Should I turn on Windows Firewall? Do I need to do anything with bad files that were put in Quarantine?
Here are your requests:
Avira AntiVir Personal
Report file date: Thursday, January 01, 2009 20:34
Scanning for 1140430 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: RAFAEL-0F450D52
Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 11/18/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 11/18/2008 15:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 5/26/2008 14:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 6/12/2008 19:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 5/26/2008 14:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 18:30:36
ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 12/24/2008 02:33:38
ANTIVIR2.VDF : 7.1.1.34 2048 Bytes 12/24/2008 02:33:38
ANTIVIR3.VDF : 7.1.1.58 296448 Bytes 1/1/2009 02:33:40
Engineversion : 8.2.0.45
AEVDF.DLL : 8.1.0.6 102772 Bytes 10/14/2008 17:05:56
AESCRIPT.DLL : 8.1.1.19 336252 Bytes 1/2/2009 02:33:45
AESCN.DLL : 8.1.1.5 123251 Bytes 11/7/2008 22:06:41
AERDL.DLL : 8.1.1.3 438645 Bytes 11/4/2008 20:58:38
AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 16:41:39
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 1/2/2009 02:33:44
AEHEUR.DLL : 8.1.0.75 1524087 Bytes 1/2/2009 02:33:44
AEHELP.DLL : 8.1.2.0 119159 Bytes 1/2/2009 02:33:42
AEGEN.DLL : 8.1.1.8 323956 Bytes 1/2/2009 02:33:41
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/14/2008 17:05:56
AECORE.DLL : 8.1.5.2 172405 Bytes 1/2/2009 02:33:40
AEBB.DLL : 8.1.0.3 53618 Bytes 10/14/2008 17:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 7/9/2008 15:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 5/16/2008 16:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 7/31/2008 19:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 5/9/2008 18:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 15:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 6/12/2008 19:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/23/2008 00:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 6/12/2008 19:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 19:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 6/12/2008 20:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 6/27/2008 20:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, G:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: Thursday, January 01, 2009 20:34
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'jucheck.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'V0270Mon.exe' - '1' Module(s) have been scanned
Scan process 'StartFX.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'CTSysVol.exe' - '1' Module(s) have been scanned
Scan process 'stsystra.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
36 processes with 36 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: The device is not ready.
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'G:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '56' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Qoobox\Quarantine\C\Documents and Settings\RAFAEL\Application Data\gadcom\gadcom.exe.vir
[DETECTION] Is the TR/Agent.axoc Trojan
[NOTE] The file was moved to '49c180fb.qua'!
C:\Qoobox\Quarantine\C\Documents and Settings\RAFAEL\Application Data\SpeedRunner\SpeedRunner.exe.vir
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49c28114.qua'!
C:\Qoobox\Quarantine\C\Documents and Settings\RAFAEL\Application Data\SpeedRunner\SRUninstall.exe.vir
[DETECTION] Is the TR/Dldr.Agent.aldb Trojan
[NOTE] The file was moved to '49b280f6.qua'!
C:\Qoobox\Quarantine\C\Documents and Settings\RAFAEL\Application Data\SpeedRunner\_SpeedRunner_.exe.zip
--> SpeedRunner.exe
[DETECTION] Is the TR/Dldr.Agent.alda Trojan
[NOTE] The file was moved to '49cd80f7.qua'!
C:\Qoobox\Quarantine\C\Program Files\GetModule\GetModule32.exe.vir
[DETECTION] Is the TR/Click.MRV Trojan
[NOTE] The file was moved to '49d1810a.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\wpv401229907443.cpx.vir
--> ProgramFilesDir/GetModule32.exe
[DETECTION] Is the TR/Click.MRV Trojan
[NOTE] The file was moved to '49d38116.qua'!
C:\System Volume Information\_restore{0D5FFE30-F6A9-45FB-A57F-4807E2FBC049}\RP2\A0000547.exe
[DETECTION] Is the TR/Click.MRV Trojan
[NOTE] The file was moved to '498d80e4.qua'!
C:\System Volume Information\_restore{0D5FFE30-F6A9-45FB-A57F-4807E2FBC049}\RP2\A0000558.exe
[DETECTION] Is the TR/Agent.axoc Trojan
[NOTE] The file was moved to '480f6e9d.qua'!
