I was asked to clean a freinds computer of this Trojan and found that they had clicked on a Rogue Anti-virus Program and infected themself. It installed Personal Antivirus. the first thing that I did was to try to uninstall the Program but it would not uninstall. I was able to delete the Program for C:\Programs files and deleted the folder, I then tried to run malwarebytes and it would not run so I started looking at forums. I also tried several different malware removers but none would run. so I came across several of your posts. So I download the Combofix software and renamed it and it ran on the computer and here is the log. can you help me to finish cleaning this machine or is this machine clean.
ComboFix 09-11-05.05 - Dale Moses 11/06/2009 12:28.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.482 [GMT -6:00]
Running from: c:\documents and settings\Administrator\Desktop\ABCD.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Starware408
c:\documents and settings\All Users\Application Data\Starware408\buttons\1223_button_1b_def.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\1223_button_1b_over.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\1229_button_1b_def.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\1229_button_1b_over.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\Button_50.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\Button_60.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\Button_70.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\FindIt.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\FindItHot.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\findithotxp.png
c:\documents and settings\All Users\Application Data\Starware408\buttons\finditxp.png
c:\documents and settings\All Users\Application Data\Starware408\buttons\logo.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\logoxp.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\Weather.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\WeatherHot.bmp
c:\documents and settings\All Users\Application Data\Starware408\buttons\weatherhotxp.png
c:\documents and settings\All Users\Application Data\Starware408\buttons\weatherxp.png
c:\documents and settings\All Users\Application Data\Starware408\contexts\error.xml
c:\documents and settings\All Users\Application Data\Starware408\contexts\Related.xml
c:\documents and settings\All Users\Application Data\Starware408\contexts\Travel.xml
c:\documents and settings\All Users\Application Data\Starware408\images\clear.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\cloudy.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\foggy.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\frain.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\haze.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\mcloud.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\na.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\nclear.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\ncloudy.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\nfoggy.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\nmcloud.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\nna.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\noicon.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\npcloud.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\nrain.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\pcloud.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\rain.bmp
c:\documents and settings\All Users\Application Data\Starware408\images\walertXP.bmp
c:\documents and settings\All Users\Application Data\Starware408\SimpleUpdate\ProductMessagingConfig.xml
c:\documents and settings\All Users\Application Data\Starware408\SimpleUpdate\ProductMessagingConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware408\SimpleUpdate\SimpleUpdateConfig.xml
c:\documents and settings\All Users\Application Data\Starware408\SimpleUpdate\SimpleUpdateConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware408\SimpleUpdate\TimerManagerConfig.xml
c:\documents and settings\All Users\Application Data\Starware408\SimpleUpdate\TimerManagerConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware408\Tem10.tmp
c:\documents and settings\Dale Moses\Application Data\Starware408
c:\documents and settings\Dale Moses\Application Data\Starware408\Button_5\Button_5Options.xml
c:\documents and settings\Dale Moses\Application Data\Starware408\Button_5\Button_5Options.xml.backup
