ComboFix 09-02-18.01 - HP_Administrator 2009-02-19 18:06:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.628 [GMT -6:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\crazybird.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\HP_Administrator\Favorites\Cheap Pharmacy Online.url
c:\documents and settings\HP_Administrator\Favorites\Search Online.url
c:\documents and settings\HP_Administrator\Favorites\SMS TRAP.url
c:\documents and settings\HP_Administrator\Favorites\VIP Casino.url
c:\documents and settings\HP_Administrator\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\Common\helper.dll
c:\program files\Common\helper.sig
c:\windows\default.htm
c:\windows\Dxoju.dll
c:\windows\Fonts\svchost.exe
c:\windows\IE4 Error Log.txt
c:\windows\ios.dat
c:\windows\jestertb.dll
c:\windows\system32\_proxy.dll
c:\windows\system32\adzgalore-remove.exe
c:\windows\system32\bnceoxoo.ini
c:\windows\system32\bversion.dll
c:\windows\system32\c.ico
c:\windows\system32\comsa32.sys
c:\windows\system32\digeste.dll
c:\windows\system32\drivers\UACwkornpyk.sys
c:\windows\system32\fccdbArp.dll
c:\windows\system32\fejokt.dll
c:\windows\system32\fhpatch.dll
c:\windows\system32\fiplock.dll
c:\windows\system32\hsfd83jfdg.dll
c:\windows\system32\inf\rundll33.exe
c:\windows\system32\inf\xccdfb16_090131.dll
c:\windows\system32\inf\xccefb090131.scr
c:\windows\system32\IPHACTION.dll
c:\windows\system32\IPHOST.dll
c:\windows\system32\iphy.dll
c:\windows\system32\IpSvchostF.dll
c:\windows\system32\kernel32_check.dll
c:\windows\system32\m.ico
c:\windows\system32\m3.ico
c:\windows\system32\mt_32.dll
c:\windows\system32\NopAyJjl.ini
c:\windows\system32\NopAyJjl.ini2
c:\windows\system32\nvaux32.dll
c:\windows\system32\p.ico
c:\windows\system32\s.ico
c:\windows\system32\sf.ico
c:\windows\system32\tpszxyd.sys
c:\windows\system32\twain_32
c:\windows\system32\twain_32\local.ds
c:\windows\system32\twain_32\user.ds
c:\windows\system32\twain_32\user.ds.cla
c:\windows\system32\twext.exe
c:\windows\system32\UACafsxmlte.dat
c:\windows\system32\UACjyoaenqo.log
c:\windows\system32\UACmkvbwnab.dll
c:\windows\system32\UACppbesjka.dll
c:\windows\system32\UACrtqpkrod.dll
c:\windows\system32\UACuxdoldaf.dll
c:\windows\system32\UACuyfqvoiy.log
c:\windows\system32\UACvvvnwlfl.log
c:\windows\system32\VFPsAGgh.ini
c:\windows\system32\VFPsAGgh.ini2
c:\windows\system32\wini10251.exe
c:\windows\system32\xcchit32.ini
c:\windows\wiaserviv.log
c:\windows\wiaservv.log
c:\windows\xccdf16_090131a.dll
c:\windows\xccdf32_090131a.dll
c:\windows\xccwinsys.ini
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_uacd.sys
((((((((((((((((((((((((( Files Created from 2009-01-20 to 2009-02-20 )))))))))))))))))))))))))))))))
.
