As instructed, I ran the ComboFix program and the following log was produced.
ComboFix 08-07-29.1 - Owner 2008-07-31 12:45:56.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1621 [GMT -10:00]
Running from: C:\Documents and Settings\Owner\Desktop\Incoming\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\install.exe
C:\WINDOWS\system32\CMMGR32.EXE
----- BITS: Possible infected sites -----
http://www.dj |Cv @J...C7-927721D56EBB.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 )))))))))))))))))))))))))))))))
.
2008-07-30 18:16 . 2008-07-30 18:16 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-30 18:16 . 2008-07-30 18:16 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-29 21:25 . 2008-07-29 21:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\NASA
2008-07-29 21:24 . 2008-07-29 21:24 <DIR> d-------- C:\Program Files\NASA
2008-07-29 07:07 . 2008-07-29 07:07 <DIR> d-------- C:\Program Files\Morgan
2008-07-29 07:07 . 2008-07-29 07:08 <DIR> d-------- C:\Program Files\abcAVI
2008-07-29 07:07 . 2002-11-15 02:11 77,824 --a------ C:\WINDOWS\system32\MMSwitch.dll
2008-07-29 07:07 . 2002-11-18 05:15 62,464 --a------ C:\WINDOWS\system32\MMSwitch.ax
2008-07-29 07:07 . 2002-11-18 05:02 40,960 --a------ C:\WINDOWS\system32\MMAVILNG.exe
2008-07-29 06:57 . 2008-07-29 06:57 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-24 18:27 . 2008-07-24 18:25 4,623 --a------ C:\WINDOWS\_detmp.1
2008-07-24 18:23 . 2008-07-24 18:27 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo
2008-07-23 21:43 . 2008-07-23 21:43 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Windows Search
2008-07-23 17:01 . 2008-07-23 17:01 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
2008-07-23 17:01 . 2008-07-23 21:47 <DIR> d-------- C:\Program Files\Windows Desktop Search
2008-07-23 16:13 . 2008-07-23 16:13 <DIR> d-------- C:\Program Files\CCleaner
2008-07-23 15:45 . 2004-08-04 09:00 17 --a------ C:\WINDOWS\system32\WINSPOOL.WIN
2008-07-23 15:40 . 2008-07-23 15:40 796,672 --a------ C:\WINDOWS\GPInstall.exe
2008-07-21 20:49 . 2008-07-21 20:49 <DIR> d-------- C:\Program Files\Elaborate Bytes
2008-07-19 15:46 . 2008-07-19 15:46 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2008-07-19 15:44 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-07-19 15:43 . 2008-07-19 15:43 <DIR> d-------- C:\Program Files\Zone Labs
2008-07-18 22:30 . 2008-07-30 10:00 <DIR> d--h----- C:\$AVG8.VAULT$
2008-07-18 19:54 . 2008-07-30 09:56 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-18 19:54 . 2008-07-18 19:54 <DIR> d-------- C:\Program Files\AVG
2008-07-18 19:54 . 2008-07-23 17:03 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\AVGTOOLBAR
2008-07-18 19:54 . 2008-07-18 19:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-18 19:54 . 2008-07-18 19:54 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-18 19:54 . 2008-07-18 19:54 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-18 19:54 . 2008-07-18 19:54 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-18 11:41 . 2008-07-18 11:41 <DIR> d-------- C:\Program Files\ActiveX Control Pad
2008-07-18 11:41 . 2008-07-18 11:41 1,123,600 --a------ C:\WINDOWS\system32\FM20.DLL
2008-07-18 11:41 . 2008-07-18 11:41 169,984 --a------ C:\WINDOWS\system32\P2D.DLL
2008-07-18 11:41 . 2008-07-18 11:41 161,552 --a------ C:\WINDOWS\system32\ASYCPICT.DLL
2008-07-18 11:41 . 2008-07-18 11:41 127,488 --a------ C:\WINDOWS\system32\ISCTRLS.OCX
2008-07-18 11:41 . 2008-07-18 11:41 79,872 --a------ C:\WINDOWS\system32\MSNAUDIO.ACM
2008-07-18 11:41 . 2008-07-18 11:41 57,344 --a------ C:\WINDOWS\system32\COMMTB32.DLL
2008-07-18 11:41 . 2008-07-18 11:41 25,872 --a------ C:\WINDOWS\system32\FM20ENU.DLL
2008-07-18 11:36 . 2008-07-18 11:37 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\ErrorSmart
2008-07-17 23:07 . 2008-07-17 23:07 <DIR> d-------- C:\Program Files\DivX
2008-07-17 23:07 . 2008-07-17 23:07 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\DivX
2008-07-17 20:51 . 2008-07-17 20:51 <DIR> d-------- C:\Program Files\Universal Interactive
2008-07-14 22:15 . 2008-07-21 21:00 24 ---hs---- C:\WINDOWS\S5E5652A5.tmp