c:\documents and settings\Dale Moses\Application Data\Starware408\Button_6\Button_6Options.xml
c:\documents and settings\Dale Moses\Application Data\Starware408\Button_6\Button_6Options.xml.backup
c:\documents and settings\Dale Moses\Application Data\Starware408\Button_7\Button_7Options.xml
c:\documents and settings\Dale Moses\Application Data\Starware408\Button_7\Button_7Options.xml.backup
c:\documents and settings\Dale Moses\Application Data\Starware408\Video_Vault\Video_VaultOptions.xml
c:\documents and settings\Dale Moses\Application Data\Starware408\Video_Vault\Video_VaultOptions.xml.backup
c:\documents and settings\Dale Moses\Application Data\Starware408\Watch_Videos\Watch_VideosOptions.xml
c:\documents and settings\Dale Moses\Application Data\Starware408\Watch_Videos\Watch_VideosOptions.xml.backup
c:\program files\Starware408
c:\program files\Starware408\bin\Starware408.dll
c:\program files\Starware408\icons\star_16.ico
c:\recycler\S-1-5-21-1079113596-3371296759-2528311962-500
c:\recycler\S-1-5-21-1275210071-261478967-839522115-500
c:\recycler\S-1-5-21-179531828-2853224448-3628542644-500
c:\recycler\S-1-5-21-2192409820-2289054400-1157314694-500
c:\recycler\S-1-5-21-2724382250-2464719362-122087494-500
c:\recycler\S-1-5-21-3101147382-3012010417-1302004682-500
c:\windows\10116tzo539f.ocx
c:\windows\1059steal19z5.ocx
c:\windows\117ct9iez2155.cpl
c:\windows\12030v59uz24c.dll
c:\windows\12439tr5j71z.bin
c:\windows\1252zpambo935f.exe
c:\windows\12560worm1z95.dll
c:\windows\12689hackto5lza1.cpl
c:\windows\1290spa9boz51.exe
c:\windows\13179zp5mbot53e.cpl
c:\windows\13599pambotaaz.exe
c:\windows\13854hzckto9l7d8.ocx
c:\windows\13961hackt5ol9fez.exe
c:\windows\13z05spa5b9t774.bin
c:\windows\13z29spambot7f59.dll
c:\windows\146z95py1ec.ocx
c:\windows\148zviru59f4.cpl
c:\windows\14zbspars95765.ocx
c:\windows\150ead9ware1158z.bin
c:\windows\1514thzef7099.ocx
c:\windows\15296hacktzol661.dll
c:\windows\1539virz972.cpl
c:\windows\1561back9oor20z.bin
c:\windows\15846noz9a-viru57b8.bin
c:\windows\1590zpyw9re1095.cpl
c:\windows\15951worm35z9.cpl
c:\windows\1596395cktoolze9.exe
c:\windows\15z8ad9ware567.cpl
c:\windows\15z9sp9rse606.dll
c:\windows\162999ot-z-virus652.bin
c:\windows\16550not-a-virusz229.bin
c:\windows\16664spa9botza5.bin
c:\windows\1715nzt-a-v9rus49c.bin
c:\windows\17945spz675.dll
c:\windows\1795szeal525.ocx
c:\windows\1796zir8759.cpl
c:\windows\17z37spy965.exe
c:\windows\184529zrm259.bin
c:\windows\186349azk5ool225.bin
c:\windows\1869v5z1029.exe
c:\windows\188035pa9bot75z.exe
c:\windows\18866tz592b1.cpl
c:\windows\191319roj2a5z.exe
c:\windows\19206not-a-virzs543.bin
c:\windows\193759rojz5.cpl
c:\windows\1945not-a-virus4z4.bin
c:\windows\19599zorm295.bin
c:\windows\19699virus585z.cpl
c:\windows\19952troz7c2.exe
c:\windows\19955worm7a1z.cpl
c:\windows\19b1ad5ware2z4.ocx
c:\windows\19bcspz5se2670.cpl
c:\windows\19cf5ir30z5.ocx
c:\windows\19d9dowzl5ader2059.exe
c:\windows\1a07add5are9542z.dll
c:\windows\1a2zdo9nl5ader530.exe
c:\windows\1b28spywzr52592.bin
c:\windows\1b97b9ckdzor850.exe
c:\windows\1cecz9dware1534.bin
c:\windows\1cz8vi59339.cpl
c:\windows\1d9thi5f2109z.bin
c:\windows\1f5dsteal99z8.bin
c:\windows\1f8esza5s92628.dll
c:\windows\1z596troj5d15.dll
c:\windows\1z625spambot998.ocx
c:\windows\1z708s9y6875.dll
c:\windows\20daad5waze2931.dll
c:\windows\210489z5us477.bin
c:\windows\21049z5rm3a5.ocx
c:\windows\2158bzck9oor2118.cpl
c:\windows\2168059cktooz5ed.exe
c:\windows\217039ormaz5.ocx
c:\windows\21892zirus2e5.ocx
c:\windows\226995roz679.cpl
c:\windows\23457not-a-viruz295.cpl
c:\windows\24198hackt5olz98.bin
c:\windows\24292zpy1005.exe
c:\windows\24318not5a-vir9s1e3z.exe
c:\windows\250z7hac9tool205.exe
c:\windows\2551z9irusde.bin
c:\windows\2554zwo9m59f.exe
c:\windows\256015pazbot599.ocx
c:\windows\25768spy7zf9.ocx
c:\windows\25964wzr5344.ocx
c:\windows\2619ackdoo510z8.bin
c:\windows\265tzo945a.dll
c:\windows\26983nz59a-virus48f.exe
c:\windows\26bcst9alz52.bin
c:\windows\26z76h9ckt5ol18.dll
c:\windows\27122zot-a-9irus151.cpl
c:\windows\271485ot-a-vizus53b9.exe
c:\windows\271d5pywaze28129.ocx
c:\windows\272z6spy79c5.bin
c:\windows\2793zo5nloader3246.dll
c:\windows\28095h9cktzol3ed5.dll
c:\windows\282abackdoo51z709.bin
c:\windows\282ddownlo59zr2923.exe
c:\windows\28363hackto5z691.exe
c:\windows\28623s9azb5t5af.ocx
c:\windows\290255or926dz.exe
c:\windows\29250szy18e9.exe
c:\windows\292b9ownloade5z62.ocx
c:\windows\29590ha5kzool44.cpl
c:\windows\299509roz227.bin
c:\windows\29961hackt5ol391z.ocx
