Hi Sal,
Great Job !... and thank the Combofix programmer... It fixed the sound on Youtube...
I think that I still may have a problem with the keylogger flickering... page close / freeze up..
but its great to have the sound back ....
Heres the Combofix log...
Cheers
Dowsp
==================================================
ComboFix 11-06-21.08 - P 23/06/2011 16:40:02.19.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.240 [GMT 1:00]
Running from: c:\documents and settings\P\Desktop\combofix\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: PC Tools Firewall Plus *Disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\P\g2mdlhlpx.exe
c:\documents and settings\P\Local Settings\Application Data\{2C75D44D-B6E4-4710-A404-A6592926EA9C}
c:\documents and settings\P\Local Settings\Application Data\{2C75D44D-B6E4-4710-A404-A6592926EA9C}\chrome.manifest
c:\documents and settings\P\Local Settings\Application Data\{2C75D44D-B6E4-4710-A404-A6592926EA9C}\chrome\content\_cfg.js
c:\documents and settings\P\Local Settings\Application Data\{2C75D44D-B6E4-4710-A404-A6592926EA9C}\chrome\content\c.js
c:\documents and settings\P\Local Settings\Application Data\{2C75D44D-B6E4-4710-A404-A6592926EA9C}\chrome\content\overlay.xul
c:\documents and settings\P\Local Settings\Application Data\{2C75D44D-B6E4-4710-A404-A6592926EA9C}\install.rdf
.
.
((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))
.
.
2011-06-22 02:49 . 2011-06-22 02:49 1409 ----a-w- c:\windows\QTFont.for
2011-06-09 16:58 . 2004-08-04 05:00 13463552 ----a-w- c:\windows\system32\dllcache\hwxjpn.dll
2011-06-09 16:58 . 2004-08-04 05:00 10096640 ----a-w- c:\windows\system32\dllcache\hwxcht.dll
2011-06-09 15:53 . 2004-08-03 23:56 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-06-09 15:53 . 2001-08-17 21:36 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-06-09 15:53 . 2001-08-17 21:36 17408 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-06-09 15:53 . 2001-08-17 21:37 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-06-09 15:53 . 2001-08-17 21:37 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-06-09 15:52 . 2001-08-17 21:37 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe
2011-06-09 15:52 . 2001-08-17 11:11 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-06-09 15:52 . 2004-08-03 21:29 19455 ----a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-06-09 15:52 . 2004-08-03 22:10 19328 ----a-w- c:\windows\system32\dllcache\wstcodec.sys
2011-06-09 15:52 . 2004-08-03 21:29 12063 ----a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-06-09 15:52 . 2004-08-03 23:56 8192 ----a-w- c:\windows\system32\dllcache\wshirda.dll
2011-06-09 15:51 . 2004-08-03 22:07 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-06-09 15:51 . 2004-08-03 21:31 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-06-09 15:51 . 2001-08-17 11:12 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-06-09 15:51 . 2001-08-17 12:28 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys
2011-06-09 15:49 . 2001-08-17 11:13 16925 ----a-w- c:\windows\system32\dllcache\w940nd.sys
2011-06-09 15:48 . 2001-08-17 12:28 765884 ----a-w- c:\windows\system32\dllcache\usrti.sys
2011-06-09 15:48 . 2001-08-17 12:28 113762 ----a-w- c:\windows\system32\dllcache\usrpda.sys
2011-06-09 15:48 . 2001-08-17 12:28 7556 ----a-w- c:\windows\system32\dllcache\usroslba.sys
2011-06-09 15:48 . 2001-08-17 12:28 224802 ----a-w- c:\windows\system32\dllcache\usr1807a.sys
2011-06-09 15:48 . 2001-08-17 12:28 794399 ----a-w- c:\windows\system32\dllcache\usr1806v.sys
2011-06-09 15:48 . 2001-08-17 12:28 793598 ----a-w- c:\windows\system32\dllcache\usr1806.sys
2011-06-09 15:48 . 2001-08-17 12:28 794654 ----a-w- c:\windows\system32\dllcache\usr1801.sys
2011-06-09 15:48 . 2004-08-03 22:10 78464 ----a-w- c:\windows\system32\dllcache\usbvideo.sys
2011-06-09 15:48 . 2004-08-03 22:08 25600 ----a-w- c:\windows\system32\dllcache\usbser.sys
2011-06-09 15:48 . 2004-08-03 22:08 17024 ----a-w- c:\windows\system32\dllcache\usbohci.sys
2011-06-09 15:48 . 2004-08-03 22:04 12672 ----a-w- c:\windows\system32\dllcache\usb8023x.sys