2009-02-14 15:57 . 2009-02-14 15:57 <DIR> d-------- c:\program files\LanqiEngine
2009-02-14 15:57 . 2009-02-14 15:57 735,232 --a------ c:\windows\system32\AdvOcr.dll
2009-02-14 15:57 . 2009-02-14 15:57 94,208 --a------ c:\windows\system32\TRSOCR.dll
2009-02-14 15:57 . 2009-02-14 15:57 94,208 --a------ c:\windows\system32\TOCRdll.dll
2009-02-14 15:57 . 2009-02-14 15:57 95 --a------ c:\windows\TOCR.ini
2009-02-14 15:57 . 2009-02-14 15:57 95 --a------ c:\windows\system32\TRSOCR.ini
2009-02-14 15:53 . 2009-02-14 15:53 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-14 15:44 . 2009-02-14 15:57 32,137,216 --a------ c:\windows\system32\TRSOCR.dat
2009-02-14 15:06 . 2009-02-14 15:06 133,632 --a------ c:\windows\otowihepalamu.dll
2009-02-14 14:47 . 2009-02-14 14:47 10,240 --a------ c:\windows\system32\Packer.dll
2009-02-14 14:47 . 2009-02-14 14:47 1,536 --a------ c:\windows\system32\AUTMGR.EXE
2009-02-14 14:26 . 2009-02-18 23:52 5,189 --a------ c:\windows\system32\uacinit.dll
2009-02-14 14:24 . 2009-02-14 14:25 38,912 --a------ C:\dykhyp.exe
2009-02-14 14:24 . 2009-02-14 14:24 2 --a------ C:\152667771
2009-02-14 14:23 . 2009-02-19 18:09 <DIR> d-------- c:\windows\system32\inf
2009-02-14 14:23 . 2009-02-14 14:23 204,800 --a------ C:\ypuweg.exe
2009-02-14 14:23 . 2009-02-14 14:23 204,800 --a------ c:\windows\system32\azton.mt
2009-02-14 14:23 . 2009-02-14 14:23 155,156 --a------ c:\windows\system\xccef090131.exe
2009-02-14 14:23 . 2009-02-14 14:23 72,704 --a------ c:\windows\system32\bbafbgrt.dll
2009-02-14 14:23 . 2009-02-14 14:23 64,512 --a------ c:\windows\system32\wer3.pf
2009-02-14 14:23 . 2009-02-14 14:23 40,448 --a------ C:\cwxwwgtl.exe
2009-02-14 14:23 . 2009-02-14 14:23 32,768 --a------ c:\windows\system32\febbn.wa
2009-02-14 14:21 . 2009-02-14 14:22 302,592 --a------ c:\windows\system32\ljJyApoN.dll.vir
2009-02-14 14:16 . 2009-02-14 14:16 36,352 --a------ c:\windows\system32\cbXQJBuU.dll
2009-02-08 19:55 . 2009-02-08 19:55 <DIR> d-------- c:\program files\Visiosonic
2009-02-08 19:55 . 2009-02-08 19:55 <DIR> d-------- c:\program files\Submersible
2009-02-06 09:21 . 2009-02-06 09:21 <DIR> d-------- c:\program files\Trend Micro
2009-02-02 22:50 . 2009-02-19 18:07 <DIR> d-------- c:\program files\Common
2009-01-31 11:21 . 2009-01-31 11:21 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\cogad
2009-01-27 13:20 . 2009-02-16 16:40 <DIR> d-------- C:\Video
2009-01-23 19:49 . 2009-01-23 19:49 <DIR> d--h----- c:\program files\Zero G Registry
2009-01-23 19:48 . 2009-01-23 19:48 <DIR> d--h----- c:\documents and settings\HP_Administrator\InstallAnywhere
2009-01-23 19:06 . 2009-01-23 19:06 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\SoundTrek
2009-01-23 19:04 . 2009-01-23 19:14 <DIR> d-------- c:\windows\SoundTrek
2009-01-23 18:51 . 2009-01-23 18:52 <DIR> d-------- c:\windows\system32\Adobe
2009-01-23 07:47 . 2009-01-23 07:47 <DIR> d-------- c:\program files\MySpace
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-20 00:06 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-19 06:04 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\HP
2009-02-16 04:34 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-16 02:06 --------- d-----w c:\program files\Yahoo! Games
2009-02-16 02:05 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-16 02:05 --------- d-----w c:\program files\Full Tilt Poker.Net
2009-02-14 19:03 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\LimeWire
2009-02-11 08:30 --------- d-----w c:\program files\PDCPoker
2009-02-03 18:27 --------- d-----w c:\program files\Java
2009-01-23 04:21 --------- d-----w c:\program files\Xilisoft
2009-01-22 08:53 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\vlc
2009-01-16 13:40 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2009-01-15 18:55 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\Sahmon Games
2009-01-10 06:55 --------- d-----w c:\program files\Google
2009-01-09 23:06 --------- d-----w c:\program files\DivX
2009-01-08 17:30 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-08 17:28 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo!