2008-07-14 21:43 . 2008-07-14 21:43 512 --a------ C:\ScanSectorLog.dat
2008-07-13 18:36 . 2008-07-31 12:53 12,268,064 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-13 18:36 . 2008-07-30 23:51 167,576 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-13 18:36 . 2008-07-18 19:41 83,744 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-13 18:36 . 2008-07-18 19:41 9,968 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-12 20:51 . 2008-07-12 20:56 <DIR> d-------- C:\WINDOWS\Logs
2008-07-12 20:33 . 2008-06-13 03:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-07-12 20:33 . 2008-06-13 03:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-11 19:55 . 2008-07-11 20:05 <DIR> d-------- C:\Program Files\Return to Castle Wolfenstein
2008-07-11 19:50 . 2008-07-11 19:56 810 --a------ C:\WINDOWS\Rtcw.INI
2008-07-11 16:47 . 2008-07-11 17:08 896 --a------ C:\WINDOWS\STBC.ini
2008-07-08 23:40 . 2008-07-08 23:40 22,328 --a------ C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
2008-07-08 23:39 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-07-08 23:39 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-07-08 23:39 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-07-08 23:29 . 2008-07-16 18:55 <DIR> d-------- C:\Program Files\Electronic Arts
2008-07-08 17:35 . 2008-07-08 17:35 <DIR> d-------- C:\WINDOWS\nvidia icons
2008-07-08 17:35 . 2008-07-08 17:37 <DIR> d-------- C:\WINDOWS\NV36283912.TMP
2008-07-08 17:35 . 2008-05-02 22:46 182,347 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-07-08 17:34 . 2008-07-08 17:34 <DIR> d-------- C:\NVIDIA
2008-07-08 17:31 . 2008-07-12 20:10 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-07-08 17:31 . 2008-07-12 20:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SystemRequirementsLab
2008-07-08 17:21 . 2008-07-08 17:37 <DIR> d-------- C:\WINDOWS\nview
2008-07-08 17:21 . 2008-05-02 22:46 442,368 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-07-08 17:21 . 2008-07-31 12:30 167,179 --a------ C:\WINDOWS\system32\nvapps.xml
2008-07-08 17:21 . 2008-05-02 22:46 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-07-08 17:09 . 2008-07-08 17:09 10 --a------ C:\WINDOWS\WININIT.INI
2008-07-08 09:27 . 2008-07-08 09:27 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-07-04 01:43 . 2008-07-04 01:43 126,976 --a------ C:\WINDOWS\system32\UAService7.exe
2008-07-01 20:55 . 2008-07-01 20:55 <DIR> d-------- C:\Program Files\PCFriendly
2008-06-25 20:44 . 2008-06-25 20:44 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Petroglyph
2008-06-24 20:52 . 2008-06-24 20:52 <DIR> d-------- C:\Program Files\Atari
2008-06-24 00:44 . 2008-06-24 00:47 991 --a------ C:\WINDOWS\EFXP.ini
2008-06-24 00:40 . 2008-06-24 00:40 <DIR> d-------- C:\Program Files\Raven
2008-06-24 00:39 . 2008-06-27 23:43 1,070 --a------ C:\WINDOWS\EF.ini
2008-06-23 23:03 . 2008-07-14 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-06-23 22:43 . 2008-07-14 22:15 <DIR> d-------- C:\Program Files\SlySoft
2008-06-23 22:43 . 2008-05-20 11:43 37,312 --a------ C:\WINDOWS\system32\drivers\maplom.sys
2008-06-23 22:43 . 2008-05-20 11:43 36,288 --a------ C:\WINDOWS\system32\drivers\maploml.sys
2008-06-23 17:28 . 2008-07-11 16:58 <DIR> d-------- C:\Program Files\Activision
2008-06-23 15:17 . 1996-01-09 10:38 283,648 --a------ C:\WINDOWS\uninst.exe
2008-06-23 00:43 . 2008-06-23 22:44 27 --a------ C:\WINDOWS\system32\mcheck.mhf
2008-06-22 19:46 . 2008-06-22 19:46 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\ATI
2008-06-22 19:42 . 2008-06-22 19:43 <DIR> dr------- C:\My Documents
2008-06-21 22:42 . 2008-07-10 00:13 <DIR> d-------- C:\Program Files\LucasArts
2008-06-20 11:43 . 2008-06-20 11:43 61,200 --a------ C:\WINDOWS\system32\x264vfw-uninstall.exe
2008-06-20 10:14 . 2008-06-20 10:14 754 --a------ C:\WINDOWS\WORDPAD.INI
2008-06-20 10:13 . 2008-06-20 10:13 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Template
2008-06-20 10:12 . 2008-06-20 10:13 168 --a------ C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2008-06-19 18:40 . 2008-06-19 18:40 351,744 --a------ C:\WINDOWS\system32\avisynth.dll
2008-06-19 18:10 . 2008-06-19 18:10 <DIR> d-------- C:\Program Files\Red Kawa
