Shaba,
After allowing ComboFix to Run, a popup appeared that said that there was a new version of ComboFix and asked if I wanted to update. I figured it probably was OK, but figured it was safer to use the old safe version in case this was a popup generated by a virus to screw things up. If I should update it for next time, please let me know.
Just to let you know, I did have Azureus on my computer but hadn't used it since last November, so I don't think it was the cause of my infection. I did uninstall it before making my first post on this forum per the forum instructions. I'm not sure why there is still files from it on my computer.
For the uninstall list from HijackThis that you asked me to produce last time; I've always wondered about a few programs listed in the Windows Add/Remove function that I didn't seem to use and didn't know what they were. I would get rid of them if I knew they weren't important, do you know of a good safe site that might list programs that may be listed and what they do?
Otherwise everything ran correctly.
Thanks,
Trent
ComboFix 09-01-21.02 - Trent Kucher 2009-01-23 6:09:25.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.722 [GMT -6:00]
Running from: c:\documents and settings\Trent Kucher\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Trent Kucher\Desktop\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated)
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated)
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated)
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Trent Kucher\Application Data\Azureus
c:\documents and settings\Trent Kucher\Application Data\Azureus\.certs
c:\documents and settings\Trent Kucher\Application Data\Azureus\.keystore
c:\documents and settings\Trent Kucher\Application Data\Azureus\.lock
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\A7FC7D7D113BF13E6AC5590A0C0B8CA45F61572A.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\A7FC7D7D113BF13E6AC5590A0C0B8CA45F61572A.dat.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\cache.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\D428B3E847F1B3C06D42CF6217840E776A5B0AEB.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\D428B3E847F1B3C06D42CF6217840E776A5B0AEB.dat.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\D85053FDE8B0D77C6D637B6EA6DEA22B0042F371.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\D85053FDE8B0D77C6D637B6EA6DEA22B0042F371.dat.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\E79D3B67A71D046733D53C1D84884A86E72DD2CE.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\active\E79D3B67A71D046733D53C1D84884A86E72DD2CE.dat.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\azureus.config
c:\documents and settings\Trent Kucher\Application Data\Azureus\azureus.config.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\azureus.statistics
c:\documents and settings\Trent Kucher\Application Data\Azureus\azureus.statistics.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\banips.config
c:\documents and settings\Trent Kucher\Application Data\Azureus\banips.config.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\dht\addresses.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\dht\contacts.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\dht\diverse.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\dht\general.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\dht\version.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\downloads.config
c:\documents and settings\Trent Kucher\Application Data\Azureus\downloads.config.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\ipfilter.cache
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\alerts_1.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\AutoSpeed_1.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\AutoSpeedSearchHistory_1.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\debug_1.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\debug_2.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\NetStatus_1.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\seltrace_1.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\seltrace_2.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\SpeedMan_1.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\thread_1.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\logs\thread_2.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\net\pm_7132.dat
c:\documents and settings\Trent Kucher\Application Data\Azureus\plugins\azupnpav\azupnpav_0.2.1.jar
c:\documents and settings\Trent Kucher\Application Data\Azureus\plugins\azupnpav\azupnpav_0.2.1.zip
c:\documents and settings\Trent Kucher\Application Data\Azureus\plugins\azupnpav\plugin.properties
c:\documents and settings\Trent Kucher\Application Data\Azureus\plugins\azupnpav\plugin.properties_0.2.1
c:\documents and settings\Trent Kucher\Application Data\Azureus\tables.config
