Eraser Control driver;c:\program files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2008-03-17 371248]
R1 SPBBCDrv;SPBBCDrv;c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2008-01-16 447024]
R1 SRTSPX;SRTSPX;c:\windows\system32\drivers\srtspx.sys [2008-01-31 43696]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;c:\windows\system32\drivers\wmiacpi.sys [2004-08-03 8832]
R3 aeaudio;aeaudio;c:\windows\system32\drivers\aeaudio.sys [2004-10-06 129280]
R3 ApfiltrService;Alps Pointing-device Filter Driver;c:\windows\system32\drivers\Apfiltr.sys [2005-01-25 105831]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-02 99376]
R3 hpqwmi;HP WMI Interface;c:\program files\HPQ\Shared\hpqwmi.exe [2005-01-25 98304]
R3 Iviaspi;IVI ASPI Shell;c:\windows\system32\drivers\iviaspi.sys [2005-05-15 10752]
R3 MxlW2k;MxlW2k;c:\windows\system32\drivers\MxlW2k.sys [2005-06-08 28256]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver;c:\windows\system32\drivers\Rtlnicxp.sys [2004-06-28 69760]
R3 sdbus;sdbus;c:\windows\system32\drivers\sdbus.sys [2004-08-04 79232]
R3 senfilt;senfilt;c:\windows\system32\drivers\senfilt.sys [2004-04-26 381056]
R3 smwdm;smwdm;c:\windows\system32\drivers\smwdm.sys [2004-09-01 259648]
R3 SRTSP;SRTSP;c:\windows\system32\drivers\srtsp.sys [2008-01-31 279088]
R3 SymIMMP;SymIMMP;c:\windows\system32\drivers\SymIM.sys [2008-02-06 31280]
R3 SYMNDIS;SYMNDIS;c:\windows\system32\drivers\symndis.sys [2008-06-13 37424]
R3 tifm21;tifm21;c:\windows\system32\drivers\tifm21.sys [2005-01-25 147840]
R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP;c:\windows\system32\drivers\w29n51.sys [2004-09-20 3210496]
R4 Apple Mobile Device;Apple Mobile Device;c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R4 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2008-02-09 238968]
R4 BthServ;Bluetooth Support Service;c:\windows\system32\svchost.exe -k bthsvcs [2004-08-04 14336]
R4 CLTNetCnService;Symantec Lic NetConnect service;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
R4 JavaQuickStarterService;Java Quick Starter;c:\program files\Java\jre6\bin\jqs.exe [2009-01-20 152984]
R4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
S0 2201ced6d30a29e038061eb6d9f15452;2201ced6d30a29e038061eb6d9f15452;c:\windows\system32\2201ced6d30a29e038061eb6d9f15452.sys --> c:\windows\system32\2201ced6d30a29e038061eb6d9f15452.sys [?]
S1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA;c:\windows\system32\drivers\tosrfcom.sys [2005-08-01 64896]
S3 BthEnum;Bluetooth Enumerator Service;c:\windows\system32\drivers\bthenum.sys [2006-08-06 17024]
S3 BTHPORT;Bluetooth Port Driver;c:\windows\system32\drivers\bthport.sys [2006-08-06 272128]
S3 BTHUSB;Bluetooth Radio USB Driver;c:\windows\system32\drivers\bthusb.sys [2006-08-06 18944]
S3 BVRPMPR5;BVRPMPR5 NDIS Protocol Driver;\??\d:\instal~e\Core\BVRPMPR5.SYS --> d:\instal~e\Core\BVRPMPR5.SYS [?]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]
S3 comHost;COM Host;c:\program files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-08-22 55640]
S3 eabusb;eabusb;c:\windows\system32\drivers\EabUsb.sys [2005-01-25 5220]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 MidiSyn;MidiSyn;c:\windows\system32\drivers\MidiSyn.sys --> c:\windows\system32\drivers\MidiSyn.sys [?]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;c:\windows\system32\nsndis5.sys [2004-03-23 17280]
S3 odserv;Microsoft Office Diagnostics Service;c:\program files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 Rasirda;WAN Miniport (IrDA);c:\windows\system32\drivers\rasirda.sys [2001-08-17 19584]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI);c:\windows\system32\drivers\rfcomm.sys [2006-08-06 59136]
S3 SMCIRDA;SMC IrCC Miniport Device Driver;c:\windows\system32\drivers\smcirda.sys [2001-08-17 35913]