2011-06-09 15:48 . 2004-08-03 21:31 32384 ----a-w- c:\windows\system32\dllcache\usb101et.sys
2011-06-09 15:47 . 2004-08-04 05:00 76288 ----a-w- c:\windows\system32\dllcache\uniime.dll
2011-06-09 15:47 . 2001-08-17 21:36 94720 ----a-w- c:\windows\system32\dllcache\umaxud32.dll
2011-06-09 15:47 . 2001-08-17 21:36 28160 ----a-w- c:\windows\system32\dllcache\umaxu40.dll
2011-06-09 15:47 . 2001-08-17 21:36 26624 ----a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-06-09 15:47 . 2001-08-17 21:36 69632 ----a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-06-09 15:47 . 2001-08-17 21:36 50688 ----a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-06-09 15:47 . 2001-08-17 12:58 22912 ----a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-06-09 15:47 . 2001-08-17 21:36 50176 ----a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-06-09 15:47 . 2001-08-17 21:36 47616 ----a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-06-09 15:47 . 2001-08-17 21:36 211968 ----a-w- c:\windows\system32\dllcache\um54scan.dll
2011-06-09 15:47 . 2001-08-17 21:36 216064 ----a-w- c:\windows\system32\dllcache\um34scan.dll
2011-06-09 15:47 . 2004-08-03 22:07 44672 ----a-w- c:\windows\system32\dllcache\uagp35.sys
2011-06-09 15:46 . 2001-08-17 12:48 11520 ----a-w- c:\windows\system32\dllcache\twotrack.sys
2011-06-09 15:46 . 2004-08-04 05:00 14336 ----a-w- c:\windows\system32\dllcache\tsprof.exe
2011-06-09 15:46 . 2001-08-17 11:51 166784 ----a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-06-09 15:46 . 2001-08-17 21:36 525568 ----a-w- c:\windows\system32\dllcache\tridxp.dll
2011-06-09 15:46 . 2001-08-17 11:51 159232 ----a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-06-09 15:46 . 2001-08-17 13:56 440576 ----a-w- c:\windows\system32\dllcache\tridkb.dll
2011-06-09 15:46 . 2001-08-17 11:51 222336 ----a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-06-09 15:46 . 2001-08-17 13:56 315520 ----a-w- c:\windows\system32\dllcache\trid3d.dll
2011-06-09 15:46 . 2001-08-17 11:12 34375 ----a-w- c:\windows\system32\dllcache\tpro4.sys
2011-06-09 15:46 . 2001-08-17 21:35 42496 ----a-w- c:\windows\system32\dllcache\tp4res.dll
2011-06-09 15:46 . 2004-08-03 23:56 82432 ----a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-06-09 15:44 . 2004-08-04 05:00 21896 ----a-w- c:\windows\system32\dllcache\tdipx.sys
2011-06-09 15:44 . 2001-08-17 11:13 37961 ----a-w- c:\windows\system32\dllcache\tdk100b.sys
2011-06-09 15:44 . 2004-08-04 05:00 13192 ----a-w- c:\windows\system32\dllcache\tdasync.sys
2011-06-09 15:44 . 2001-08-17 12:49 30464 ----a-w- c:\windows\system32\dllcache\tbatm155.sys
2011-06-09 15:44 . 2001-08-17 12:52 7040 ----a-w- c:\windows\system32\dllcache\tandqic.sys
2011-06-09 15:44 . 2001-08-17 11:50 36640 ----a-w- c:\windows\system32\dllcache\t2r4mini.sys
2011-06-09 15:44 . 2001-08-17 13:56 172768 ----a-w- c:\windows\system32\dllcache\t2r4disp.dll
2011-06-09 15:44 . 2001-08-17 21:36 94293 ----a-w- c:\windows\system32\dllcache\sxports.dll
2011-06-09 15:44 . 2001-08-17 12:50 103936 ----a-w- c:\windows\system32\dllcache\sx.sys
2011-06-09 15:44 . 2001-08-17 13:02 3968 ----a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-06-09 15:44 . 2001-08-17 21:36 10240 ----a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-06-09 15:43 . 2001-08-17 21:36 10240 ----a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-06-09 15:43 . 2001-08-17 21:36 53760 ----a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-06-09 15:43 . 2001-08-17 21:36 41472 ----a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-06-09 15:43 . 2004-08-03 22:10 15360 ----a-w- c:\windows\system32\dllcache\streamip.sys
2011-06-09 15:43 . 2001-08-17 21:36 155648 ----a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-06-09 15:43 . 2001-08-17 21:36 53248 ----a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-06-09 15:43 . 2001-08-17 11:18 285760 ----a-w- c:\windows\system32\dllcache\stlnata.sys
2011-06-09 15:43 . 2001-08-17 12:51 16896 ----a-w- c:\windows\system32\dllcache\stcusb.sys
2011-06-09 15:43 . 2001-08-17 11:11 48736 ----a-w- c:\windows\system32\dllcache\srwlnd5.sys