2009-01-03 03:57 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\U3
2008-12-29 02:34 --------- d-----w c:\documents and settings\All Users\Application Data\SecTaskMan
2008-12-29 02:12 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-29 02:12 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-29 00:04 --------- d-----w c:\program files\Oberon Media
2008-12-28 22:38 --------- d-----w c:\program files\Windows Live
2008-12-28 22:37 --------- d-----w c:\program files\Real
2008-12-28 22:17 --------- d-----w c:\program files\eGames
2008-12-28 22:15 --------- d-----w c:\program files\Yahoo!
2008-12-28 22:07 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo
2008-12-28 22:03 --------- d-----w c:\documents and settings\WESLEY\Application Data\Verizon
2008-12-28 22:03 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\Verizon
2008-12-28 22:03 --------- d-----w c:\documents and settings\All Users\Application Data\Verizon
2008-12-28 21:59 --------- d-----w c:\program files\Common Files\SupportSoft
2008-12-28 21:58 --------- d-----w c:\program files\Common Files\Motive
2008-12-28 20:18 --------- d-----w c:\program files\Common Files\Real
2008-02-27 04:58 8,578 ----a-w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
2007-03-21 13:16 300,680 -c----w c:\documents and settings\All Users\Application Data\arclib.dll
2007-03-21 03:16 150 ----a-w c:\documents and settings\WESLEY\Application Data\wklnhst.dat
2008-10-10 13:55 44,032 --sha-w c:\windows\system32\Crypt_16.dll
.
file copied: c:\windows\system32\user32.dll -> c:\qoobox\Quarantine\C\WINDOWS\system32\user32.dll.vir ( 577536 bytes )
Infected c:\windows\system32\user32.dll hex repaired------- Sigcheck -------
2009-02-14 14:23 215552 a77219a971029dc2fb683e8513713803 c:\windows\system32\termsrv.dll
2009-02-14 14:23 215552 a77219a971029dc2fb683e8513713803 c:\windows\system32\dllcache\termsrv.dll
2006-07-05 04:57 985088 0fdd84928a5dde2510761b7ec76ccec9 c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
2007-04-16 10:07 986112 09f7cb3687f86edaa4ca081f7ab66c03 c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
2004-08-09 15:00 983552 888190e31455fad793312f8d087146eb c:\windows\$NtUninstallKB917422$\kernel32.dll
2006-07-05 04:55 984064 d8db5397de07577c1cb50ba6d23b3ad4 c:\windows\$NtUninstallKB935839$\kernel32.dll
2009-02-14 14:47 984576 be3941e1b96b5215127056e5107fbfc2 c:\windows\system32\kernel32.dll
2007-04-16 09:52 984576 a01f9ca902a88f7ced06884174d6419d c:\windows\system32\dllcache\kernel32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-09 15360]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-14 136600]
"Kqepejelapelep"="c:\windows\otowihepalamu.dll" [2009-02-14 133632]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\a.exe]
"Debugger"=c:\windows\system32\alg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\matrix31290.exe]
"Debugger"=c:\windows\system32\alg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\~tmpa.exe]
"Debugger"=c:\windows\system32\alg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\~tmpb.exe]
"Debugger"=c:\windows\system32\alg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\~tmpc.exe]
"Debugger"=c:\windows\system32\alg.exe
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\
0stera
[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^Adobe Media Player.lnk]
path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\Adobe Media Player.lnk
backup=c:\windows\pss\Adobe Media Player.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-06-06 10:04 50528 c:\program files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--------- 2004-08-09 15:00 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
--a------ 2007-03-22 18:29 39264 c:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-21 01:12 133104 c:\documents and settings\HP_Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kqepejelapelep]
--a------ 2009-02-14 15:06 133632 c:\windows\otowihepalamu.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
--a------ 2008-11-05 21:59 4347120 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a--c--- 2006-08-05 14:48 98304 c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2006-11-03 18:20 866584 c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2008-11-05 21:59 4347120 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Documents and Settings\\HP_Administrator\\My Documents\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19112:TCP"= 19112:TCP:BitComet 19112 TCP
"19112:UDP"= 19112:UDP:BitComet 19112 UDP
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2009-01-08 57376]
S1 1860e4a3;1860e4a3;c:\windows\system32\drivers\1860e4a3.sys --> c:\windows\system32\drivers\1860e4a3.sys [?]
