ComboFix 11-11-30.03 - Jeremy 11/30/2011 18:58:10.4.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1307 [GMT -6:00] Running from: c:\documents and settings\Jeremy\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\All Users\Application Data\TEMP c:\documents and settings\All Users\SPL8F9.tmp c:\documents and settings\Jeremy\314_gotomypc.exe c:\documents and settings\Jeremy\Application Data\Adobe\rehhoum.exe c:\documents and settings\Jeremy\Application Data\Google\T-Scan c:\documents and settings\Jeremy\WINDOWS c:\windows\jestertb.dll c:\windows\system32\ndisapi.dll c:\windows\system32\usmt\migwiz_a.exe . . ((((((((((((((((((((((((( Files Created from 2011-11-01 to 2011-12-01 ))))))))))))))))))))))))))))))) . . 2011-11-18 12:53 . 2011-11-18 12:56 -------- d-----w- c:\documents and settings\Jeremy\Application Data\Download Manager 2011-11-18 04:12 . 2011-11-23 11:07 -------- d-----w- c:\documents and settings\Jeremy\Application Data\MioNet 2011-11-18 04:11 . 2011-11-18 04:11 -------- d-----w- c:\documents and settings\Jeremy\Local Settings\Application Data\MioNet 2011-11-18 04:11 . 2011-12-01 00:53 -------- d-----w- c:\program files\MioNet . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-18 04:22 . 2011-05-21 19:11 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-10-23 20:30 . 2011-10-23 20:30 290 ----a-w- C:\cc_20111023_153054.reg 2011-10-23 20:30 . 2011-10-23 20:30 1094 ----a-w- C:\cc_20111023_153036.reg 2011-10-23 20:30 . 2011-10-23 20:29 2408 ----a-w- C:\cc_20111023_152957.reg 2011-10-23 20:29 . 2011-10-23 20:29 227832 ----a-w- C:\cc_20111023_152922.reg 2011-10-10 14:22 . 2004-08-10 10:00 692736 ----a-w- c:\windows\system32\inetcomm.dll 2011-09-28 07:06 . 2004-08-10 10:00 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-26 16:41 . 2008-07-30 00:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll 2011-09-26 16:41 . 2004-08-10 10:00 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 16:41 . 2004-08-10 10:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-24 21:26 . 2008-02-20 12:57 18816 ----a-w- c:\windows\system32\drivers\dvd43llh.sys 2011-09-06 13:20 . 2004-08-10 10:00 1858944 ----a-w- c:\windows\system32\win32k.sys 2005-09-28 11:58 . 2005-09-28 11:58 774144 ----a-w- c:\program files\RngInterstitial.dll 2011-11-09 03:29 . 2011-09-22 02:14 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}] 2011-10-21 09:10 87440 ----a-w- c:\program files\adawaretb\adawareDx.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files\adawaretb\adawareDx.dll" [2011-10-21 87440] . [HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Jeremy\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Jeremy\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Jeremy\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Jeremy\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360] "MusicManager"="c:\documents and settings\Jeremy\Local Settings\Application Data\Programs\Google\MusicManager\MusicManager.exe" [2011-11-12 13222400] "415674D557931331CFF40242CAA6B9F9B4CFB0A1._service_run"="c:\documents and settings\Jeremy\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" [2011-11-15 1036344] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-13 328568] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 135168] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592] "SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 81920] "Samsung Common SM"="c:\windows\Samsung\ComSMMgr\ssmmgr.exe" [2005-07-03 372736] "medicsp2"="c:\program files\twc\medicsp2\bin\sprtcmd.exe" [2007-03-07 198184] "lxcymon.exe"="c:\program files\Lexmark 3400 Series\lxcymon.exe" [2007-06-25 291504] "EzPrint"="c:\program files\Lexmark 3400 Series\ezprint.exe" [2007-06-25 82608] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941] "LXCYCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll" [2006-11-21 106496] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-12-15 5513216] "AmazonGSDownloaderTray"="c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-09-10 2338656] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064] "MioNet"="c:\program files\MioNet\MioNetLauncher.exe" [2010-02-09 32768] "Ad-Aware Browsing Protection"="c:\documents and settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe" [2011-10-21 198032] . c:\documents and settings\Jeremy\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Jeremy\Application Data\Dropbox\bin\Dropbox.exe [2011-5-25 24176560] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-7-8 113664] iTunes.lnk - c:\program files\iTunes\iTunes.exe [2011-6-7 9776936] SpywareBlaster.lnk - c:\program files\SpywareBlaster\spywareblaster.exe [2009-4-13 1385192] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^dlbcserv.