c:\windows\29982spy45z.bin
c:\windows\29bt5iez2280.dll
c:\windows\29z285ot-a-vir9s39f.dll
c:\windows\29z9spy557.dll
c:\windows\2ae1azdwar530779.bin
c:\windows\2az5s9arse1963.ocx
c:\windows\2d5a9hi5f297z.dll
c:\windows\2d6cstzal5469.exe
c:\windows\2e895iz3013.ocx
c:\windows\2e97t95eaz15376.exe
c:\windows\2fezad5ware909.ocx
c:\windows\2z02thief91825.ocx
c:\windows\2z7sp9r5e309.exe
c:\windows\2z93st5al1369.bin
c:\windows\2zf7addware9505.ocx
c:\windows\308935acztoo97b3.cpl
c:\windows\3108s5zmbot397.bin
c:\windows\31109troz585.bin
c:\windows\315859ief2242z.dll
c:\windows\31925virus2bz.exe
c:\windows\319z75acktool700.dll
c:\windows\321809acztoo5481.cpl
c:\windows\32222n9z-a-5irus6e4.bin
c:\windows\3224baczdoor9250.cpl
c:\windows\32399spz585.cpl
c:\windows\32554not-a9virus1z9.cpl
c:\windows\32683hacktzo925a.ocx
c:\windows\3285threat97979z.dll
c:\windows\336zd5wnloader95.exe
c:\windows\3372sp9wzr52508.ocx
c:\windows\3388t5ief90z9.cpl
c:\windows\33b5spa9sz2624.exe
c:\windows\3494zhie5359.exe
c:\windows\34a1tzre5t24095.bin
c:\windows\34z7stea52902.bin
c:\windows\3529zpy2e.cpl
c:\windows\356az9r1507.ocx
c:\windows\35709zacktool29a.bin
c:\windows\3589sparsz1905.cpl
c:\windows\35fethrzat5985.dll
c:\windows\3759backdoor91z3.ocx
c:\windows\37b5thizf1954.ocx
c:\windows\382d5d9waze2830.ocx
c:\windows\3916addwarz1251.bin
c:\windows\3953back9oo5z006.exe
c:\windows\3954zpyware5562.ocx
c:\windows\3959bazkd5or3230.cpl
c:\windows\395zspy4349.exe
c:\windows\39a1thief4z5.exe
c:\windows\39az5hief2260.exe
c:\windows\3becvzr9651.exe
c:\windows\3d2daddwa5ez2029.exe
c:\windows\3e9dszyw5re2490.cpl
c:\windows\3f54a9dwaze64.exe
c:\windows\3z49a5dware180.cpl
c:\windows\3z505hief27599.bin
c:\windows\3z59steal2997.bin
c:\windows\414fdoz9loa5er2397.dll
c:\windows\4156w9rm45ez.bin
c:\windows\419cs95wzre1595.bin
c:\windows\420not5a-vi9uz50f.cpl
c:\windows\43e2v9r558z.dll
c:\windows\4459threzt117.bin
c:\windows\446zv5r26529.dll
c:\windows\450hacktooz297.bin
c:\windows\451zthief15949.exe
c:\windows\4536downloader9047z.ocx
c:\windows\4568vir40z9.dll
c:\windows\459virz9685.ocx
c:\windows\4655spywaze1009.bin
c:\windows\471zaddwa5e790.bin
c:\windows\48acspa5sez159.cpl
c:\windows\48fdz592251.ocx
c:\windows\48z45acktool3d9.exe
c:\windows\491spyware5563z.dll
c:\windows\4935ha5kzool1ca.bin
c:\windows\4935zir1355.exe
c:\windows\4955h95ktool581z.exe
c:\windows\495zvir2654.ocx
c:\windows\4978spamzot1995.exe
c:\windows\498fbaczd95r1534.exe
c:\windows\49b8downloa9e5z095.bin
c:\windows\4e379aczdoor5855.bin
c:\windows\4e87threa52z8309.ocx
c:\windows\4ebzth59f1119.ocx
c:\windows\4ez55ackdoor1779.exe
c:\windows\4f99v5r39z.ocx
c:\windows\5095thzeat11632.ocx
c:\windows\50965hreat7950z.cpl
c:\windows\509a9zr3236.bin
c:\windows\50cbdowzl9ader275.bin
c:\windows\510caddwzr59087.bin
c:\windows\5142spz189.ocx
c:\windows\51559orm7z3.dll
c:\windows\516z9troj1ad.cpl
c:\windows\51925hreat26504z.cpl
c:\windows\52379virus1z9.exe
c:\windows\52591hacztool680.exe
c:\windows\52b5spazse1948.dll
c:\windows\52zdsp5rs9348.cpl
c:\windows\52zfa9dwa5e3089.ocx
c:\windows\5355spz39a.dll
c:\windows\538fbackdoor95z.bin
c:\windows\53941szambot31b.exe
c:\windows\53a6adzwar919425.cpl
c:\windows\54594not-a-virusz.exe
c:\windows\5499thzeat8793.dll
c:\windows\55110ha9ktooz2ba.cpl
c:\windows\5547worz9a9.dll
c:\windows\5551spy7zc9.exe
c:\windows\5590wor94zc.bin
c:\windows\55bzthi9f15145.ocx
c:\windows\55c5szyware2209.cpl
c:\windows\55d2z9reat4599.cpl
c:\windows\55ea9tzal2319.ocx
c:\windows\55z9threa921871.ocx
c:\windows\563139acztool4f6.cpl
c:\windows\56594nzt-a-virus49d.exe
c:\windows\568zhief729.exe
c:\windows\56970hacztool78b.dll
c:\windows\5752ba5kdo9rz630.ocx
c:\windows\578caddwarz759.dll
c:\windows\5791spz3f8.ocx
c:\windows\57d4zir1977.exe
c:\windows\5808z9cktool11c.ocx
c:\windows\58196not-z-virus5ab.bin
c:\windows\58z57worm95.exe
c:\windows\58z68virus908.ocx
c:\windows\58zvir999.bin
c:\windows\5945vir3189z.cpl
c:\windows\59cbspy9are57z0.exe
c:\windows\59zb59reat9964.cpl
c:\windows\5b16stea9z025.exe
c:\windows\5cdbspy95rez068.exe
c:\windows\5ceba9kdooz2007.ocx
c:\windows\5d44dow5l9ader2124z.cpl
c:\windows\5e0cdowzloader25999.ocx
c:\windows\5e6zthrea924121.exe
c:\windows\5ez7thief3195.exe
c:\windows\5fa85parse6z9.ocx
c:\windows\5z398hackto9l91.bin
c:\windows\5z799s9y494.ocx
c:\windows\5z84t5ief26529.cpl
c:\windows\5z88sparse1759.cpl
c:\windows\5z95vir2022.cpl
c:\windows\5zbbthre5t24179.bin
c:\windows\5zc59pyware2959.cpl
c:\windows\5zcspywa9e1969.ocx
c:\windows\5zf9vir1848.ocx
c:\windows\6073ad5ware3294z.exe