S3 SRTSPL;SRTSPL;c:\windows\system32\drivers\srtspl.sys [2008-01-31 317616]
S3 SymIM;Symantec Network Security Intermediate Filter Service;c:\windows\system32\drivers\SymIM.sys [2008-02-06 31280]
S3 toshidpt;TOSHIBA Bluetooth HID port driver;c:\windows\system32\drivers\toshidpt.sys [2005-07-11 3712]
S3 tosporte;Bluetooth Port Driver from Toshiba;c:\windows\system32\drivers\tosporte.sys [2005-11-24 47104]
S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA;c:\windows\system32\drivers\tosrfbd.sys [2005-11-22 108800]
S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA;c:\windows\system32\drivers\tosrfbnp.sys [2005-09-15 36480]
S3 Tosrfhid;Bluetooth RFHID from TOSHIBA;c:\windows\system32\drivers\tosrfhid.sys [2005-12-01 62848]
S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA;c:\windows\system32\drivers\tosrfnds.sys [2005-01-06 18612]
S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA;c:\windows\system32\drivers\tosrfsnd.sys [2005-11-11 52864]
S3 Tosrfusb;Bluetooth USB Controller;c:\windows\system32\drivers\tosrfusb.sys [2005-11-15 36736]
S3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl.sys [2008-07-24 32000]
S3 usbbus;LGE CDMA Composite USB Device;c:\windows\system32\drivers\lgusbbus.sys [2008-08-12 12672]
S3 UsbDiag;LGE CDMA USB Serial Port;c:\windows\system32\drivers\lgusbdiag.sys [2008-08-12 21248]
S3 USBModem;LGE CDMA USB Modem;c:\windows\system32\drivers\lgusbmodem.sys [2008-08-12 22912]
S3 WpdUsb;WpdUsb;c:\windows\system32\drivers\wpdusb.sys [2006-10-18 38528]
S4 MCSTRM;MCSTRM; [x]
S4 pciinfo;HP Pci Information;\??\c:\docume~1\GREGMA~1\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys --> c:\docume~1\GREGMA~1\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys [?]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - COMHOST
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5aa3dbcb-5587-11dc-9aef-0012f035d7d0}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
2008-10-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2009-01-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4175463211-170456199-81732586-1006.job
- c:\documents and settings\Greg Masie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-29 17:01]
2009-01-20 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Greg Masie.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 07:05]
2009-01-22 c:\windows\Tasks\Norton Security Scan for Greg Masie.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]
.
- - - - ORPHANS REMOVED - - - -
BHO-{2502BBD0-D73B-11DD-B4EC-CEBF56D89593} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKLM-Run-ChangeResolution - c:\hp\bin\ChangeResolution.exe
HKLM-Run-1640814211 - c:\documents and settings\All Users\Application Data\1260062919\1640814211.exe
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &MSN Search - c:\program files\MSN Toolbar Suite\TB\[u]0[/u]2.05.0001.1119\en-us\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-25 15:38:27
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????j?P??|?????? ???B???????????????B? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(1612)
c:\program files\Logitech\MouseWare\System\LgWndHk.dll
c:\windows\system32\ieframe.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Apoint2K\ApntEx.exe
c:\windows\system32\rundll32.exe
c:\program files\Logitech\MouseWare\system\EM_EXEC.EXE
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
c:\program files\MSN Toolbar Suite\DS\[u]0[/u]2.05.0001.1119\en-us\bin\WindowsSearchIndexer.exe
c:\program files\MSN Toolbar Suite\DS\[u]0[/u]2.05.0001.1119\en-us\bin\WindowsSearchFilter.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2009-01-25 15:45:57 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-25 22:45:43
Pre-Run: 66,915,495,936 bytes free
Post-Run: 67,004,018,688 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
262 --- E O F --- 2009-01-15 01:20:42