Hello DragonMaster Jay:
Thanks for the reply and help....
. it took me while. The infection is crippling......
it changes IE settings to proxy and keeps giving me all kinds of problems....any how ran combofix. it finished all stages and was deleting some files and backing up others when the OS gave me the blue screen of deth. I booted in safe mode and ran CF again this time it finished. here is the log file....
ComboFix 10-04-21.01 - Ardy 04/23/2010 21:23:23.2.2 - x86 MINIMAL
Running from: c:\users\Ardy\Desktop\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\$recycle.bin\S-1-5-21-1361614194-4143690539-4151942459-1002
c:\$recycle.bin\S-1-5-21-1361614194-4143690539-4151942459-500
c:\$recycle.bin\S-1-5-21-2826133206-2312993737-4083541239-500
c:\$recycle.bin\S-1-5-21-918056312-2952985149-2686913973-500
C:\Images
c:\users\Ardy\AppData\Roaming\xolehlpy.dll
c:\windows\system32\win.ini
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
.
((((((((((((((((((((((((( Files Created from 2010-03-24 to 2010-04-24 )))))))))))))))))))))))))))))))
.
2010-04-24 04:30 . 2010-04-24 04:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-24 04:22 . 2010-04-24 04:22 -------- d-----w- C:\32788R22FWJFW
2010-04-24 02:53 . 2010-04-24 02:53 -------- d-----w- c:\users\Ardy\AppData\Local\ktrfptpku
2010-04-23 17:01 . 2010-04-23 17:33 -------- d-----w- c:\temp\virus-tools
2010-04-23 14:55 . 2010-04-23 14:55 61184 ----a-w- c:\users\Ardy\AppData\Local\syssvc.exe
2010-04-23 14:53 . 2010-04-23 14:53 -------- d-----w- c:\users\Ardy\AppData\Local\inngnjoss
2010-04-22 14:41 . 2010-04-23 02:07 -------- d-----w- c:\users\Ardy\AppData\Local\ewkjldovf
2010-04-22 14:25 . 2010-04-22 14:28 -------- d-----w- c:\temp\AllwaysSync
2010-04-22 02:31 . 2010-04-22 02:31 -------- d-----w- c:\temp\TFTP-Program
2010-04-16 01:17 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-16 01:17 . 2010-02-27 07:32 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-16 01:17 . 2010-02-27 07:32 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-16 01:17 . 2010-02-27 07:32 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-16 01:17 . 2010-02-27 12:07 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-16 01:17 . 2010-02-27 12:07 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-04-16 01:17 . 2010-03-08 21:33 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-04-16 01:17 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 21:26 . 2010-04-21 18:01 193872 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\lib7zip.dll
2010-04-13 21:26 . 2010-04-21 18:01 1000784 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\lgpl.dll
2010-04-11 05:37 . 2010-04-11 05:38 -------- d-----w- c:\programdata\SSScanAppDataDir
2010-04-11 05:37 . 2010-04-11 05:37 -------- d-----w- c:\programdata\MSScanAppDataDir
2010-04-10 16:36 . 2010-04-10 16:36 -------- d-----w- c:\program files\Common Files\AnswerWorks 5.0
2010-04-10 16:32 . 2010-04-10 16:32 -------- d-----w- c:\users\Ardy\AppData\Local\IsolatedStorage
2010-04-10 16:26 . 2010-04-10 16:26 -------- d-----w- c:\program files\TurboTax
2010-04-10 16:10 . 2010-02-23 07:56 977920 ----a-w- c:\windows\system32\wininet.dll
2010-04-07 23:30 . 2010-04-07 23:30 -------- d-----w- c:\users\Ardy\.jagex_cache_32
2010-04-03 15:33 . 2010-04-03 15:33 -------- d-----w- c:\program files\FileZilla FTP Client
2010-04-03 15:22 . 2010-04-06 17:18 -------- d-----w- c:\temp\TomCat_6.0.26
2010-04-03 14:54 . 2010-04-03 15:33 -------- d-----w- c:\temp\Filzilla-Ftp
2010-04-02 16:37 . 2010-04-02 16:37 0 ----a-w- c:\users\Ardy\jagex__preferences3.dat
2010-03-30 15:49 . 2010-03-30 15:49 17632 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\WSCUpdate.dll
2010-03-29 01:52 . 2010-04-22 03:21 1366 ----a-w- c:\users\Ardy\SDM-2.5-877W-c870-advipservicesk9-mz.124-15.T12.bin
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-24 03:10 . 2008-11-19 05:08 -------- d-----w- c:\programdata\Google Updater