c:\windows\60e5spywa5e201z9.ocx
c:\windows\61195aczto9l3c3.dll
c:\windows\6134zp9mbot5e5.dll
c:\windows\6355szarse598.ocx
c:\windows\63a19ownloadz52494.cpl
c:\windows\641cdownloa9e53092z.bin
c:\windows\6519s9eaz447.ocx
c:\windows\6569thie52577z.bin
c:\windows\658caddzare14939.dll
c:\windows\6590zownloade5927.exe
c:\windows\6689adzware2585.bin
c:\windows\66e1bzc9door3095.cpl
c:\windows\68eca9dware55z.ocx
c:\windows\6935tzreat50520.ocx
c:\windows\6a549pywzre2671.ocx
c:\windows\6d2ct9ie5z790.exe
c:\windows\6e34do9nloa5er12z6.cpl
c:\windows\6e679zyware5724.cpl
c:\windows\6ea49ddwa5e1z92.ocx
c:\windows\6z9a5pyware1257.dll
c:\windows\6zdf59dware1116.bin
c:\windows\70985orm54z.cpl
c:\windows\7130vzr59498.dll
c:\windows\72zed9w5loader66.ocx
c:\windows\7361dowzloader9585.bin
c:\windows\73899acktoolz95.ocx
c:\windows\73c79te5z664.ocx
c:\windows\7459bac9zoor2138.ocx
c:\windows\749edownzo5der196.ocx
c:\windows\7516do9nlzader2605.ocx
c:\windows\7587hacktozl19a.exe
c:\windows\769ezte9l435.ocx
c:\windows\776t9reat1z574.ocx
c:\windows\77z5v9r3041.dll
c:\windows\77zspywa5e9079.bin
c:\windows\788aad5zare6339.bin
c:\windows\78aaspyw5ze3907.ocx
c:\windows\799thr9at28z56.cpl
c:\windows\79bb9pyware1z375.ocx
c:\windows\79z4hacktoo579c.bin
c:\windows\7ccbback9o5r1z95.exe
c:\windows\7cd5bac9dooz197.cpl
c:\windows\7d78stealz0915.exe
c:\windows\7e56thief114z9.bin
c:\windows\7f5c5ackzoor1795.bin
c:\windows\7z28vi91525.exe
c:\windows\7z74downl5ader1791.exe
c:\windows\81z9sp9457.exe
c:\windows\82795dwzre2051.ocx
c:\windows\8595not-a-zi9us4fa.ocx
c:\windows\896a5zware642.cpl
c:\windows\8d8ad5warz1973.ocx
c:\windows\8z20t5oj28f9.exe
c:\windows\9019pywaze2955.dll
c:\windows\91e2spaz5e825.bin
c:\windows\91z01worm3a5.ocx
c:\windows\9248hacktozl495.exe
c:\windows\92520not-5-zirus1cf.bin
c:\windows\9359spam9oz1d7.bin
c:\windows\93c5sparse1z69.cpl
c:\windows\93ffadd5are3z45.ocx
c:\windows\9457szy7d9.cpl
c:\windows\94818hackz5ol7de.exe
c:\windows\95379virus449z.exe
c:\windows\9545virz05.dll
c:\windows\95978zroj192.dll
c:\windows\95z5troj20b.dll
c:\windows\964caddwarz151.cpl
c:\windows\96d55hreat3z54.bin
c:\windows\96z69tro563c.bin
c:\windows\9764trzj15a.dll
c:\windows\97f9iz5032.exe
c:\windows\9844zow5loader2042.exe
c:\windows\98681viruz315.bin
c:\windows\9981w9r5675z.cpl
c:\windows\99969sp53z4.exe
c:\windows\9b52threat20z45.exe
c:\windows\9c25az5ware718.cpl
c:\windows\9d7sp5ware2913z.cpl
c:\windows\9z2a5ownloader1051.exe
c:\windows\9z60not-a-v5ru974e.ocx
c:\windows\a2fazdw9re2562.exe
c:\windows\bc1backdzor3925.dll
c:\windows\ccczow5loade9367.exe
c:\windows\cz5vir1957.bin
c:\windows\d85t9i5f32z1.bin
c:\windows\e87spars51z929.ocx
c:\windows\kb913800.exe
c:\windows\setup.exe
c:\windows\system32\10z55ha9ktool1ce.bin
c:\windows\system32\113415zoj79.dll
c:\windows\system32\11399szy5f2.cpl
c:\windows\system32\114419zoj52a.ocx
c:\windows\system32\11467s9am5oz693.bin
c:\windows\system32\11493sz5mbo9220.cpl
c:\windows\system32\1157noz-a9virus322.exe
c:\windows\system32\11945spamzot3cb.cpl
c:\windows\system32\120f59zware2613.exe
c:\windows\system32\12179spaz5ot4b89.exe
c:\windows\system32\12284spz75e9.dll
c:\windows\system32\124479pyzf5.exe
c:\windows\system32\1288downlz5der591.dll
c:\windows\system32\13330spam9ot5z.dll
c:\windows\system32\13559hacktooz57e.dll
c:\windows\system32\13951vzr5s582.exe
c:\windows\system32\1398backd5zr3068.exe
c:\windows\system32\13d85hiefz902.cpl
c:\windows\system32\14129spambo51zb9.cpl
c:\windows\system32\14595zr19559.dll
c:\windows\system32\14668wzrm5b39.bin
c:\windows\system32\14911trz955a.cpl
c:\windows\system32\14f0a5dw9re23z4.ocx
c:\windows\system32\14z56t9o5793.exe
c:\windows\system32\15029sp5105z.dll
c:\windows\system32\1542zac9tool46b.bin
c:\windows\system32\15607hack9zol336.cpl
c:\windows\system32\15894not-azvi9us35d.bin
c:\windows\system32\1599zddw5re922.bin
c:\windows\system32\15b8bz59door1158.exe
c:\windows\system32\15beaddza9e30905.ocx
c:\windows\system32\15zvi59921.exe
c:\windows\system32\161689rzj550.bin
c:\windows\system32\16169sp9mbot5b9z.bin
c:\windows\system32\16431zroj9b5.dll
c:\windows\system32\165975ot-a9zirus18f.bin
c:\windows\system32\165f9p5rsz749.exe
c:\windows\system32\167845zy989.ocx
c:\windows\system32\1697ztea9259.dll
c:\windows\system32\171425zo92d.bin
c:\windows\system32\17386not-a-9i5usz7f.exe
c:\windows\system32\17555virzs759.cpl
c:\windows\system32\1762zte9l28375.bin
c:\windows\system32\1850nzt-a-vi5us559.cpl
c:\windows\system32\1859viruz540.dll
c:\windows\system32\18695trzj3f59.ocx