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\dlbcserv.lnk backup=c:\windows\pss\dlbcserv.lnkCommon Startup . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk backup=c:\windows\pss\HotSync Manager.lnkCommon Startup . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk backup=c:\windows\pss\Office Startup.lnkCommon Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter] 2009-05-21 15:55 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate] 2007-11-15 15:24 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43] 2009-10-24 00:34 827904 ----a-w- c:\program files\dvd43\DVD43_Tray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer] 2007-06-25 14:35 295600 ----a-w- c:\program files\Lexmark Fax Solutions\fm3032.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM] 2003-09-04 01:12 221184 ----a-w- c:\program files\Intel\Modem Event Monitor\IntelMEM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-06-03 02:44 1660952 ----a-w- c:\progra~1\MESSEN~1\Msmsgs.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck] 2003-12-04 17:34 406016 ----a-w- c:\windows\SYSTEM32\PSDrvCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2010-09-13 02:29 328568 ----a-w- c:\program files\uTorrent\uTorrent.exe . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\MioNet\\jvm\\bin\\MioNet.exe"= "c:\\Program Files\\Messenger\\Msmsgs.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"= "c:\\Program Files\\Lexmark 3400 Series\\lxcyaiox.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Documents and Settings\\Jeremy\\Application Data\\Dropbox\\bin\\Dropbox.exe"= "c:\\Program Files\\MioNet\\MioNetManager.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"= "c:\\Documents and Settings\\Jeremy\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Documents and Settings\\Jeremy\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= "c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Spotify\\spotify.exe"= "c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"= "c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\adawaretb\\dtUser.exe"= "c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1700:TCP"= 1700:TCP:MioNet Remote Drive Access 0 "1701:TCP"= 1701:TCP:MioNet Remote Drive Access 1 "1702:TCP"= 1702:TCP:MioNet Remote Drive Access 2 "1703:TCP"= 1703:TCP:MioNet Remote Drive Access 3 "1704:TCP"= 1704:TCP:MioNet Remote Drive Access 4 "1705:TCP"= 1705:TCP:MioNet Remote Drive Access 5 "1706:TCP"= 1706:TCP:MioNet Remote Drive Access 6 "1707:TCP"= 1707:TCP:MioNet Remote Drive Access 7 "1708:TCP"= 1708:TCP:MioNet Remote Drive Access 8 "1709:TCP"= 1709:TCP:MioNet Remote Drive Access 9 "1641:TCP"= 1641:TCP:MioNet Remote Drive Verification "1647:TCP"= 1647:TCP:MioNet Storage Device Configuration "5432:UDP"= 5432:UDP:MioNet Storage Device Discovery . R0 AVGIDSEH;AVGIDSEH;c:\windows\SYSTEM32\DRIVERS\AVGIDSEH.sys [9/13/2010 3:27 PM 22992] R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [11/29/2011 12:55 PM 64512] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [1/7/2011 5:41 AM 248656] R1 Avgtdix;AVG TDI Driver;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [9/7/2010 2:49 AM 297168] R1 MemAlloc;MemAlloc;c:\windows\SYSTEM32\DRIVERS\MemAlloc.sys [8/20/2006 4:28 PM 5543] R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 4:33 AM 269520] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [11/3/2011 12:06 PM 2152152] R2 lxcy_device;lxcy_device;c:\windows\system32\lxcycoms.exe -service --> c:\windows\system32\lxcycoms.exe -service [?] R2 SBKUPNT;SBKUPNT;c:\windows\SYSTEM32\DRIVERS\SBKUPNT.SYS [10/1/2011 1:39 PM 14976] R2 sprtsvc_medicsp2;SupportSoft Sprocket Service (medicsp2);c:\program files\twc\medicsp2\bin\sprtsvc.exe [8/6/2007 5:48 AM 202280] R3 atinewp2;ATI