2010-04-23 19:53 . 2008-04-15 06:01 -------- d-----w- c:\users\Ardy\AppData\Roaming\ESRI
2010-04-22 15:33 . 2009-11-11 19:34 -------- d-----w- c:\program files\Allway Sync
2010-04-21 05:42 . 2010-03-17 00:50 -------- d-----w- c:\users\Ardy\AppData\Roaming\Skype
2010-04-21 00:51 . 2009-01-22 02:39 -------- d-----w- c:\users\Ardy\AppData\Roaming\skypePM
2010-04-16 02:24 . 2010-01-16 19:08 -------- d-----w- c:\programdata\WebEx
2010-04-16 02:07 . 2010-01-21 02:55 -------- d-----w- c:\users\Ardy\AppData\Roaming\webex
2010-04-16 02:07 . 2010-01-21 02:55 2211840 ----a-w- c:\programdata\WebEx\WebEx\924\atpdmod.dll
2010-04-16 02:07 . 2010-01-21 02:55 98304 ----a-w- c:\programdata\WebEx\WebEx\924\atplayim.dll
2010-04-16 02:07 . 2010-01-21 02:55 364544 ----a-w- c:\programdata\WebEx\WebEx\924\atarm.dll
2010-04-16 02:07 . 2010-01-21 02:55 53248 ----a-w- c:\programdata\WebEx\WebEx\924\atcarmcl.dll
2010-04-16 02:07 . 2010-01-21 02:55 24576 ----a-w- c:\programdata\WebEx\WebEx\924\atmemmgr.dll
2010-04-16 01:23 . 2007-11-12 02:34 -------- d-----w- c:\programdata\Microsoft Help
2010-04-12 14:34 . 2010-03-24 16:17 3757392 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\vcore.dll
2010-04-12 14:34 . 2010-03-24 16:17 259408 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\remediation.dll
2010-04-12 14:33 . 2010-03-24 16:17 226640 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libZip.dll
2010-04-12 14:33 . 2010-03-24 16:17 390480 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libVvs.dll
2010-04-12 14:33 . 2010-03-24 16:17 173392 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libtd.dll
2010-04-12 14:33 . 2010-03-24 16:17 296272 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libRar.dll
2010-04-12 14:33 . 2010-03-24 16:17 345424 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libOleA.dll
2010-04-12 14:33 . 2010-03-24 16:17 206160 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libNSIS.dll
2010-04-12 14:33 . 2010-03-24 16:17 177488 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libMsi.dll
2010-04-12 14:33 . 2010-03-24 16:17 283984 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libEmail.dll
2010-04-12 14:33 . 2010-03-24 16:17 206160 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\libCHM.dll
2010-04-10 16:37 . 2010-02-16 02:44 147784 ----a-w- c:\users\Ardy\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-10 16:36 . 2008-08-08 06:12 -------- d-----w- c:\users\Ardy\AppData\Roaming\Intuit
2010-04-10 16:33 . 2008-08-08 05:51 -------- d-----w- c:\programdata\Intuit
2010-04-10 16:32 . 2008-08-08 03:21 -------- d-----w- c:\program files\Common Files\Intuit
2010-04-09 17:50 . 2009-10-07 21:15 -------- d-----w- c:\users\Ardy\AppData\Roaming\FileZilla
2010-04-08 01:16 . 2009-08-07 21:12 41 ----a-w- c:\users\Ardy\jagex_runescape_preferences.dat
2010-04-08 01:00 . 2009-09-07 14:25 69 ----a-w- c:\users\Ardy\jagex_runescape_preferences2.dat
2010-04-06 14:11 . 2009-12-20 16:42 966104 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-04-06 14:11 . 2009-12-20 16:38 1265264 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-04-01 03:54 . 2008-09-27 22:43 -------- d-----w- c:\program files\AirPort
2010-03-22 22:37 . 2010-03-22 22:37 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2010-03-18 03:22 . 2010-01-20 05:37 1662 ----a-w- c:\users\Ardy\SDM-2.5-877W-c870-advipservicesk9-mz.124-2.T5.bin
2010-03-17 00:50 . 2010-03-17 00:49 -------- d-----r- c:\program files\Skype
2010-03-17 00:49 . 2010-03-17 00:49 -------- d-----w- c:\program files\Common Files\Skype
2010-03-17 00:49 . 2009-01-22 02:37 -------- d-----w- c:\programdata\Skype
2010-03-13 01:24 . 2010-03-24 16:17 83280 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Defs\Extended\kbu.dll
2010-03-09 00:15 . 2008-11-21 05:51 -------- d-----w- c:\program files\RegCure