2011-06-09 15:41 . 2001-08-17 21:36 12288 ----a-w- c:\windows\system32\dllcache\EXCH_smtpctrs.dll
2011-06-09 15:40 . 2004-08-03 22:10 11136 ----a-w- c:\windows\system32\dllcache\slip.sys
2011-06-09 15:39 . 2004-08-03 23:56 3901 ----a-w- c:\windows\system32\dllcache\siint5.dll
2011-06-09 15:39 . 2001-07-21 13:29 161568 ----a-w- c:\windows\system32\dllcache\sgsmusb.sys
2011-06-09 15:38 . 2001-07-21 13:29 18400 ----a-w- c:\windows\system32\dllcache\sgsmld.sys
2011-06-09 15:38 . 2001-08-17 11:51 98080 ----a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2011-06-09 15:38 . 2001-08-17 21:36 386560 ----a-w- c:\windows\system32\dllcache\sgiul50.dll
2011-06-09 15:38 . 2001-08-17 11:19 36480 ----a-w- c:\windows\system32\dllcache\sfmanm.sys
2011-06-09 15:37 . 2001-08-17 12:53 6784 ----a-w- c:\windows\system32\dllcache\serscan.sys
2011-06-09 15:37 . 2001-08-17 21:36 26112 ----a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2011-06-09 15:37 . 2001-08-17 12:53 6912 ----a-w- c:\windows\system32\dllcache\seaddsmc.sys
2011-06-09 15:37 . 2001-08-17 12:53 10880 ----a-w- c:\windows\system32\dllcache\scsiscan.sys
2011-06-09 15:37 . 2001-08-17 12:52 11648 ----a-w- c:\windows\system32\dllcache\scsiprnt.sys
2011-06-09 15:37 . 2001-08-17 21:36 57856 ----a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-06-09 15:37 . 2001-08-17 12:51 17280 ----a-w- c:\windows\system32\dllcache\scr111.sys
2011-06-09 15:37 . 2001-08-17 12:51 16640 ----a-w- c:\windows\system32\dllcache\scmstcs.sys
2011-06-09 15:37 . 2001-08-17 12:51 23936 ----a-w- c:\windows\system32\dllcache\sccmusbm.sys
2011-06-09 15:36 . 2001-08-17 12:51 23936 ----a-w- c:\windows\system32\dllcache\sccmn50m.sys
2011-06-09 15:36 . 2004-08-03 21:59 43136 ----a-w- c:\windows\system32\dllcache\sbp2port.sys
2011-06-09 15:36 . 2001-08-17 21:36 495616 ----a-w- c:\windows\system32\dllcache\sblfx.dll
2011-06-09 15:36 . 2001-08-17 11:50 75392 ----a-w- c:\windows\system32\dllcache\s3savmxm.sys
2011-06-09 15:36 . 2001-08-17 13:56 245632 ----a-w- c:\windows\system32\dllcache\s3savmx.dll
2011-06-09 15:36 . 2001-08-17 11:50 77824 ----a-w- c:\windows\system32\dllcache\s3sav4m.sys
2011-06-09 15:36 . 2001-08-17 13:56 198400 ----a-w- c:\windows\system32\dllcache\s3sav4.dll
2011-06-09 15:34 . 2001-08-17 11:12 19017 ----a-w- c:\windows\system32\dllcache\rtl8029.sys
2011-06-09 15:34 . 2001-08-17 11:19 30720 ----a-w- c:\windows\system32\dllcache\rthwcls.sys
2011-06-09 15:34 . 2001-08-17 21:36 9216 ----a-w- c:\windows\system32\dllcache\rsmgrstr.dll
2011-06-09 15:34 . 2001-08-17 11:19 3840 ----a-w- c:\windows\system32\dllcache\rpfun.sys
2011-06-09 15:34 . 2004-08-03 21:59 79104 ----a-w- c:\windows\system32\dllcache\rocket.sys
2011-06-09 15:34 . 2004-08-03 22:04 30080 ----a-w- c:\windows\system32\dllcache\rndismpx.sys
2011-06-09 15:34 . 2001-08-17 11:12 37563 ----a-w- c:\windows\system32\dllcache\rlnet5.sys
2011-06-09 15:34 . 2004-08-03 22:10 59648 ----a-w- c:\windows\system32\dllcache\rfcomm.sys
2011-06-09 15:34 . 2001-08-17 21:36 86097 ----a-w- c:\windows\system32\dllcache\reslog32.dll
2011-06-09 15:34 . 2001-08-17 21:36 23040 ----a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2011-06-09 15:34 . 2004-08-04 05:00 14848 ----a-w- c:\windows\system32\dllcache\register.exe
2011-06-09 15:34 . 2004-08-03 21:41 13776 ----a-w- c:\windows\system32\dllcache\recagent.sys
2011-06-09 15:33 . 2001-08-17 12:51 19584 ----a-w- c:\windows\system32\dllcache\rasirda.sys
2011-06-09 15:33 . 2004-08-04 05:00 20736 ----a-w- c:\windows\system32\dllcache\ramdisk.sys
2011-06-09 15:33 . 2001-08-17 12:28 714762 ----a-w- c:\windows\system32\dllcache\r2mdmkxx.sys
2011-06-09 15:33 . 2001-08-17 12:28 899146 ----a-w- c:\windows\system32\dllcache\r2mdkxga.sys
2011-06-09 15:33 . 2001-08-17 21:36 41472 ----a-w- c:\windows\system32\dllcache\qvusd.dll
2011-06-09 15:33 . 2004-08-04 05:00 16384 ----a-w- c:\windows\system32\dllcache\quser.exe
2011-06-09 15:33 . 2001-08-17 12:53 3328 ----a-w- c:\windows\system32\dllcache\qv2kux.sys
2011-06-09 15:33 . 2004-08-04 05:00 9728 ----a-w- c:\windows\system32\dllcache\query.exe