c:\windows\system32\18783n9t5azvirus47.cpl
c:\windows\system32\18852spambzt5199.dll
c:\windows\system32\190z5hac5tool7a0.bin
c:\windows\system32\193905acktoolz1a.exe
c:\windows\system32\195019acktzo5611.exe
c:\windows\system32\197d5ownlozder987.ocx
c:\windows\system32\19811nz5-a-virus774.dll
c:\windows\system32\19859zroj683.cpl
c:\windows\system32\19884hac5tozl975.ocx
c:\windows\system32\19910hacztool75c.ocx
c:\windows\system32\19ae9pyware1765z.dll
c:\windows\system32\19z92not-5-virus184.dll
c:\windows\system32\1c84baczdo5r1970.cpl
c:\windows\system32\1d18baczd5or17479.dll
c:\windows\system32\1d5959eal2z52.ocx
c:\windows\system32\1d95szeal605.ocx
c:\windows\system32\1e32do9nlozder857.ocx
c:\windows\system32\1e65zpyware2907.dll
c:\windows\system32\1e9z59ckdoor75.ocx
c:\windows\system32\1f68s5zrse9675.bin
c:\windows\system32\1f95backdoo9503z.ocx
c:\windows\system32\1z00thie95430.cpl
c:\windows\system32\1z305not-a-virus699.cpl
c:\windows\system32\1z43s5arse9905.exe
c:\windows\system32\1z681virus5c69.cpl
c:\windows\system32\1z702spam95t236.ocx
c:\windows\system32\1z948virus15a.dll
c:\windows\system32\1z99virus105.ocx
c:\windows\system32\205d9ddware480z.bin
c:\windows\system32\20893not-a-virusz53.cpl
c:\windows\system32\20934hac5tool2ze.dll
c:\windows\system32\2119zi95s490.cpl
c:\windows\system32\21393not-a5vizus768.ocx
c:\windows\system32\21409t95z79f.cpl
c:\windows\system32\21445ha9ktool76z.cpl
c:\windows\system32\21536spamboz495.exe
c:\windows\system32\215zt95eat13915.cpl
c:\windows\system32\218b9ddw5re43z.bin
c:\windows\system32\219etzre5t3194.cpl
c:\windows\system32\22355trzj292.exe
c:\windows\system32\22959ot-a-vir5sa5z.dll
c:\windows\system32\229z5spy3ee.cpl
c:\windows\system32\23255zorm689.ocx
c:\windows\system32\2326tr9j1e5z.dll
c:\windows\system32\23316z5ambot90a.bin
c:\windows\system32\23353woz955e.dll
c:\windows\system32\23424s5y9zc.bin
c:\windows\system32\23890zr59279.cpl
c:\windows\system32\239165irusz8a.bin
c:\windows\system32\244z8troj495.exe
c:\windows\system32\24558v9ruz457.cpl
c:\windows\system32\24852vz9us566.dll
c:\windows\system32\24931zpy65d.exe
c:\windows\system32\24952virus5z0.bin
c:\windows\system32\25141wor92z9.bin
c:\windows\system32\2515addwa9e258z.dll
c:\windows\system32\252a9teal99z.ocx
c:\windows\system32\254asparse1z369.exe
c:\windows\system32\254z5v9rus188.ocx
c:\windows\system32\2555zspy695.dll
c:\windows\system32\25f3vzr1695.ocx
c:\windows\system32\26025zot-a-virus699.ocx
c:\windows\system32\26157no5-z-v9rus35b.exe
c:\windows\system32\26189not-a-vir5szf4.bin
c:\windows\system32\263c5azkdoor799.ocx
c:\windows\system32\267z0t5oj729.exe
c:\windows\system32\26968no9-a-vzr5s56a.dll
c:\windows\system32\27335wor938ez.ocx
c:\windows\system32\273z5spy9ce.exe
c:\windows\system32\27853z5cktool39.dll
c:\windows\system32\278905roz49e.exe
c:\windows\system32\27z415p91be.bin
c:\windows\system32\281z99py525.cpl
c:\windows\system32\2825sp9rsez5.bin
c:\windows\system32\2907backdooz2589.ocx
c:\windows\system32\29080tro95bz.cpl
c:\windows\system32\29206hzckt5ol6449.bin
c:\windows\system32\2925spambot65z.exe
c:\windows\system32\294195acktool135z.dll
c:\windows\system32\29475zp976b.bin
c:\windows\system32\29535spam9oz512.exe
c:\windows\system32\29595zor9659.bin
c:\windows\system32\295z39roj59d.dll
c:\windows\system32\29609spambotzbe5.ocx
c:\windows\system32\29770noz-a-5irus6e4.ocx
c:\windows\system32\29864w5r9zdf.cpl
c:\windows\system32\29866hacktoo55az.exe
c:\windows\system32\2988ztro9665.ocx
c:\windows\system32\298s9yzf55.dll
c:\windows\system32\29z2vir30475.dll
c:\windows\system32\29z9thief1599.ocx
c:\windows\system32\2be9d5wnloaz9r2059.bin
c:\windows\system32\2c1addwa5z1729.cpl
c:\windows\system32\2d89v9r172z5.ocx
c:\windows\system32\2z1995py7c6.dll
c:\windows\system32\2z548wor59c0.cpl
c:\windows\system32\2z865worm596.ocx
c:\windows\system32\2zcb5ddware3931.cpl
c:\windows\system32\30529spz2a9.cpl
c:\windows\system32\30th9ef1z195.exe
c:\windows\system32\3149zs5y7ba.bin
c:\windows\system32\317z9not5a-virus59.ocx
c:\windows\system32\32508h9cktzo5208.ocx
c:\windows\system32\32avi5279z.dll
c:\windows\system32\3358sz9al856.exe
c:\windows\system32\341ab9ck5oor1898z.ocx
c:\windows\system32\34619pyware2358z.cpl
c:\windows\system32\346z5py41f9.ocx
c:\windows\system32\348fdownloz9er9055.ocx
c:\windows\system32\3529z5eal360.exe
c:\windows\system32\3535vir15z79.dll
c:\windows\system32\3596vi9258z.exe
c:\windows\system32\3599tzo976f.exe
c:\windows\system32\359zspa5se899.dll
c:\windows\system32\35davir2z95.exe