2010-03-08 04:12 . 2010-03-08 04:12 95024 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2010-03-08 04:12 . 2009-10-27 17:27 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-08 04:12 . 2010-03-08 04:12 566608 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\sbap.dll
2010-03-08 04:12 . 2009-12-21 01:21 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-03-08 04:12 . 2009-12-20 16:47 15880 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-08 04:12 . 2010-01-27 22:47 1230160 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\SBTE.dll
2010-03-08 04:12 . 2010-01-27 22:47 247120 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\SBRE.dll
2010-03-08 04:11 . 2009-12-20 16:42 6330848 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-08 04:11 . 2010-03-08 04:11 17480 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\EmailScannerBridge.dll
2010-03-08 04:10 . 2010-03-08 04:10 735008 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2010-03-08 04:10 . 2009-12-21 16:50 2270720 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\ToolBox\LT\HostFileEditor.exe
2010-03-08 04:10 . 2010-03-08 04:12 69936 ----a-w- c:\windows\system32\drivers\sbapifs.sys
2010-03-08 04:10 . 2010-03-08 04:10 77616 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Drivers\i386\sbapifsl.sys
2010-03-08 04:10 . 2010-03-08 04:10 69936 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Drivers\i386\sbapifs.sys
2010-03-08 04:10 . 2010-03-08 04:10 13360 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Drivers\i386\sbaphd.sys
2010-03-08 04:10 . 2009-12-21 16:49 2038272 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\ToolBox\LT\ProcessWatch.exe
2010-03-08 04:10 . 2009-12-21 16:49 104960 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\ToolBox\AutoStart Manager\SO.dll
2010-03-03 22:54 . 2009-12-20 16:41 3803208 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-02-27 20:11 . 2010-02-27 20:11 -------- d-----w- c:\programdata\PC Drivers HeadQuarters
2010-02-25 22:16 . 2010-01-16 19:08 743224 ----a-w- c:\programdata\WebEx\WebEx\932\atsccust.dll
2010-02-25 22:16 . 2010-01-16 19:08 356352 ----a-w- c:\programdata\WebEx\WebEx\932\sccustres.dll
2010-02-25 22:16 . 2010-01-16 19:08 53248 ----a-w- c:\programdata\WebEx\WebEx\932\atcarmcl.dll
2010-02-25 22:16 . 2010-01-16 19:08 364544 ----a-w- c:\programdata\WebEx\WebEx\932\atarm.dll
2010-02-25 22:16 . 2010-01-16 19:08 24576 ----a-w- c:\programdata\WebEx\WebEx\932\atmemmgr.dll
2010-02-22 03:40 . 2010-02-22 03:41 720896 ----a-w- c:\windows\iun6002.exe
2010-02-15 23:09 . 2010-02-15 23:09 21316 ----a-w- c:\windows\system32\emptyregdb.dat
2010-02-15 19:54 . 2007-07-27 09:06 4268 ----a-w- c:\windows\bthservsdp.dat
2010-02-02 17:02 . 2010-01-27 22:48 348160 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\msvcr71.dll
2010-02-02 17:02 . 2010-01-27 22:48 503808 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\msvcp71.dll
2010-02-02 07:45 . 2010-02-27 15:23 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-27 22:49 . 2009-12-20 16:46 8 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2007-07-27 09:18 . 2007-07-27 09:18 76 --sha-r- c:\windows\CT4CET.bin
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2007-11-11 05:03 . 2007-11-11 05:03 8 --sha-r- c:\windows\System32\84463728C9.sys
2007-11-12 02:30 . 2007-11-11 05:03 2672 --sha-w- c:\windows\System32\KGyGaAvL.sys
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-27 3883856]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-19 39408]
"TomTomHOME.exe"="c:\program files\TomTom HOME\TomTomHOMERunner.exe" [2009-11-13 247144]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2009-07-14 65024]
"Allway Sync"="c:\program files\Allway Sync\Bin\syncappw.exe" [2010-03-23 102168]
"qrwaffgj"="c:\users\Ardy\AppData\Local\inngnjoss\vfuxnrxtssd.exe" [2010-04-23 272640]