S1 cd7a9fa;cd7a9fa;c:\windows\system32\drivers\cd7a9fa.sys [2008-10-10 0]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?]
S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [2009-01-08 377920]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [2006-09-27 10664]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\D-Link\RangeBooster G WUA-2340\JSWUtil\jswpsapi.exe --> c:\program files\D-Link\RangeBooster G WUA-2340\JSWUtil\jswpsapi.exe [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
2009-02-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-10 00:55]
2008-10-09 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-21 01:12]
2009-02-20 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -
BHO-{C5BF49A2-94F3-42BD-F434-3604812C8955} - c:\windows\system32\hsfd83jfdg.dll
HKLM-Run-qdgnijbgaofzcq - c:\windows\system32\chuzvtnvhygsimne.dll
HKLM-Explorer_Run-xccinit - c:\windows\system32\inf\rundll33.exe
SharedTaskScheduler-{C5BF49A2-94F3-42BD-F434-3604812C8955} - c:\windows\system32\hsfd83jfdg.dll
Notify-nnnnOFWM - nnnnOFWM.dll
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-GetModule23 - c:\program files\GetModule\GetModule23.exe
MSConfigStartUp-GetPack22 - c:\program files\GetPack\GetPack22.exe
MSConfigStartUp-h9axno0mfc7eyypzvyho9 - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\vvqd5n7er.exe
MSConfigStartUp-jsf8uiw3jnjgffght - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\winlognn.exe
MSConfigStartUp-jv8gav6yanon05ryzbaumjw00j6qif9r275mdy9jj - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\bpbk6g5tp4xdz.exe
MSConfigStartUp-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-n00ji2e5icz32w54w9rgks77j8bh7i63uy3gb9lqzhrtr - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\ot6poa0fpu.exe
MSConfigStartUp-qa3a62no9fpu4892qg3c476p2ayar56 - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\mzen8p5yb0vcd.exe
MSConfigStartUp-tezrtsjhfr84iusjfo84f - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\csrssc.exe
MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
MSConfigStartUp-u9g9fq02xs8nizgt4tlzt1wynzwvk7oe8j589 - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\vx0lctgfmg4au.exe
MSConfigStartUp-us6iqcddjkj8rq8d3vpyy2ms9ng16o6sb6vnzrhicu - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\kku0r68df.exe
MSConfigStartUp-w0t72jr3zould841colgrrhreet - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\cwiplo8s76w7t.exe
MSConfigStartUp-w8ksazthgphvwaz897b39msx6ebbnsw2z7qhl7uh5 - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\hf4vpux0.exe
MSConfigStartUp-wqprste4k - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\eb5yykacbo6.exe
MSConfigStartUp-x2qjrdk9z4ca0k8avkspxn1987urqm3ivvo - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\zffcc1a5z8y3.exe
MSConfigStartUp-x5acw9lt4lhxat31egeamgnz91ovvdh5zd1bewq8u1k9xuc - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\gnktwyuamyvw.exe
MSConfigStartUp-xqlpsxhbd2b20xu7sutajk10idc9wu9myfld9g47kt - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\e1gvjlvbd4222.exe
MSConfigStartUp-yl5t46wjjcq03b3rcexzc6t6s3232ew437ltvd6mbuv2a8hxl - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\zfqv2k.exe
MSConfigStartUp-z2a5q2depfp - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\o8uldwi.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://aol.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/verizon/*http://www.yahoo.com/search/ie.html
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\enxah9ey.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - aol.com
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - plugin: c:\program files\Google\Google Updater\2.4.1441.4352\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-02-19 18:17:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(480)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\arservice.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\dllhost.exe
c:\windows\system32\ati2evxx.exe
.
**************************************************************************
.
Completion time: 2009-02-19 18:21:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-20 00:20:37
Pre-Run: 38,234,243,072 bytes free
Post-Run: 39,083,704,320 bytes free
358 --- E O F --- 2009-01-30 04:10:27