c:\windows\system32\36e1t9zef158.bin
c:\windows\system32\3850down9ozder924.ocx
c:\windows\system32\38a8addwa5e89z.ocx
c:\windows\system32\392adow59oadez2576.ocx
c:\windows\system32\39399sp5d9z.ocx
c:\windows\system32\3957zhief1565.exe
c:\windows\system32\39825hreat220z69.cpl
c:\windows\system32\39f7ba9kdozr3550.bin
c:\windows\system32\3a13bacz5o9r1007.cpl
c:\windows\system32\3ad2z5ckdoor2290.exe
c:\windows\system32\3az6spywar5917.dll
c:\windows\system32\3c2ed5wnl9azer2393.cpl
c:\windows\system32\3c97stezl9562.dll
c:\windows\system32\3d49szywa9e2715.ocx
c:\windows\system32\3d93dzwnload9r7635.cpl
c:\windows\system32\3de5downzo9der1453.exe
c:\windows\system32\3eb3back95zr2595.cpl
c:\windows\system32\3ez95ir729.ocx
c:\windows\system32\3z705hief2839.dll
c:\windows\system32\43f5zackdo5r2938.cpl
c:\windows\system32\4405bac5dzor1199.ocx
c:\windows\system32\44c6spy5zre23579.dll
c:\windows\system32\44feaddwzre59.dll
c:\windows\system32\4569zow5loader9073.cpl
c:\windows\system32\45765o9z38e.exe
c:\windows\system32\4577do9nloader18z1.exe
c:\windows\system32\45b4b9ckdoor198z.exe
c:\windows\system32\45b9virz751.dll
c:\windows\system32\493csze5l1188.exe
c:\windows\system32\496s5ambot37z.ocx
c:\windows\system32\49e7bazkdo5r1026.bin
c:\windows\system32\4a4zthreat19175.cpl
c:\windows\system32\4d2f5ir29z9.dll
c:\windows\system32\4e1bs9zware5180.dll
c:\windows\system32\4e53threat1z7975.dll
c:\windows\system32\4ffdzddw5re1699.ocx
c:\windows\system32\4z659tea5399.cpl
c:\windows\system32\4z92threa97835.bin
c:\windows\system32\4zea9ir1254.bin
c:\windows\system32\5037zorm490.cpl
c:\windows\system32\50434z9y6b1.exe
c:\windows\system32\504z3spam9otd0.dll
c:\windows\system32\5099spy6ez9.cpl
c:\windows\system32\5155addware19z8.bin
c:\windows\system32\5159spy5z9.bin
c:\windows\system32\517f9hief680z.exe
c:\windows\system32\51949worm6z4.cpl
c:\windows\system32\51d9threat1854z.exe
c:\windows\system32\5209dowzlo5der1867.bin
c:\windows\system32\52czd9ware371.bin
c:\windows\system32\53307not-a-virus689z.cpl
c:\windows\system32\5364z954e3.ocx
c:\windows\system32\5386ba59dozr1816.exe
c:\windows\system32\53f9zteal1570.exe
c:\windows\system32\541spywarez7359.cpl
c:\windows\system32\5425spa9zot84.exe
c:\windows\system32\54496trojzd8.cpl
c:\windows\system32\548es9eal1z84.cpl
c:\windows\system32\54c2dow59oaderz169.ocx
c:\windows\system32\54z6down9oader2646.dll
c:\windows\system32\5500w5zm791.ocx
c:\windows\system32\55b59ddware2951z.bin
c:\windows\system32\5605sparse79z.ocx
c:\windows\system32\5612ztroj6c9.ocx
c:\windows\system32\567a9owzloader3033.exe
c:\windows\system32\56z7threat259175.dll
c:\windows\system32\57259ir86z.ocx
c:\windows\system32\577zbac5door9243.ocx
c:\windows\system32\5783hzckt9ol4e5.exe
c:\windows\system32\5798worm20z5.ocx
c:\windows\system32\579sp9mzot7a9.dll
c:\windows\system32\5833not-a-zirus398.cpl
c:\windows\system32\5877worm659z.bin
c:\windows\system32\589dsteal5100z.dll
c:\windows\system32\58b5dzwnloader5699.cpl
c:\windows\system32\5903vzr637.exe
c:\windows\system32\5906z5ckdo9r1196.cpl
c:\windows\system32\5940noz-a-vi9u5585.ocx
c:\windows\system32\596cs9zal795.bin
c:\windows\system32\596dvi529z9.ocx
c:\windows\system32\59956troj4zb.ocx
c:\windows\system32\5995threa523z08.cpl
c:\windows\system32\599not-a9viruz5e7.ocx
c:\windows\system32\59b15teal152z.dll
c:\windows\system32\59e6thzef532.ocx
c:\windows\system32\59faspyw5ze1794.ocx
c:\windows\system32\5adaviz9506.exe
c:\windows\system32\5b409zwnloader394.exe
c:\windows\system32\5b9caddw9ze450.dll
c:\windows\system32\5c0zvir219.dll
c:\windows\system32\5c65spzrse3039.bin
c:\windows\system32\5f75spyware1793z.dll
c:\windows\system32\5fdfspa9se358z.bin
c:\windows\system32\5z49virus5209.ocx
c:\windows\system32\5z931virus375.ocx
c:\windows\system32\6038zownl5ader1289.cpl
c:\windows\system32\61b0thzeat8359.ocx
c:\windows\system32\61bcaddwaze459.bin
c:\windows\system32\61z9h95ktoola6.exe
c:\windows\system32\626cste5lz94.dll
c:\windows\system32\6339not-a-zi59s7fe.cpl
c:\windows\system32\63c1szywa951988.ocx
c:\windows\system32\6539stezl3905.dll
c:\windows\system32\654cvi928z6.ocx
c:\windows\system32\655zbackdo9r223.ocx
c:\windows\system32\656zbac9door72.cpl
c:\windows\system32\65b75hrea914000z.ocx
c:\windows\system32\65e995zal1239.dll
c:\windows\system32\65f3back9ozr2715.ocx
c:\windows\system32\665viruz9b.bin
c:\windows\system32\6669thizf594.ocx
c:\windows\system32\66a2zownl95der636.dll
c:\windows\system32\6723bzck5oor94.ocx
c:\windows\system32\674bz5ea9219.dll
c:\windows\system32\6795threat19890z.exe