eHomeWonder, WDM Video CODEC;c:\windows\SYSTEM32\DRIVERS\atinewp2.sys [12/31/1979 11:00 PM 485888] S1 LStone;Pinnacle Systems Studio AV/DV Overlay;c:\windows\system32\DRIVERS\lstone2k.sys --> c:\windows\system32\DRIVERS\lstone2k.sys [?] S2 gupdate1c98eb48ce81fd0;Google Update Service (gupdate1c98eb48ce81fd0);c:\program files\Google\Update\GoogleUpdate.exe [2/14/2009 8:57 AM 133104] S2 MioNet;MioNet;c:\program files\MioNet\MioNetManager.exe [2/9/2010 5:17 PM 139264] S3 Amazon Download Agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [5/21/2010 4:29 PM 401920] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/14/2009 8:57 AM 133104] S3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys --> c:\windows\system32\Drivers\ANDROIDUSB.sys [?] S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [11/3/2011 12:06 PM 15232] S4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys --> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?] S4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys --> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?] S4 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys --> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?] S4 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys --> c:\windows\system32\DRIVERS\avgrkx86.sys [?] . --- Other Services/Drivers In Memory --- . *NewlyCreated* - AVGLDX86 *Deregistered* - NDISRD . Contents of the 'Scheduled Tasks' folder . 2011-12-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-11-03 18:06] . 2011-11-28 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 20:42] . 2011-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-14 14:56] . 2011-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-14 14:56] . 2011-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1012130832-1747327062-4042544087-1005Core.job - c:\documents and settings\Jeremy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-07 02:49] . 2011-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1012130832-1747327062-4042544087-1005UA.job - c:\documents and settings\Jeremy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-07 02:49] . 2005-05-19 c:\windows\Tasks\ISP signup reminder 1.job - c:\windows\system32\OOBE\OOBEBALN.EXE [2004-08-10 00:12] . 2011-09-22 c:\windows\Tasks\User_Feed_Synchronization-{7BC8A429-C278-4F9B-A45C-D5DB4ADB9329}.job - c:\windows\system32\msfeedssync.exe [2007-08-14 09:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com uDefault_Search_URL = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mWindow Title = Microsoft Internet Explorer provided by Comcast uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Download All using 4shared Desktop - c:\program files\4shared Desktop\down_all.htm IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html TCP: DhcpNameServer = 209.18.47.61 209.18.47.62 DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} - hxxp://www.ritzpix.com/net/Uploader/LPUploader45.cab FF - ProfilePath - c:\documents and settings\Jeremy\Application Data\Mozilla\Firefox\Profiles\kcw5roxt.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ . Supplementary scan did not complete! . - - - - ORPHANS REMOVED - - - - . Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) HKU-Default-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe SafeBoot-AVG Anti-Spyware Driver SafeBoot-AVG Anti-Spyware Guard MSConfigStartUp-DellSupport - c:\program files\DellSupport\DSAgnt.exe MSConfigStartUp-TkBellExe - c:\program files\Real\RealPlayer\update\realsched.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-11-30 19:11 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCYCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1012130832-1747327062-4042544087-1005\Software\SecuROM\License information*] "datasecu"=hex:81,28,e1,71,16,f1,74,e7,1a,7f,b2,d0,69,e4,d1,f8,c9,e6,c9,bb,22, 20,dc,33,95,14,08,e3,26,86,23,3e,10,5d,3d,af,2b,7c,fb,3b,d4,a5,e6,c0,0a,d4,\ "rkeysecu"=hex:60,82,6a,ba,de,a5,6d,b1,3f,f8,51,a3,c8,79,b4,0c . Completion time: 2011-11-30 19:19:19 ComboFix-quarantined-files.txt 2008-12-07 12:49 ComboFix2.txt 2008-12-06 18:14 . Pre-Run: 66,591,920,128 bytes free Post-Run: 66,801,950,720 bytes free . - - End Of File - - DA2BF131F0E10822C4C91D51864B045E