"ygwsslvv"="c:\users\Ardy\AppData\Local\ktrfptpku\dcowjmatssd.exe" [2010-04-24 272640]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-07-02 159744]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-06-27 405504]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-10 36864]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-12 101136]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-12-08 3444736]
"EC Software TNT"="c:\program files\TNT\tnt.exe" [2004-04-05 4051456]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13793824]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2009-08-19 92704]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-09-21 184320]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"SMART Board Service"="c:\program files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe" [2007-11-02 1283336]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2008-06-29 52168]
"WinSSHD Activation State Checker"="c:\program files\Bitvise WinSSHD\WinsshdActStateCheck.exe" [2009-12-02 216832]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2009-11-11 771360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-7-27 50688]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-2-22 1193240]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-11-11 02:26 2356088 ----a-w- c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
R2 ArcGIS License Manager;ArcGIS License Manager;c:\program files\ESRI\License\arcgis9x\lmgrd.exe [2008-08-02 1431440]
R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2010-01-16 43920]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-13 133104]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-04-06 1265264]
R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys [2010-03-08 69936]
R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2008-07-11 328992]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME\TomTomHOMEService.exe [2009-11-13 92008]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2006-10-20 37296]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
R3 Ser2rs;Radioshack USB to Serial Driver;c:\windows\system32\DRIVERS\ser2rs.sys [2007-06-25 76288]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-02-27 1343400]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-09-23 64288]
S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2010-03-08 95024]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder
2010-04-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-19 02:10]
2010-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-13 05:05]
2010-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-13 05:05]
2010-04-24 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 19:25]
2010-04-18 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 19:25]
2010-04-24 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2010-02-23 23:20]
2010-04-24 c:\windows\Tasks\RegCure Startup.job
- c:\program files\RegCure\RegCure.exe [2010-02-23 23:20]
2010-04-24 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2010-02-23 23:20]
2010-04-24 c:\windows\Tasks\User_Feed_Synchronization-{1D769DAF-DFF1-46DC-B064-2A61CE487549}.job
- c:\windows\system32\msfeedssync.exe [2009-07-13 01:14]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.pesare-darya.com/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Trusted Zone: intuit.com\ttlc
DPF: {6F0C8A8F-8B0D-11D2-801B-00105AA78F4A} - hxxp://ecare4a.netopia.com/techsupport/ecare4/components/CobAgent_4.2.1.319.cab
.
- - - - ORPHANS REMOVED - - - -
Toolbar-{a298ed31-d405-40e2-880f-b7511948e582} - (no file)
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
HKLM-RunOnce-<NO NAME> - (no file)
AddRemove-AnswerWorks - c:\program files\WexTech\AnswerWorks\Uninst.isu
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2010-04-23 21:32:34
ComboFix-quarantined-files.txt 2010-04-24 04:32
Pre-Run: 77,355,212,800 bytes free
Post-Run: 77,202,366,464 bytes free
- - End Of File - - 472B97925779E27AA20601FAAC0EFB90