c:\windows\system32\6799addwaze7435.dll
c:\windows\system32\690thief1z95.exe
c:\windows\system32\6937spzr5e2506.bin
c:\windows\system32\6944zir563.exe
c:\windows\system32\6987zro9546.cpl
c:\windows\system32\69ddo9nloadzr16365.bin
c:\windows\system32\6e13zh5ea919006.bin
c:\windows\system32\6f4zpars51719.exe
c:\windows\system32\6ff8doznloade9251.ocx
c:\windows\system32\6z04thief2195.ocx
c:\windows\system32\6z1fd9wn5oader2765.bin
c:\windows\system32\7171zackdoor2945.exe
c:\windows\system32\7195spy340z.cpl
c:\windows\system32\71dcdo9nlza5er77.ocx
c:\windows\system32\720fdoz9loa5er2750.ocx
c:\windows\system32\720zbackd5or1595.cpl
c:\windows\system32\740259oj68z.cpl
c:\windows\system32\74459zckdoor151.cpl
c:\windows\system32\744eadd5arz793.ocx
c:\windows\system32\74z9spy9are2785.cpl
c:\windows\system32\7533hack9o5l19z.exe
c:\windows\system32\753ha9ktool2z7.cpl
c:\windows\system32\754aback9ozr3239.dll
c:\windows\system32\75929owzloader467.ocx
c:\windows\system32\7597stzal1604.ocx
c:\windows\system32\76b5th9ef2z23.dll
c:\windows\system32\790ddownlo5der1904z.bin
c:\windows\system32\7947not-a-z5rus32.bin
c:\windows\system32\7954sp5rse901z.bin
c:\windows\system32\7958z95ef1355.dll
c:\windows\system32\7a97vzr1551.ocx
c:\windows\system32\7adazdw5r9254.ocx
c:\windows\system32\7c1e59izf2551.dll
c:\windows\system32\7cebdownloadzr54599.exe
c:\windows\system32\7d19th9ea5z604.exe
c:\windows\system32\7ee3zd9war51671.cpl
c:\windows\system32\7f59zddwa5e3101.exe
c:\windows\system32\7fa8zteal7955.cpl
c:\windows\system32\7fz9spywar925685.ocx
c:\windows\system32\7fzback5oor1914.dll
c:\windows\system32\7z2a5dware9644.cpl
c:\windows\system32\815ba9zdoor559.dll
c:\windows\system32\87319or5z81.bin
c:\windows\system32\8884not-5zvirus39a.cpl
c:\windows\system32\8952vi5us69z.cpl
c:\windows\system32\9221dow5loadzr3263.dll
c:\windows\system32\92260sp54fz.dll
c:\windows\system32\92353woz547f.ocx
c:\windows\system32\92379noz-a5virus7e3.cpl
c:\windows\system32\9288downloader4z35.bin
c:\windows\system32\92bfsp5warez592.cpl
c:\windows\system32\935fadzware1815.dll
c:\windows\system32\936steal9z75.ocx
c:\windows\system32\939bacz5oor490.dll
c:\windows\system32\952z4spy4c5.bin
c:\windows\system32\9547zh5cktool4ac.dll
c:\windows\system32\95543spy4z5.dll
c:\windows\system32\9557szy524.dll
c:\windows\system32\955vir12z0.ocx
c:\windows\system32\95618szy55.exe
c:\windows\system32\9598viru93dz.ocx
c:\windows\system32\95998worm7ez.cpl
c:\windows\system32\95athiez3135.ocx
c:\windows\system32\9601notz5-virus979.dll
c:\windows\system32\9644vi95s3z5.cpl
c:\windows\system32\968vizus3425.dll
c:\windows\system32\96downloader2251z.dll
c:\windows\system32\995zthreat523.cpl
c:\windows\system32\995ztroj48b.ocx
c:\windows\system32\9a0a5dware3209z.ocx
c:\windows\system32\9b6back5ozr2693.bin
c:\windows\system32\9b99backd5or25z5.ocx
c:\windows\system32\9c1dvir285z.bin
c:\windows\system32\9d45szyware5670.cpl
c:\windows\system32\9e7s5arse292z.dll
c:\windows\system32\9eaethreaz4505.dll
c:\windows\system32\9z25p9ware1253.cpl
c:\windows\system32\9z49spy7785.cpl
c:\windows\system32\9z62spyware1955.dll
c:\windows\system32\aoz17.tmp.exe
c:\windows\system32\czft5r9at4997.cpl
c:\windows\system32\d3d0499.dll
c:\windows\system32\drivers\ndisrd.sys
c:\windows\system32\drivers\UACiqparrtjxb.sys
c:\windows\system32\ed9downloa5er2z96.bin
c:\windows\system32\fe99hrzat4525.dll
c:\windows\system32\msxmlm.dll
c:\windows\system32\ndisapi.dll
c:\windows\system32\NetFilter.exe
c:\windows\system32\UAChnpcphbrnk.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACmpvogoeuwp.dat
c:\windows\system32\UACmuyqvdyutx.dll
c:\windows\system32\UACqtomudppex.dll
c:\windows\system32\z0307hackto9l7485.bin
c:\windows\system32\z9dba9dw5re1707.dll
c:\windows\z05545pamb9t598.exe
c:\windows\z1718hackto5ld9.dll
c:\windows\z1789troj355.cpl
c:\windows\z208troj5395.ocx
c:\windows\z3521v5rus922.exe
c:\windows\z4299spy29d5.exe
c:\windows\z459thief5773.exe
c:\windows\z4981worm455.ocx
c:\windows\z5263tr9573a.bin
c:\windows\z535th9eat53769.cpl
c:\windows\z579parse1502.exe
c:\windows\z6247spy3945.bin
c:\windows\z6412vir9s2f5.cpl
c:\windows\z6954tro97015.ocx
c:\windows\z710backdoor26595.dll
c:\windows\z784hacktoo96955.exe
c:\windows\z80925roj69e.exe
c:\windows\z85virus95.exe
c:\windows\z8aedownloa59r2203.exe
c:\windows\z93es9ars5255.bin
c:\windows\z949tr5j55.dll
c:\windows\z984stea51915.bin
c:\windows\z9970w9rm5d0.exe
c:\windows\z9bbackd5or575.dll
c:\windows\ze71backdoor1569.cpl
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