c:\documents and settings\Trent Kucher\Application Data\Azureus\tables.config.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55263.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55265.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55266.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55267.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55268.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55269.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55270.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55271.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\tmp\AZU55272.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\-'mininova.org'-_The_Village_Full_DVD_Rip.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\-{mininova.org}-_The_Village.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\[TBox]_Depeche_Mode_-_Playing_The_Angel__b-mininova.org-d_.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\^mininova.org^_Girls_Gone_Wild_The_Wild_World_-_PPV_-_DSR_XviD-OMiCRON.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\_-mininova.org-__The_Village.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\__-mininova.org-__The_Village.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\_Saw_III_UNRATED_DVDRip_XviD_DiAMOND_^mininova.org^.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\_The_Village_-'mininova.org'-.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\_The_Village_-_Proper_Quality_DVD_rip_[XviD].avi_=mininova.org=.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\+[mininova.org]+_The_Village.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\=mininova.org=_Saw_III_UNRATED_DVDRip_XviD_DiAMOND.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU11503.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU12392.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU12394.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU12396.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU18460.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU18463.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU1891.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU1894.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU24901.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU26172.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU32958.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU32962.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU32964.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU40393.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU50259.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU6814.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU6817.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\AZU8020.tmp
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Battlestar.Galactica.S02E10.WS.DSR.XviD-LOKi.3387262.TPB.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Bridge.To.Terabithia[2007]DvDrip[Eng]-aXXo_[mininova].torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Collective_Soul_Collection_(5_Albums).3268930.TPB.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Futurama_S1E1_Pilot.3371859.TPB.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Girls_Gone_Wild_Sexiest_Moments_2_PPV_DSRip_XviD-aAF.3828331.TPB.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Iron_Man[2008]DvDrip[Eng]-FXG_[mininova].torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\mininova.org___Timbaland_Shock_Value_New_Album_2007.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Saw_III_UNRATED_DVDRip_XviD_DiAMOND_^mininova.org^.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Sneaker_Pimps_-_Becoming_X.3371410.TPB.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\Stardust[2007]DvDrip[Eng]-FXG_[mininova].torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\The_Village_-'mininova.org'-.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\torrents\The_Village_-_Proper_Quality_DVD_rip_[XviD].avi_=mininova.org=.torrent
c:\documents and settings\Trent Kucher\Application Data\Azureus\tracker.config
c:\documents and settings\Trent Kucher\Application Data\Azureus\tracker.config.bak
c:\documents and settings\Trent Kucher\Application Data\Azureus\update.log
c:\documents and settings\Trent Kucher\Application Data\Azureus\update.properties
c:\program files\Azureus
c:\program files\Azureus\az_error.log
c:\program files\Azureus\az_output.log
c:\program files\Azureus\AzureusUpdater.exe
c:\program files\Azureus\msvcr71.dll
c:\program files\Azureus\plugins\azplugins\azplugins_1.8.6.jar
c:\program files\Azureus\plugins\azplugins\azplugins_1.8.8.jar
c:\program files\Azureus\plugins\azplugins\azplugins_2.1.4.jar
c:\program files\Azureus\plugins\azupdater\azupdater_1.8.3.zip
c:\program files\Azureus\plugins\azupdater\azupdater_1.8.5.zip
c:\program files\Azureus\plugins\azupdater\azupdater_1.8.8.zip
c:\program files\Azureus\plugins\azupdater\azupdaterpatcher_1.8.2.jar
c:\program files\Azureus\plugins\azupdater\azupdaterpatcher_1.8.3.jar
c:\program files\Azureus\plugins\azupdater\azupdaterpatcher_1.8.5.jar
c:\program files\Azureus\plugins\azupdater\azupdaterpatcher_1.8.8.jar
c:\program files\Azureus\plugins\azupdater\Azureus2_2.3.0.6_P2.pax
c:\program files\Azureus\plugins\azupdater\plugin.properties
c:\program files\Azureus\plugins\azupdater\plugin.properties_1.8.3
c:\program files\Azureus\plugins\azupdater\plugin.properties_1.8.5
c:\program files\Azureus\plugins\azupdater\plugin.properties_1.8.8
c:\program files\Azureus\plugins\azupdater\Updater.jar
c:\program files\Azureus\plugins\azupdater\Updater.jar.bak
c:\program files\Azureus\plugins\rating\azrating_1.3.1.jar
c:\program files\Azureus\plugins\rating\rating_1.2.jar
c:\program files\Azureus\plugins\SafePeer\blocklist.cache
c:\program files\Azureus\plugins\SafePeer\blocklist.properties
c:\program files\Azureus\plugins\SafePeer\history.txt
c:\program files\Azureus\plugins\SafePeer\License.txt
c:\program files\Azureus\plugins\SafePeer\plugin.properties
c:\program files\Azureus\plugins\SafePeer\Readme.txt
c:\program files\Azureus\plugins\SafePeer\safepeer.log
c:\program files\Azureus\plugins\SafePeer\safepeer.properties
c:\program files\Azureus\plugins\SafePeer\safepeer_2.5.1.jar
c:\program files\Azureus\swt-awt-win32-3318.dll
c:\program files\Azureus\swt-gdip-win32-3318.dll
c:\program files\Azureus\swt-wgl-win32-3318.dll
c:\program files\Azureus\swt-win32-3318.dll
c:\program files\Azureus\Uninstall.exe
.