2008-06-19 17:12 . 2008-06-19 17:12 <DIR> d-------- C:\Program Files\PQDVD
2008-06-18 11:22 . 2008-06-18 11:22 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-06-18 10:37 . 2008-06-18 10:37 2,045,459 --a------ C:\WINDOWS\system32\x264vfw.dll
2008-06-18 07:52 . 2008-06-18 07:52 161,096 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-06-17 21:26 . 2008-06-17 21:26 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-06-17 21:26 . 2008-06-17 21:26 681 --a------ C:\WINDOWS\mozver.dat
2008-06-13 09:16 . 2008-06-13 09:16 <DIR> dr-h----- C:\Documents and Settings\Owner\Application Data\SecuROM
2008-06-13 09:14 . 2008-07-09 00:11 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-06-13 09:06 . 2008-06-13 09:06 <DIR> d-------- C:\Program Files\Sierra Entertainment
2008-06-11 18:01 . 2008-06-11 18:01 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\CyberLink
2008-06-10 20:21 . 2008-06-10 20:21 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\ATI
2008-06-10 14:07 . 2008-06-10 14:07 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-06-10 14:07 . 2008-06-10 14:07 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2008-06-10 14:07 . 2008-06-10 14:07 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2008-06-10 14:04 . 2008-06-10 14:04 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-06-10 14:04 . 2008-06-10 14:04 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-06-10 00:43 . 2008-06-10 00:43 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Thinstall
2008-06-06 22:42 . 2008-06-06 22:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Alien Skin
2008-06-06 22:33 . 2008-06-06 22:33 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Filter Forge
2008-06-06 11:44 . 2008-06-06 11:44 <DIR> d-------- C:\Program Files\Realtek AC97
2008-06-05 15:21 . 2008-07-25 21:03 <DIR> d-------- C:\My FLVs
2008-06-05 15:11 . 2008-06-05 15:11 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-06-05 15:11 . 2008-06-10 00:24 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-05 15:11 . 2007-02-28 13:33 761,856 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-06-05 15:11 . 2007-02-28 13:32 716,800 --a------ C:\WINDOWS\system32\lameACM.acm
2008-06-05 15:11 . 2007-02-28 13:33 389,120 --a------ C:\WINDOWS\system32\actskn43.ocx
2008-06-05 15:11 . 2007-02-28 13:33 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-06-05 15:11 . 2007-02-28 13:32 414 --a------ C:\WINDOWS\system32\lame_acm.xml
2008-06-04 15:48 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2008-06-04 15:48 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2008-06-04 15:48 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-30 07:38 --------- d-----w C:\Program Files\Google
2008-07-26 19:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-07-26 06:05 --------- d-----w C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor
2008-07-25 17:41 1,450,496 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-07-24 02:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-18 06:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-12 03:21 55,865 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_07_11_17_09_28_small.dmp.zip
2008-07-09 19:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 07:55 --------- d-----w C:\Program Files\Microsoft Games
2008-06-18 06:39 --------- d-----w C:\Program Files\MyPhotoBooks
2008-06-11 20:56 --------- d-----w C:\Program Files\coolpro2
2008-06-04 04:45 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-30 23:36 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-30 08:52 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-05-30 03:01 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM
2008-05-29 23:29 --------- d-----w C:\Program Files\DVD Decrypter
2008-05-29 23:28 --------- d-----w C:\Program Files\DVD Shrink
2008-05-29 09:51 --------- d-----w C:\Program Files\AlienGUIse
2008-05-29 09:49 --------- d-----w C:\Program Files\Common Files\Stardock
2008-05-29 09:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-05-29 08:39 --------- d-----w C:\Program Files\Photodex Presenter
2008-05-29 08:39 --------- d-----w C:\Program Files\Photodex
