Here's my combofix log:
ComboFix 13-05-23.02 - Sam 05/24/2013 0:23.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1417 [GMT -5:00]
Running from: c:\documents and settings\Sam\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Antivirus *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((( Files Created from 2013-04-24 to 2013-05-24 )))))))))))))))))))))))))))))))
.
.
2013-05-23 09:09 . 2013-05-23 09:09 -------- d-----w- C:\VTRoot
2013-05-23 09:09 . 2013-05-24 01:05 44168 ----a-w- c:\windows\system32\drivers\fvstore.dat
2013-05-23 08:50 . 2013-05-09 08:59 368944 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-05-23 08:50 . 2013-05-09 08:59 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-23 08:50 . 2013-05-09 08:59 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-05-23 08:50 . 2013-05-09 08:59 56080 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-23 08:50 . 2013-05-09 08:59 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-05-23 08:50 . 2013-05-09 08:59 174664 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-05-23 08:50 . 2013-05-09 08:59 49376 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-23 08:50 . 2013-05-09 08:59 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-23 08:50 . 2013-05-09 08:58 229648 ----a-w- c:\windows\system32\aswBoot.exe
2013-05-23 08:48 . 2013-05-09 08:58 41664 ----a-w- c:\windows\avastSS.scr
2013-05-23 08:48 . 2013-05-23 08:48 -------- d-----w- c:\program files\AVAST Software
2013-05-23 08:46 . 2013-05-23 08:48 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2013-05-23 08:45 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-05-23 08:45 . 2013-05-23 08:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-05-23 08:40 . 2013-05-23 08:40 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\COMODO
2013-05-23 08:38 . 2013-05-23 08:38 -------- d-s---w- c:\documents and settings\All Users\Application Data\Shared Space
2013-05-23 08:26 . 2013-05-23 08:26 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\COMODO
2013-05-23 08:26 . 2013-05-23 08:40 -------- d-----w- c:\documents and settings\All Users\Application Data\COMODO
2013-05-23 08:25 . 2013-05-23 08:33 47368 ----a-w- c:\windows\system32\certsentry.dll
2013-05-23 08:25 . 2013-05-23 08:25 -------- d-----w- c:\documents and settings\Sam\Local Settings\Application Data\COMODO
2013-05-23 08:25 . 2013-05-23 08:45 -------- d-----w- c:\program files\Comodo
2013-05-23 08:25 . 2013-05-23 08:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2013-05-23 07:58 . 2013-05-23 07:58 -------- d-----w- c:\program files\Mozilla Maintenance Service
2013-05-23 00:35 . 2013-05-02 15:28 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-05-22 22:09 . 2013-05-22 22:09 -------- d-----w- c:\program files\Common Files\Java
2013-05-22 22:08 . 2013-05-22 22:08 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-04-25 16:05 . 2013-04-25 16:05 99392 ----a-w- c:\windows\system32\drivers\inspect.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-23 01:39 . 2013-01-10 02:39 664 ----a-w- c:\windows\system32\d3d9caps.tmp
2013-05-22 22:08 . 2012-08-17 17:26 144896 ----a-w- c:\windows\system32\javacpl.cpl
2013-05-22 22:08 . 2012-08-17 17:26 866720 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-05-22 22:08 . 2010-09-25 17:40 788896 ----a-w- c:\windows\system32\deployJava1.dll
2013-05-22 21:53 . 2012-03-31 23:16 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-22 21:53 . 2011-06-07 19:38 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-23 20:04 . 2013-04-23 20:04 348048 ----a-w- c:\windows\system32\guard32.dll
2013-04-16 22:17 . 2008-04-14 10:42 920064 ----a-w- c:\windows\system32\wininet.dll
2013-04-16 22:17 . 2008-04-14 10:42 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-04-16 22:17 . 2008-04-14 10:41 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-15 23:39 . 2013-04-15 23:39 592384 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2013-04-15 23:39 . 2013-04-15 23:39 32816 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2013-04-15 23:39 . 2013-04-15 23:39 18528 ----a-w- c:\windows\system32\drivers\cmderd.sys
2013-04-15 23:38 . 2013-04-15 23:38 35488 ----a-w- c:\windows\system32\cmdcsr.dll
2013-04-15 23:38 . 2013-04-15 23:38 40656 ----a-w- c:\windows\system32\cmdkbd32.dll
2013-04-15 23:38 . 2013-04-15 23:38 276688 ----a-w- c:\windows\system32\cmdvrt32.dll
