Edit 4-28-09: I was able to get this cleaned up. Thank you anyway.
I have been working on my neighbor's computer since yesterday. Couldn't get any of the AVs to install, couldn't get Malwarebytes t install, couldn't get superantispyware to install. Looking through another post, I tried combofix and got it to generate a log. Here it is, any help would be VERY appreciated!
LOG:
ComboFix 09-04-25.A3 - Janet Frye 04/26/2009 9:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.701 [GMT -4:00]
Running from: c:\documents and settings\Janet Frye\desktop\combo-fix.exe
Command switches used :: /killall
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\UACkuxoetpeiqwuoou.sys
c:\windows\system32\UACaqhrqaorxsmrtdu.log
c:\windows\system32\UACijyfmpfxclqiamk.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACkyhsdipdkxelxle.dll
c:\windows\system32\UAClmxydipyjlojdji.dll
c:\windows\system32\UACmlogknwdgatauue.log
c:\windows\system32\UACocyxfcppxgfxkrw.log
c:\windows\system32\UACtpkeovywpvayjva.dll
c:\windows\system32\UACvngoaqlnlesyupd.dat
c:\windows\system32\UACyypvqpwoweljfdo.dll
c:\windows\system32\wincontrol.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-4-26 )))))))))))))))))))))))))))))))
.
2009-04-26 12:06 . 2009-04-26 12:31 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-26 12:04 . 2005-06-18 15:44 212240 ----a-w c:\windows\system32\RichTx32.ocx
2009-04-26 12:04 . 2004-03-09 05:00 124688 ----a-w c:\windows\system32\MSWinSck.ocx
2009-04-26 12:04 . 2009-04-26 12:04 -------- d-----w c:\program files\Common Files\eSellerate
2009-04-26 12:04 . 2007-06-08 17:53 1753088 ----a-w c:\windows\system32\ExGrid.dll
2009-04-26 12:04 . 2007-06-05 14:20 602112 ----a-w c:\windows\system32\ExMenu.dll
2009-04-26 12:04 . 2007-06-05 14:19 516096 ----a-w c:\windows\system32\ExTab.dll
2009-04-26 12:04 . 2007-04-03 20:51 614400 ----a-w c:\windows\system32\ExButton.dll
2009-04-26 12:04 . 2007-04-03 20:51 307200 ----a-w c:\windows\system32\ExPMenu.dll
2009-04-26 12:04 . 2005-10-11 18:40 356352 ----a-w c:\windows\system32\eSellerateEngine.dll
2009-04-26 12:04 . 2005-10-04 12:11 118784 ----a-w c:\windows\system32\eWebControl.dll
2009-04-26 12:04 . 1998-04-24 05:00 368912 ----a-w c:\windows\system32\vbar332.dll
2009-04-26 12:04 . 2009-04-26 12:04 -------- d-----w c:\program files\AnswersThatWork
2009-04-26 11:05 . 2009-04-26 12:33 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-26 10:59 . 2005-12-14 05:40 135168 ----a-w c:\windows\system32\igfxres.dll
2009-04-26 04:03 . 2004-08-10 08:13 73728 -c--a-w c:\windows\system32\dllcache\ehresja.dll
2009-04-26 04:03 . 2004-08-10 08:13 69632 -c--a-w c:\windows\system32\dllcache\ehresko.dll
2009-04-26 04:03 . 2004-08-10 08:13 69632 -c--a-w c:\windows\system32\dllcache\ehresfr.dll
2009-04-26 04:03 . 2004-08-10 08:13 69632 -c--a-w c:\windows\system32\dllcache\ehresde.dll
2009-04-26 04:01 . 2004-08-10 11:00 5632 -c--a-w c:\windows\system32\dllcache\smimsgif.dll
2009-04-26 04:00 . 2001-08-18 02:36 65536 -c--a-w c:\windows\system32\dllcache\EXCH_mailmsg.dll
2009-04-26 03:59 . 2004-08-10 11:00 78848 -c--a-w c:\windows\system32\dllcache\dayi.ime
2009-04-26 03:58 . 2003-03-24 20:52 20540 -c--a-w c:\windows\system32\dllcache\admin.dll
2009-04-26 03:55 . 2009-04-26 03:55 488 ---ha-r c:\windows\system32\logonui.exe.manifest
2009-04-26 03:55 . 2009-04-26 03:55 749 ---ha-r c:\windows\WindowsShell.Manifest
2009-04-26 03:55 . 2009-04-26 03:55 749 ---ha-r c:\windows\system32\wuaucpl.cpl.manifest
2009-04-26 03:55 . 2009-04-26 03:55 749 ---ha-r c:\windows\system32\sapi.cpl.manifest
2009-04-26 03:55 . 2009-04-26 03:55 749 ---ha-r c:\windows\system32\nwc.cpl.manifest