C:\System Volume Information\_restore{0D5FFE30-F6A9-45FB-A57F-4807E2FBC049}\RP2\A0000560.exe
[DETECTION] Is the TR/Dldr.Agent.aldb Trojan
[NOTE] The file was moved to '498d80e5.qua'!
C:\System Volume Information\_restore{0D5FFE30-F6A9-45FB-A57F-4807E2FBC049}\RP2\A0000571.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '480f6e9e.qua'!
C:\System Volume Information\_restore{0D5FFE30-F6A9-45FB-A57F-4807E2FBC049}\RP2\A0000637.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '498d80e8.qua'!
C:\System Volume Information\_restore{0D5FFE30-F6A9-45FB-A57F-4807E2FBC049}\RP2\A0000638.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '480f6e91.qua'!
C:\System Volume Information\_restore{0D5FFE30-F6A9-45FB-A57F-4807E2FBC049}\RP2\A0000639.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '498d80e9.qua'!
C:\System Volume Information\_restore{0D5FFE30-F6A9-45FB-A57F-4807E2FBC049}\RP2\A0000640.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '480f6e92.qua'!
Begin scan in 'G:\' <My Book>
End of the scan: Thursday, January 01, 2009 21:05
Used time: 30:45 Minute(s)
The scan has been done completely.
11893 Scanning directories
260207 Files were scanned
14 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
14 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
260192 Files not concerned
1192 Archives were scanned
2 Warnings
14 Notes
ComboFix 08-12-31.01 - RAFAEL 2009-01-01 20:25:12.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.621 [GMT -6:00]
Running from: c:\documents and settings\RAFAEL\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\RAFAEL\Desktop\CFScript.txt
* Created a new restore point
FILE ::
c:\windows\system32\drivers\TDSSypjq.sys
c:\windows\system32\TDSSbvqi.dll
c:\windows\system32\TDSScrrn.dll
c:\windows\system32\TDSSgqrr.log
c:\windows\system32\TDSShhrl.log
c:\windows\system32\TDSSkbnv.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSushc.dll
c:\windows\system32\TDSSvouw.dll
c:\windows\system32\TDSSvoxr.dll
c:\windows\system32\TDSSwryg.dat
.
((((((((((((((((((((((((( Files Created from 2008-12-02 to 2009-01-02 )))))))))))))))))))))))))))))))
.
2008-12-31 09:52 . 2008-12-31 09:52 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-31 09:52 . 2008-12-31 09:52 <DIR> d-------- c:\documents and settings\RAFAEL\Application Data\Malwarebytes
2008-12-31 09:52 . 2008-12-31 09:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-31 09:52 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-31 09:52 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-30 20:20 . 2008-12-30 20:20 726,008 --a------ c:\documents and settings\RAFAEL\gotomypc_437.exe
2008-12-30 12:23 . 2008-12-30 12:23 <DIR> d-------- c:\program files\Trend Micro
2008-12-17 21:20 . 2008-12-17 21:20 <DIR> d-------- c:\program files\UltraISO
2008-12-17 21:20 . 2008-12-17 21:20 <DIR> d-------- c:\program files\Common Files\EZB Systems
2008-12-17 20:27 . 2008-12-17 20:27 23,600 --a------ c:\windows\system32\drivers\TVICHW32.SYS
2008-12-17 20:18 . 2008-12-17 20:18 0 --a------ c:\windows\ativpsrm.bin
2008-12-17 14:38 . 2008-12-17 22:04 522 --a------ C:\GSMRIAutomation.cfg
2008-12-17 05:48 . 2008-12-17 16:27 <DIR> d--h----- C:\MRI_PE_TEMP
2008-12-16 03:13 . 2008-12-17 05:48 <DIR> d--hs---- C:\$RECYCLE.BIN
2008-12-16 02:41 . 2008-12-16 02:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\Geek Squad
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-01 02:49 --------- d-----w c:\documents and settings\RAFAEL\Application Data\Skype
2009-01-01 00:47 --------- d-----w c:\documents and settings\RAFAEL\Application Data\skypePM
2008-12-30 19:02 --------- d-----w c:\program files\McAfee.com
2008-12-30 19:02 --------- d-----w c:\program files\McAfee
2008-12-30 19:02 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-12-18 02:07 --------- d-----w c:\program files\Google
2008-12-18 02:03 --------- d-----w c:\documents and settings\All Users\Application Data\Visual Networks
2008-12-18 01:48 --------- d-----w c:\program files\Yahoo!