2011-06-09 15:32 . 2004-08-03 22:00 6016 ----a-w- c:\windows\system32\dllcache\qic157.sys
2011-06-09 15:32 . 2001-08-17 12:28 130942 ----a-w- c:\windows\system32\dllcache\ptserlv.sys
2011-06-09 15:32 . 2001-08-17 12:28 112574 ----a-w- c:\windows\system32\dllcache\ptserlp.sys
2011-06-09 15:32 . 2001-08-17 12:28 128286 ----a-w- c:\windows\system32\dllcache\ptserli.sys
2011-06-09 15:32 . 2004-08-03 23:56 159232 ----a-w- c:\windows\system32\dllcache\ptpusd.dll
2011-06-09 15:32 . 2001-08-17 21:36 5632 ----a-w- c:\windows\system32\dllcache\ptpusb.dll
2011-06-09 15:32 . 2001-08-17 21:36 35328 ----a-w- c:\windows\system32\dllcache\psisload.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-21 14:15 . 2011-05-23 02:12 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-22 00:38 . 2011-05-21 22:18 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-05-22 00:38 . 2011-05-21 22:18 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-04-08 02:24 . 2011-04-08 02:24 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-08 02:24 . 2010-07-08 23:38 472808 ----a-w- c:\windows\system32\deployJava1.dll
2009-03-25 04:56 . 2009-03-25 04:55 1075840 ----a-w- c:\program files\Google Updater.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-03-16 98304]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2010-01-14 378128]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-23 2652056]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-05-22 281768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-09-12 180269]
"Dell Photo AIO Printer 922"="c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe" [2005-04-22 290816]
"DLBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2004-11-09 69632]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2004-01-12 06:55 110592 ----a-w- c:\windows\SYSTEM32\LgNotify.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk
backup=c:\windows\pss\AOL 9.0 Tray Icon.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DSLMON.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\DSLMON.lnk
backup=c:\windows\pss\DSLMON.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SnagIt 7.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SnagIt 7.lnk
backup=c:\windows\pss\SnagIt 7.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^P^Start Menu^Programs^Startup^is-0GOKV.lnk]
path=c:\documents and settings\P\Start Menu\Programs\Startup\is-0GOKV.lnk
backup=c:\windows\pss\is-0GOKV.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^P^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\P\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^P^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\P\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2004-09-13 11:33 155648 -c--a-w- c:\program files\Apoint\Apoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Photo AIO Printer 922]
2005-04-22 07:45 290816 ----a-w- c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2004-10-07 19:44 610304 ----a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2004-07-19 07:51 306688 ----a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-12-06 01:05 127035 -c--a-w- c:\windows\SYSTEM32\dla\tfswctrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2004-10-12 16:54 57344 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2006-03-11 13:34 190464 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoToMeeting]
2010-06-02 19:54 39816 ----a-w- c:\program files\Citrix\GoToMeeting\457\g2mstart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2005-09-20 08:32 77824 ----a-w- c:\windows\SYSTEM32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-09-20 08:32 77824 ----a-w- c:\windows\SYSTEM32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-09-20 08:36 114688 ----a-w- c:\windows\SYSTEM32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-09-20 08:35 94208 ----a-w- c:\windows\SYSTEM32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NapsterShell]
2006-06-17 13:29 319488 ----a-w- c:\program files\Napster\napster.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRONoMgr.exe]