2008-05-29 08:39 --------- d-----w C:\Documents and Settings\Owner\Application Data\Netscape
2008-05-29 08:38 --------- d-----w C:\Documents and Settings\Owner\Application Data\Photodex
2008-05-29 02:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-05-29 02:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\Leadertech
2008-05-29 02:14 --------- d-----w C:\Program Files\epson
2008-05-29 02:14 --------- d-----w C:\Program Files\Common Files\ArcSoft
2008-05-29 02:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\EPSON
2008-05-29 02:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\InstallShield
2008-05-29 01:50 --------- d-----w C:\Program Files\Common Files\Ahead
2008-05-29 01:48 --------- d-----w C:\Documents and Settings\Owner\Application Data\Ahead
2008-05-29 01:46 --------- d-----w C:\Program Files\Nero
2008-05-29 01:38 --------- d-----w C:\Program Files\Ahead
2008-05-29 01:12 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-29 00:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\Syntrillium
2008-05-29 00:52 --------- d-----w C:\Documents and Settings\Owner\Application Data\Winamp
2008-05-29 00:10 --------- d-----w C:\Program Files\GiPo@Utilities
2008-05-29 00:10 --------- d-----w C:\Program Files\Common Files\Gibinsoft Shared
2008-05-28 22:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer
2008-05-28 22:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-28 22:04 --------- d-----w C:\Program Files\Lavasoft
2008-05-28 22:04 --------- d-----w C:\Documents and Settings\Owner\Application Data\Lavasoft
2008-05-28 21:55 --------- d-----w C:\Program Files\QuickTime
2008-05-28 21:55 --------- d-----w C:\Program Files\iTunes
2008-05-28 21:55 --------- d-----w C:\Program Files\iPod
2008-05-28 21:55 --------- d-----w C:\Program Files\Bonjour
2008-05-28 21:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-28 19:22 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-05-28 19:20 --------- d-----w C:\Program Files\MSBuild
2008-05-28 19:16 --------- d-----w C:\Program Files\Reference Assemblies
2008-05-28 19:16 --------- d-----w C:\Program Files\MSXML 6.0
2008-05-28 17:38 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-28 17:03 --------- d-----w C:\Program Files\Java
2008-05-28 16:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\Uniblue
2008-05-28 16:35 23,600 ----a-w C:\WINDOWS\system32\drivers\TVICHW32.SYS
2008-05-28 16:19 --------- d-----w C:\Program Files\Marvell
2008-05-28 16:16 --------- d-----w C:\Program Files\Realtek Sound Manager
2008-05-28 16:16 --------- d-----w C:\Program Files\AvRack
2008-05-28 16:14 --------- d-----w C:\Program Files\AMD
2008-05-28 16:11 --------- d-----w C:\Program Files\NVIDIA Corporation
2008-05-28 15:52 24,645,953 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2008_05_28_05_40_52_full.dmp.zip
2008-05-28 15:36 --------- d-----w C:\Program Files\Common Files\AOL
2008-05-28 15:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-05-28 14:47 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-28 14:46 --------- d-----w C:\Program Files\Common Files\Real
2008-05-28 14:45 --------- d-----w C:\Program Files\Common Files\aolshare
2008-05-28 14:39 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-05-28 14:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-28 13:36 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\McAfee
2008-05-28 13:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-05-28 13:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-05-28 13:36 --------- d-----w C:\Documents and Settings\Administrator\Application Data\McAfee
2008-05-28 13:33 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\SampleView
2008-05-28 13:33 --------- d-----w C:\Documents and Settings\Owner\Application Data\SampleView
2008-05-28 13:33 --------- d-----w C:\Documents and Settings\Administrator\Application Data\SampleView
2008-05-28 13:30 --------- d-----w C:\Program Files\CyberLink
2008-05-28 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-05-28 13:29 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\You've Got Pictures Screensaver
2008-05-28 13:29 --------- d-----w C:\Program Files\Viewpoint