2009-04-26 03:55 . 2009-04-26 03:55 749 ---ha-r c:\windows\system32\ncpa.cpl.manifest
2009-04-26 03:37 . 2004-08-10 11:00 13753 ----a-r c:\windows\SET91.tmp
2009-04-26 03:37 . 2004-08-10 11:00 1086058 ----a-r c:\windows\SET85.tmp
2009-04-26 03:37 . 2004-08-10 11:00 106147 ----a-r c:\windows\SET82.tmp
2009-04-26 02:55 . 2009-04-26 02:55 -------- d-----w c:\program files\CCleaner
2009-04-25 22:54 . 2004-08-10 11:00 16384 -c--a-w c:\windows\system32\dllcache\isignup.exe
2009-04-25 22:54 . 2004-08-10 11:00 32768 -c--a-w c:\windows\system32\dllcache\icwdl.dll
2009-04-25 22:54 . 2004-08-10 11:00 86016 -c--a-w c:\windows\system32\dllcache\icwconn2.exe
2009-04-25 22:54 . 2004-08-10 11:00 214528 -c--a-w c:\windows\system32\dllcache\icwconn1.exe
2009-04-25 22:54 . 2004-08-10 11:00 20480 -c--a-w c:\windows\system32\dllcache\inetwiz.exe
2009-04-25 22:27 . 2006-03-30 10:03 22339 ----a-r c:\windows\SET12F.tmp
2009-04-25 22:27 . 2005-03-30 17:54 10559 ----a-r c:\windows\SET130.tmp
2009-04-25 22:27 . 2004-08-10 11:00 7334 -c--a-w c:\windows\system32\dllcache\wmerrenu.cat
2009-04-25 22:27 . 2004-08-10 11:00 13753 ----a-r c:\windows\SETEC.tmp
2009-04-25 22:27 . 2004-08-10 11:00 1086058 ----a-r c:\windows\SETE0.tmp
2009-04-25 22:27 . 2004-08-10 11:00 106147 ----a-r c:\windows\SETDD.tmp
2009-04-25 18:13 . 2009-04-25 18:13 -------- d-----w c:\windows\dell
2009-04-18 19:28 . 2009-03-26 19:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-04-18 19:11 . 2009-04-18 19:11 -------- d-----w c:\program files\Bonjour
2009-04-17 16:18 . 2009-04-17 16:18 -------- d-----w c:\program files\Common Files\Uninstall
2009-04-17 16:18 . 2009-04-17 16:18 -------- d-----w c:\program files\PAV
2009-04-17 01:58 . 2009-04-17 01:58 -------- d-----w c:\documents and settings\Trevor\Local Settings\Application Data\Apple Computer
2009-04-16 02:51 . 2008-05-03 11:55 2560 ----a-w c:\windows\system32\xpsp4res.dll
2009-03-29 20:01 . 2009-03-29 20:01 -------- d-----w c:\program files\Microsoft Silverlight
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 12:10 . 2008-01-27 20:46 -------- d-----w c:\program files\Windows Live Toolbar
2009-04-26 03:53 . 2005-08-16 10:38 34380 ----a-w c:\windows\system32\emptyregdb.dat
2009-04-26 03:53 . 2009-04-26 03:53 1663 ----a-w c:\windows\Inf\COME3.tmp
2009-04-26 03:41 . 2006-12-31 19:19 4128 ----a-w C:\INFCACHE.1
2009-04-26 01:36 . 2006-12-21 03:22 -------- d-----w c:\documents and settings\All Users\Application Data\Trend Micro
2009-04-26 01:20 . 2006-12-21 03:32 -------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2009-04-26 00:09 . 2007-02-05 20:24 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-26 00:09 . 2007-02-05 20:24 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-26 00:08 . 2007-02-05 17:33 -------- d-----w c:\program files\SBC Self Support Tool
2009-04-25 23:16 . 2008-01-27 20:44 -------- d-----w c:\program files\MSN Messenger
2009-04-25 23:16 . 2009-03-08 01:37 244 ---ha-w C:\sqmnoopt17.sqm
2009-04-25 23:16 . 2009-03-08 01:37 232 ---ha-w C:\sqmdata17.sqm
2009-04-25 22:51 . 2009-04-25 22:51 873 ----a-w c:\windows\Inf\COM386.tmp
2009-04-25 20:00 . 2009-02-17 20:37 -------- d-----w c:\program files\AntWar_at
2009-04-22 22:45 . 2009-03-07 21:32 172 ---ha-w C:\sqmnoopt16.sqm
2009-04-22 22:45 . 2009-03-07 21:32 172 ---ha-w C:\sqmdata16.sqm
2009-04-22 22:44 . 2009-03-03 00:27 268 ---ha-w C:\sqmdata15.sqm
2009-04-22 22:44 . 2009-03-03 00:27 244 ---ha-w C:\sqmnoopt15.sqm
2009-04-22 19:40 . 2009-03-02 22:40 268 ---ha-w C:\sqmdata14.sqm
2009-04-22 19:40 . 2009-03-02 22:40 244 ---ha-w C:\sqmnoopt14.sqm
