ComboFix 10-07-06.01 - Jenna 07/09/2010 15:58:57.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.639 [GMT -4:00]
Running from: c:\documents and settings\Jenna\Desktop\commy.exe
Command switches used :: c:\documents and settings\Jenna\Desktop\CFScript.txt
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2010-06-09 to 2010-07-09 )))))))))))))))))))))))))))))))
.
2010-07-06 20:26 . 2010-07-07 18:50 -------- d-----w- C:\commy
2010-07-06 00:19 . 2010-07-06 00:19 -------- d-----w- c:\documents and settings\Jenna\Application Data\Malwarebytes
2010-07-06 00:19 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-06 00:19 . 2010-07-06 00:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-06 00:19 . 2010-07-06 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-06 00:19 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-05 23:09 . 2010-07-05 23:09 63488 ----a-w- c:\documents and settings\Jenna\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-07-05 23:09 . 2010-07-05 23:09 52224 ----a-w- c:\documents and settings\Jenna\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-07-05 23:09 . 2010-07-05 23:09 117760 ----a-w- c:\documents and settings\Jenna\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-07-05 23:09 . 2010-07-05 23:09 -------- d-----w- c:\documents and settings\Jenna\Application Data\SUPERAntiSpyware.com
2010-07-05 23:09 . 2010-07-05 23:09 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-07-05 23:09 . 2010-07-05 23:09 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-07-05 22:10 . 2010-07-06 16:06 -------- d-----w- c:\documents and settings\Jenna\Local Settings\Application Data\jqlkaxmst
2010-07-01 14:04 . 2010-07-01 14:04 -------- d-----w- c:\documents and settings\Jenna\Local Settings\Application Data\Threat Expert
2010-07-01 13:53 . 2010-07-05 22:26 -------- d-----w- c:\program files\Spyware Doctor
2010-06-23 15:43 . 2010-06-23 16:28 117067 ----a-w- c:\windows\hpoins11.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-09 19:50 . 2008-02-09 18:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-07-05 22:27 . 2009-11-19 18:30 -------- d-----w- c:\program files\SafeConnect
2010-07-01 14:13 . 2009-01-12 04:08 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-26 02:58 . 2010-04-18 19:53 439816 ----a-w- c:\documents and settings\Jenna\Application Data\Real\Update\setup3.10\setup.exe
2010-06-12 19:36 . 2007-12-02 21:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-10 18:54 . 2010-02-18 12:54 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-03 19:09 . 2010-06-03 19:09 -------- d-----w- c:\program files\Common Files\Apple
2010-06-03 19:09 . 2010-06-03 19:08 -------- d-----w- c:\program files\QuickTime
2010-06-03 19:08 . 2010-06-03 19:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-06-01 02:49 . 2009-11-29 19:33 -------- d-----w- c:\documents and settings\Jenna\Application Data\HpUpdate
2010-05-30 17:21 . 2009-11-19 19:40 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-05-24 00:07 . 2010-05-24 00:07 503808 ----a-w- c:\documents and settings\Jenna\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3f18d732-n\msvcp71.dll
2010-05-24 00:07 . 2010-05-24 00:07 499712 ----a-w- c:\documents and settings\Jenna\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3f18d732-n\jmc.dll
2010-05-24 00:07 . 2010-05-24 00:07 348160 ----a-w- c:\documents and settings\Jenna\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3f18d732-n\msvcr71.dll
2010-05-04 17:20 . 2006-02-28 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 17:20 . 2006-02-28 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-05-04 17:20 . 2006-02-28 12:00 17408 ------w- c:\windows\system32\corpol.dll
2010-05-02 05:22 . 2006-02-28 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:30 . 2006-02-28 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-01-07 23:46 . 2009-07-15 19:14 952 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
(((((((((((((((((((((((((((((
SnapShot@2010-07-07_19.09.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-09 19:49 . 2010-07-09 19:49 16384 c:\windows\Temp\Perflib_Perfdata_4a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim"="c:\program files\AIM\aim.exe" [2009-10-05 3634024]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-06-29 2403568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-19 16248320]
"SkyTel"="SkyTel.EXE" [2006-07-19 2879488]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-07-19 53248]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-06-13 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-06-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-06-13 118784]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"AGRSMMSG"="AGRSMMSG.exe" [2005-12-14 88204]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-03-03 149280]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-30 185896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
c:\documents and settings\Jenna\Start Menu\Programs\Startup\
Microsoft Office Groove.lnk - c:\program files\Microsoft Office\Office12\GROOVE.EXE [2009-2-14 337264]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-1-17 618557]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-05-19 19:23 87352 ----a-w- c:\windows\system32\LMIinit.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2010-06-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
2010-07-09 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]
2010-07-05 c:\windows\Tasks\WebReg Photosmart C4100 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 20:45]
2010-07-09 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 02:18]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-07-09 16:03
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(720)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\LMIinit.dll
- - - - - - - > 'explorer.exe'(204)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2010-07-09 16:05:25
ComboFix-quarantined-files.txt 2010-07-09 20:05
ComboFix2.txt 2010-07-07 19:12
Pre-Run: 144,827,510,784 bytes free
Post-Run: 144,808,546,304 bytes free
- - End Of File - - 814E0E88612CF259B301EA31E1157853