2008-05-28 13:29 --------- d-----w C:\Program Files\Pure Networks
2008-05-28 13:29 --------- d-----w C:\Program Files\Learn2.com
2008-05-28 13:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-05-28 13:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-05-28 13:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks
2008-05-28 13:28 --------- d-----w C:\Program Files\Common Files\Nullsoft
2008-05-28 13:27 --------- d-----w C:\Program Files\Digital Media Reader
2008-05-28 13:26 --------- d-----w C:\Program Files\Microsoft Works
2008-05-28 13:26 --------- d-----w C:\Program Files\Common Files\Java
2008-05-28 13:21 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec
2008-05-28 13:20 --------- d-----w C:\Program Files\Common Files\New Boundary
2008-05-28 13:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Prism Deploy
2008-05-28 13:17 --------- d-----w C:\Program Files\CONEXANT
2008-05-22 22:18 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-01 03:27 442,368 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 10:42 212992]
"SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 12:04 135168]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 11:48 479232]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-18 19:54 1232152]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016]
"ShowWnd"="ShowWnd.exe" [2003-09-19 06:09 36864 C:\WINDOWS\ShowWnd.exe]
"nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
run_startmenu.cmd [2004-10-11 17:20:38 45]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 23:34 24576 C:\Program Files\AlienGUIse\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll,avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"vidc.uldx"= C:\PROGRA~1\ULEADS~1\ULEADV~1.0SE\DivX_UL.dll
"vidc.x264"= x264vfw.dll
"MSACM.MSNAUDIO"= msnaudio.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=C:\WINDOWS\pss\Windows Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-10-28 16:25 94208 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2003-10-31 16:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a------ 2004-05-17 15:30 543232 C:\WINDOWS\zHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"EPSON_PM_RPCV4_01"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict - DEMO\\wic.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\sweaw.exe"=
"C:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Activision\\Bridge Commander\\stbc.exe"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
R0 Si3132r5;SiI-3132 SoftRaid 5 Controller;C:\WINDOWS\system32\DRIVERS\Si3132r5.sys [2007-06-01 18:28]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-18 19:54]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-18 19:54]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-18 19:54]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-18 19:54]
R3 MaplomL;MaplomL;C:\WINDOWS\system32\drivers\MaplomL.sys [2008-05-20 11:43]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-07-21 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart\ErrorSmart.exe []
2008-07-21 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart []
2008-07-31 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDetect.exe []
.
- - - - ORPHANS REMOVED - - - -
Notify-AtiExtEvent - (no file)
MSConfigStartUp-Adobe Photo Downloader - C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe
MSConfigStartUp-ATIPTA - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
MSConfigStartUp-StartCCC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
MSConfigStartUp-SUPERAntiSpyware - C:\DOCUME~1\Owner\LOCALS~1\Temp\SSUPDATE.EXE
MSConfigStartUp-Uniblue RegistryBooster 2 - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
MSConfigStartUp-WinampAgent - C:\Program Files\Winamp\winampa.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.emachines.com/
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.emachines.com/
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-07-31 12:51:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-31 13:04:11
ComboFix-quarantined-files.txt 2008-07-31 23:03:48
Pre-Run: 25,635,827,712 bytes free
Post-Run: 25,677,287,424 bytes free
373