2003-05-28 17:32 86016 -c--a-w- c:\program files\Intel\NCS\PROSet\PRONoMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2005-03-16 01:11 98304 ----a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2005-09-12 04:36 208941 ----a-w- c:\program files\Real\RealPlayer\realplay.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 09:02 26100520 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
2004-01-26 11:38 866816 ----a-w- c:\program files\Thomson\SpeedTouch USB\dragdiag.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 13:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-03-25 04:56 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tesco internet phone]
2007-01-30 10:14 6942720 ----a-w- c:\program files\Tesco internet phone\TescoIP.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2005-09-12 04:36 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2004-01-07 01:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"JavaQuickStarterService"=2 (0x2)
"KService"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"StumbleUponUpdateService"=3 (0x3)
"S24EventMonitor"=2 (0x2)
"RetroLauncher"=2 (0x2)
"RegSrvc"=2 (0x2)
"PCToolsFirewallPlus"=2 (0x2)
"NetSvc"=3 (0x3)
"MsMpSvc"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate1c9ad062ddca2f0"=2 (0x2)
"dlbt_device"=3 (0x3)
"AOL ACS"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirSchedulerService"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Tesco internet phone\\TescoIP.exe"=
"c:\\Documents and Settings\\P\\Desktop\\utorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 TfFsMon;TfFsMon;c:\windows\SYSTEM32\DRIVERS\TfFsMon.sys [21/05/2011 23:13 51984]
R0 TfSysMon;TfSysMon;c:\windows\SYSTEM32\DRIVERS\TfSysMon.sys [21/05/2011 23:13 59664]
R1 pctgntdi;pctgntdi;c:\windows\SYSTEM32\DRIVERS\pctgntdi.sys [21/05/2011 23:14 159600]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [21/05/2011 23:18 136360]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\SYSTEM32\DRIVERS\PCTAppEvent.sys [21/05/2011 23:14 73840]
R3 pctplfw;pctplfw;c:\windows\SYSTEM32\DRIVERS\pctplfw.sys [21/05/2011 23:13 95640]
R3 TfNetMon;TfNetMon;c:\windows\SYSTEM32\DRIVERS\TfNetMon.sys [21/05/2011 23:13 33552]
S2 gupdate1c9ad062ddca2f0;Google Update Service (gupdate1c9ad062ddca2f0);c:\program files\Google\Update\GoogleUpdate.exe [25/03/2009 05:57 133104]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [25/03/2009 05:57 133104]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 13:49 227232]
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-23 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
2011-06-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2005-02-26 04:56]
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-25 04:57]
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-25 04:57]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://finance.groups.yahoo.com/group/d/
uInternet Connection Wizard,ShellNext = hxxp://www.dell.co.uk/myway
uSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
TCP: DhcpNameServer = 192.168.22.22 192.168.22.23
FF - ProfilePath - c:\documents and settings\P\Application Data\Mozilla\Firefox\Profiles\ejftmv6o.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter:
[email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - user.js: yahoo.homepage.dontask - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2011-06-23 17:12
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,
[email protected]???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ThreatFire]
"AlternateImagePath"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1372)
c:\windows\system32\LgNotify.dll
c:\program files\ThreatFire\TFNI.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll
c:\program files\ThreatFire\TFWAH.dll
.
- - - - - - - > 'lsass.exe'(1428)
c:\program files\ThreatFire\TFWAH.dll
.
Completion time: 2011-06-23 17:23:49
ComboFix-quarantined-files.txt 2011-06-23 16:23
ComboFix2.txt 2011-05-21 21:26
ComboFix3.txt 2011-05-21 03:24
ComboFix4.txt 2011-04-02 22:46
.
Pre-Run: 898,502,656 bytes free
Post-Run: 1,305,141,248 bytes free
.
- - End Of File - - FBDA786388721384C23CA3B324814BFB