2009-04-21 20:25 . 2009-03-02 22:34 268 ---ha-w C:\sqmdata13.sqm
2009-04-21 20:25 . 2009-03-02 22:34 244 ---ha-w C:\sqmnoopt13.sqm
2009-04-21 00:13 . 2009-02-28 17:45 268 ---ha-w C:\sqmdata12.sqm
2009-04-21 00:13 . 2009-02-28 17:45 244 ---ha-w C:\sqmnoopt12.sqm
2009-04-20 23:58 . 2009-02-28 16:52 268 ---ha-w C:\sqmdata11.sqm
2009-04-20 23:58 . 2009-02-28 16:52 244 ---ha-w C:\sqmnoopt11.sqm
2009-04-20 23:50 . 2009-02-26 04:13 268 ---ha-w C:\sqmdata10.sqm
2009-04-20 23:50 . 2009-02-26 04:13 244 ---ha-w C:\sqmnoopt10.sqm
2009-04-20 23:41 . 2009-02-25 01:08 268 ---ha-w C:\sqmdata09.sqm
2009-04-20 23:41 . 2009-02-25 01:08 244 ---ha-w C:\sqmnoopt09.sqm
2009-04-19 17:38 . 2009-02-24 01:39 268 ---ha-w C:\sqmdata08.sqm
2009-04-19 17:38 . 2009-02-24 01:39 244 ---ha-w C:\sqmnoopt08.sqm
2009-04-18 19:30 . 2009-02-23 23:11 268 ---ha-w C:\sqmdata07.sqm
2009-04-18 19:30 . 2009-02-23 23:11 244 ---ha-w C:\sqmnoopt07.sqm
2009-04-18 19:14 . 2008-09-16 00:04 -------- d-----w c:\program files\Safari
2009-04-18 17:52 . 2009-02-23 02:34 268 ---ha-w C:\sqmdata06.sqm
2009-04-18 17:52 . 2009-02-23 02:34 244 ---ha-w C:\sqmnoopt06.sqm
2009-04-17 22:42 . 2009-02-21 13:53 268 ---ha-w C:\sqmdata05.sqm
2009-04-17 22:42 . 2009-02-21 13:53 244 ---ha-w C:\sqmnoopt05.sqm
2009-04-17 16:26 . 2009-02-19 11:52 268 ---ha-w C:\sqmdata04.sqm
2009-04-17 16:26 . 2009-02-19 11:52 244 ---ha-w C:\sqmnoopt04.sqm
2009-04-17 03:02 . 2009-02-19 02:29 268 ---ha-w C:\sqmdata03.sqm
2009-04-17 03:02 . 2009-02-19 02:29 244 ---ha-w C:\sqmnoopt03.sqm
2009-04-15 18:17 . 2009-02-16 01:23 268 ---ha-w C:\sqmdata02.sqm
2009-04-15 18:17 . 2009-02-16 01:23 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-09 02:17 . 2009-02-14 23:29 268 ---ha-w C:\sqmdata01.sqm
2009-04-09 02:17 . 2009-02-14 23:29 244 ---ha-w C:\sqmnoopt01.sqm
2009-04-07 20:18 . 2008-01-27 20:51 268 ---ha-w C:\sqmdata00.sqm
2009-04-07 20:18 . 2008-01-27 20:51 244 ---ha-w C:\sqmnoopt00.sqm
2009-04-07 19:41 . 2009-03-08 16:39 268 ---ha-w C:\sqmdata19.sqm
2009-04-07 19:41 . 2009-03-08 16:39 244 ---ha-w C:\sqmnoopt19.sqm
2009-04-07 01:06 . 2009-03-08 15:41 268 ---ha-w C:\sqmdata18.sqm
2009-04-07 01:06 . 2009-03-08 15:41 244 ---ha-w C:\sqmnoopt18.sqm
2009-03-26 23:17 . 2007-03-18 17:33 1786 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-03-26 23:17 . 2007-01-03 14:19 -------- d-----w c:\documents and settings\Janet Frye\Application Data\Corel
2009-03-26 19:23 . 2007-12-25 14:21 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-20 19:24 . 2009-03-13 00:29 -------- d-----w c:\documents and settings\Janet Frye\Application Data\Move Networks
2009-03-02 01:00 . 2008-11-13 00:18 34 ----a-w c:\documents and settings\Janet Frye\jagex_runescape_preferences.dat
2008-09-15 22:58 . 2006-12-21 03:46 93288 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-01-02 16:50 . 2008-01-02 16:50 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2006-12-31 18:15 . 2006-12-31 17:14 133 ----a-w c:\documents and settings\Janet Frye\Local Settings\Application Data\fusioncache.dat
2006-12-21 03:46 . 2008-01-21 16:26 70568 ----a-w c:\documents and settings\Kyle\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-12-21 03:46 . 2008-01-21 16:18 70568 ----a-w c:\documents and settings\Trevor\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-12-21 03:46 . 2006-12-31 17:14 70568 ----a-w c:\documents and settings\Janet Frye\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-12-21 03:46 . 2006-12-31 17:14 70568 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-11-16 17:12 . 2007-01-15 17:12 32 ----a-r c:\documents and settings\All Users\hash.dat