((((((((((((((((((((((((( Files Created from 2008-12-23 to 2009-01-23 )))))))))))))))))))))))))))))))
.
2009-01-16 20:46 . 2009-01-16 20:46 <DIR> d-------- c:\program files\Trend Micro
2009-01-16 20:44 . 2009-01-16 20:46 <DIR> d-------- c:\program files\ERUNT
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 00:05 --------- d-----w c:\program files\World of Warcraft
2009-01-16 02:06 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-16 01:37 --------- d-----w c:\program files\Google
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2005-07-11 23:44 41,573 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2005-07-11 23:44 48,223 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2005-07-11 23:44 160,871 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-08-28 03:14 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082720080828\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 131072]
"SmartGuardian"="c:\program files\ITE\Smart Guardian\ITESmart.exe" [2003-09-30 180224]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 36975]
"avgnt"="c:\program files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-05-18 262401]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-04-24 98304]
"nwiz"="nwiz.exe" [2004-10-29 c:\windows\system32\nwiz.exe]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-06-25 614531]
KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2003-06-08 16432]
SBC Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2005-07-02 217088]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
1 [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2004-12-17 23:20 278528 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
--a------ 2003-12-10 03:52 380928 c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-04-24 10:57 98304 c:\program files\QuickTime\qttask.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2005\\sandra.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2005\\RpcSandraSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2005\\RpcDataSrv.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-1.2.1-patch-enUS-Downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-1.1.1-patch-enUS-Downloader.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre1.5.0_05\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:blizzard downloader
"6112:TCP"= 6112:TCP:blizzard downloader
R3 iteio;iteio;c:\windows\system32\drivers\ITEIO.SYS [2004-11-21 3680]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://yahoo.sbc.com/dsl
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
Trusted Zone: aeroplan.com\www
Trusted Zone: paypal.com\www
Trusted Zone: sony.com\
www.sonycard
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath -
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("backups.number_of_prefs_copies", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.link.open_newwindow.ui", 3); // prefs UI version
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.closed", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.document", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.frames", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.history", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.length", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.opener", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.parent", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.self", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.top", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.window", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromString", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromStream", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.disable_window_open_feature.status", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("advanced.always_load_images", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.protocol-handler.external.help", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.connect.timeout", 30); // in seconds
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.request.timeout", 120); // in seconds
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN_show_punycode", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.image.imageBehavior", 0); // 0-Accept, 1-dontAcceptForeign, 2-dontUse
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.cookieBehavior", 3); // 0-Accept, 1-dontAcceptForeign, 2-dontUse, 3-p3p
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.id", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.version",
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.extensions.version", "1.0");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.build_id",
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.autoUpdateEnabled", true); // Whether or not background app updates
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.url", "chrome://mozapps/locale/update/update.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.updatesAvailable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.lastUpdateDate", 0); // UTC offset when last App update was
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.performed", false); // Whether or not an update has been
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.autoUpdateEnabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.autoUpdate", false); // Automatically download and install
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.interval", 604800000); // Check for updates to Extensions and
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.lastUpdateDate", 0); // UTC offset when last Extension/Theme
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.severity.threshold", 5);// The number of pending Extension/Theme
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.count", 0); // The number of extension/theme/etc
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.interval", 3600000); // Check each of the above intervals
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.showSlidingNotification", true); // Windows-only slide-up taskbar
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.severity", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("general.useragent.vendor", "Firefox");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("general.useragent.vendorSub",
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.update.resetHomepage", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.startup.homepage_override.1", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.turbo.enabled", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://browser/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://browser/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update_notifications.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update_notifications.provider.0.frequency", 7); // number of days
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.xul.error_pages.enabled", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("pfs.datasource.url", "chrome://mozapps/locale/plugins/plugins.properties");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-01-23 06:10:59
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-01-23 6:11:59
ComboFix-quarantined-files.txt 2009-01-23 12:11:53
ComboFix2.txt 2009-01-22 01:53:22
Pre-Run: 3,700,297,728 bytes free
Post-Run: 3,702,239,232 bytes free
303 --- E O F --- 2009-01-14 01:23:39
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:41, on 2009-01-23
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe
C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Trent Kucher\Desktop\Gooch38\Gooch38.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\ITE\Smart Guardian\ITESmart.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120326078671
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125620040031
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -
http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
--
End of file - 7331 bytes