2008-12-18 01:47 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-28 20:37 --------- d-----w c:\program files\iTunes
2008-11-28 20:37 --------- d-----w c:\program files\iPod
2008-11-28 20:37 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-28 20:36 --------- d-----w c:\program files\QuickTime
2008-11-28 20:35 --------- d-----w c:\program files\Common Files\Apple
2008-11-26 01:28 --------- d-----w c:\program files\Common Files\AnswerWorks 4.0
2008-11-23 20:46 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-11-18 01:25 --------- d-----w c:\documents and settings\RAFAEL\Application Data\ntr
2008-11-18 00:58 --------- d-----w c:\program files\Common Files\Scanner
2008-11-18 00:58 --------- d-----w c:\program files\CCleaner
2008-11-15 15:03 36,624 ------w c:\windows\system32\drivers\pxhelp20.sys
2008-04-01 01:24 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((( snapshot@2008-12-30_13.11.44.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-30 18:00:09 32,768 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-12-30 20:00:31 32,768 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-12-30 18:00:09 16,384 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-12-30 20:00:31 16,384 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-12-30 20:00:31 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-11-17 00:13:38 149,200 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-12-31 15:40:29 149,200 ----a-w c:\windows\system32\FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"CTSysVol"="c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"CTDVDDET"="c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-08-16 24576]
"V0270Mon.exe"="c:\windows\V0270Mon.exe" [2006-09-26 32768]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"CTHelper"="CTHELPER.EXE" [2004-03-10 c:\windows\system32\CTHELPER.EXE]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 443968]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 11:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
--------- 2005-02-23 16:19 53248 c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2008-02-28 16:15 503808 c:\program files\Orb Networks\Orb\bin\OrbTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-06 17:37 21898024 c:\program files\Skype\Phone\Skype.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"=
"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\SightSpeed\\SightSpeed.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R3 VF0270Dev;Live! Cam Optia;c:\windows\system32\DRIVERS\V0270Dev.sys [2008-03-31 225632]
R3 VF0270Vfx;VF0270 Video FX;c:\windows\system32\DRIVERS\V0270VFx.sys [2008-03-31 6912]
.
Contents of the 'Scheduled Tasks' folder
2008-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://att.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {EDE05334-D18B-49FE-9B39-E23C686A2C09} = 4.2.2.1,4.2.2.2
O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\RAFAEL\Application Data\Mozilla\Firefox\Profiles\sicg66af.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage -
www.mail.yahoo.comFF - component: c:\program files\Mozilla Firefox\components\nsglobaladsolution.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-01-01 20:27:37
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*NULL*_ Â|·*NULL*]
@Owner=S-1-5-21-1482476501-1604221776-725345543-1003
"DisplayName"="?\11"
"DeviceDesc"="?\11"
"ProviderName"="?\11???\11\
08"
"MFG"="??\
09"
"ReinstallString"="8.162.0.0"
"DeviceInstanceIds"=multi:"c:\\dell\\drivers\\r106409\\driver\\2kxp_inf\\cx_25672.inf\
00"
[HKEY_LOCAL_MACHINE\software\SigmaTel\GlobalState]
@Owner=Administrator
@Denied: (Full) (Guests)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (B 1 2 3 4 5) (S-1-5-4)
[HKEY_LOCAL_MACHINE\software\SigmaTel\GlobalState\STSysTray]
@Owner=Administrator
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(764)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-01 20:29:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-02 02:29:09
ComboFix2.txt 2009-01-02 00:50:49
ComboFix3.txt 2008-12-30 19:12:08
Pre-Run: 228,020,449,280 bytes free
Post-Run: 228,003,725,312 bytes free
212 --- E O F --- 2008-12-11 11:26:06