-------\Legacy_NDISRD
-------\Service_NDISRD
((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 )))))))))))))))))))))))))))))))
.
2009-11-05 16:33 . 2009-09-10 20:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-05 16:33 . 2009-11-05 16:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-05 16:33 . 2009-11-05 16:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-05 16:33 . 2009-09-10 20:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-04 22:32 . 2009-11-04 22:32 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert
2009-11-04 22:24 . 2009-11-04 23:01 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-04 21:44 . 2009-11-04 21:44 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2009-11-04 21:44 . 2009-11-04 21:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skinux
2009-11-04 21:44 . 2009-11-04 21:44 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-10-12 18:25 . 2009-10-12 18:25 6021 ----a-w- c:\windows\system32\z5717hacktool195.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-25 17:48 . 2006-07-25 23:01 67528 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 23:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-03-15 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck"="c:\windows\system32\dumprep 0 -k" [X]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-18 118784]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-04-05 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-04-05 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-04-05 118784]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-28 217088]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 151552]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-08 7561216]
"Switcher.exe"="c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128]
"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632]
"DISCover"="c:\program files\DISC\DISCover.exe" [2006-06-02 1077248]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-08-18 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-29 29744]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-11-15 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-11-15 267048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"combofix"="c:\abcd\CF9491.exe" [2009-11-06 388608]
"Mouse Suite 98 Daemon"="ICO.EXE" - c:\windows\system32\ico.exe [2002-03-14 45056]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-7-7 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-03-09 21:51 73728 ----a-w- c:\windows\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [12/19/2006 11:30 AM 58016]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB [?]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [7/24/2006 11:28 AM 30080]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [7/24/2006 11:28 AM 226304]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [1/16/2007 11:11 PM 29744]
S3 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMOUSE.SYS [7/24/2006 1:39 PM 17251]
S3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\pelusblf.sys [7/24/2006 1:39 PM 7520]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB [?]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - ENTDRV51
*NewlyCreated* - MBR
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder
2009-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:57]
.
.
------- Supplementary Scan -------
.
mDefault_Page_URL = hxxp://www.sony.com/vaiopeople
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: trymedia.com
.
- - - - ORPHANS REMOVED - - - -
BHO-{cb5a26c3-d9b3-4ab0-9efc-443595518284} - c:\program files\Starware408\bin\Starware408.dll
Toolbar-{6e4cc754-caa4-4576-9af1-68323d5760d4} - c:\program files\Starware408\bin\Starware408.dll
HKLM-Run-PersonalAV - c:\program files\PersonalAV\PAV.exe
HKLM-Run-<NO NAME> - (no file)
Notify-WgaLogon - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-06 12:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\VESWinlogon.dll
- - - - - - - > 'lsass.exe'(936)
c:\windows\system32\EntApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\Mcshield.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\eHome\ehmsas.exe
c:\program files\Apoint\Apntex.exe
c:\program files\DISC\DiscStreamHub.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-11-06 12:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-06 18:49
Pre-Run: 134,242,820,096 bytes free
Post-Run: 134,620,393,472 bytes free
- - End Of File - - 7B35764C3DB94A6861394277113F4B55