2005-08-17 02:52 . 2008-01-21 16:26 136 ----a-w c:\documents and settings\Kyle\Local Settings\Application Data\fusioncache.dat
2005-08-17 02:52 . 2008-01-21 16:18 136 ----a-w c:\documents and settings\Trevor\Local Settings\Application Data\fusioncache.dat
2005-08-17 02:52 . 2006-12-31 17:14 136 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Application Data\fusioncache.dat
2005-08-17 02:52 . 2005-08-17 02:52 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2002-07-26 22:02 . 2007-07-11 18:08 153088 ----a-w c:\program files\UNWISE.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk
backup=c:\windows\pss\Exif Launcher.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Janet Frye^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\documents and settings\Janet Frye\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-08-30 29744]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
2009-02-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2009-04-26 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 16:20]
.
- - - - ORPHANS REMOVED - - - -
BHO-{4AFC04A3-B551-4B68-9BEB-8677D90150D9} - c:\windows\system32\wincontrol.dll
.
------- Supplementary Scan -------
.
uStart Page = hxxp://att.my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspxIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-04-26 09:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1241513954-2828669199-4241389553-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,27,fe,ff,64,28,
e1,63,cf,c8,28,51,af,b0,29,a3,98,42,10,56,5d,c2,7d,b5,ce,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,b7,2c,d8,b4,34,
86,66,78,71,3b,04,66,8b,46,0d,96,6b,87,eb,48,ec,5a,ce,ce,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,9e,62,0c,ba,20,
ee,d4,d1,25,da,ec,7e,55,20,c9,26,88,2e,d2,24,0c,76,4d,b4,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,86,c8,d2,9d,fd,
33,27,e7,3e,1e,9e,e0,57,5a,93,61,92,c2,b0,41,ce,2c,98,b8,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,ac,dd,0d,a0,ed,
76,ee,78,cd,44,cd,b9,a6,33,6c,cd,cd,66,bf,f6,11,f1,a4,8a,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,3b,17,b5,9b,65,
26,d9,91,b0,18,ed,a7,3f,8d,37,a4,80,fc,94,6c,a0,f7,be,7a,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,57,f1,31,f4,3d,
d8,6d,82,31,77,e1,ba,b1,f8,68,02,a3,84,e2,fa,14,e2,f5,26,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,73,7f,1a,05,b0,
f4,72,79,83,6c,56,8b,a0,85,96,ab,86,d2,01,c1,44,5f,3c,90,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,44,72,2d,18,11,
9c,6e,37,51,fa,6e,91,28,9e,14,cc,d0,ce,cb,cc,b1,d5,f6,88,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,72,98,b4,bd,2b,
53,95,76,b1,cd,45,5a,a8,c4,f8,b9,90,7a,84,11,4e,8b,15,5f,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,fb,f2,a6,4e,49,
56,71,a5,e3,0e,66,d5,eb,bc,2f,6b,e4,28,b4,09,10,b9,58,eb,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,1d,8f,5c,f2,30,
8b,b3,f9,fa,ea,66,7f,d4,3b,6b,70,6f,93,78,82,8f,1c,ad,a6,6c,43,2d,1e,aa,22,\
[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\
0* 2*]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"
[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\*& 2*]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"
[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\*& ]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(1072)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\ehome\ehSched.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2009-04-26 9:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-26 13:32
Pre-Run: 86,817,038,336 bytes free
Post-Run: 88,891,490,304 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
338 --- E O F --- 2009-04-16 14:58