2013-04-12 23:28 . 2008-04-14 05:07 385024 ----a-w- c:\windows\system32\html.iec
2013-04-10 01:31 . 2008-04-14 06:00 1876352 ----a-w- c:\windows\system32\win32k.sys
2013-03-08 08:36 . 2008-04-14 10:42 293376 ----a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32 . 2008-04-14 05:54 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50 . 2008-04-14 06:01 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-02-27 07:56 . 2010-04-04 06:37 2067456 ----a-w- c:\windows\system32\mstscax.dll
2013-05-23 07:57 . 2013-05-23 07:57 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-12-21 . 710DEE44DFB67EB7D512E768856E52A4 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]
"nwiz"="nwiz.exe" [2006-05-09 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-09 86016]
"RTHDCPL"="RTHDCPL.EXE" [2010-03-26 19522592]
"Qwest Personal Digital Vault"="c:\program files\Qwest Personal Digital Vault\QwestPersonalDigitalVault.exe" [2009-12-18 1064808]
"QuickCare"="c:\program files\Qwest\Quickcare\bin\sprtcmd.exe" [2010-01-16 206120]
"MP10_EnsureFileVer"="c:\windows\inf\unregmp2.exe" [2008-04-14 208896]
"VMM Mode Selection"="c:\program files\HTC\ModeSelection\VMMModeSelection.exe" [2011-02-14 43520]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2013-04-15 3012816]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
.
c:\documents and settings\Guest\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonui.exe"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 10:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-12-12 19:57 152544 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Qwest\\QuickConnect\\QuickConnect.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58016:TCP"= 58016:TCP
ando Media Booster
"58016:UDP"= 58016:UDP
ando Media Booster
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [5/23/2013 3:50 AM 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [5/23/2013 3:50 AM 174664]
R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [7/1/2011 12:55 PM 16024]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [5/23/2013 3:50 AM 765736]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5/23/2013 3:50 AM 368944]
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [4/15/2013 6:39 PM 18528]
R1 cmdGuard;COMODO Internet Security Driver;c:\windows\system32\drivers\cmdGuard.sys [4/15/2013 6:39 PM 592384]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [4/15/2013 6:39 PM 32816]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/14/2008 5:42 AM 14336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/23/2013 3:50 AM 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [5/23/2013 3:50 AM 66336]
R2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [7/1/2011 12:55 PM 220824]
R2 sprtlisten;SupportSoft Listener Service;c:\program files\Common Files\supportsoft\bin\sprtlisten.exe [1/8/2008 12:02 PM 1213728]
R2 sprtsvc_quickcare;SupportSoft Sprocket Service (quickcare);c:\program files\Qwest\Quickcare\bin\sprtsvc.exe [8/8/2010 10:14 PM 206120]
R2 tgsrvc_quickcare;SupportSoft Repair Service (quickcare);c:\program files\Qwest\Quickcare\bin\tgsrvc.exe [8/8/2010 10:14 PM 185640]
R2 WinFLdrv;WinFLdrv;c:\windows\system32\WinFLdrv.sys [10/16/2011 11:54 PM 17984]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [8/8/2010 1:31 AM 266240]
S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\Comodo\COMODO Internet Security\cmdvirth.exe [4/15/2013 6:38 PM 127184]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 49850858
*Deregistered* - 49850858
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-13 03:45 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 21:53]
.
2013-05-24 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-23 08:58]
.
2013-05-24 c:\windows\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-04-15 23:38]
.
2013-05-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1659004503-838170752-1801674531-1005Core.job
- c:\documents and settings\Monalisa\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-09-22 18:05]
.
2013-05-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1659004503-838170752-1801674531-1005UA.job
- c:\documents and settings\Monalisa\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-09-22 18:05]
.
2013-05-23 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-04-10 20:39]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-23 03:18]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-23 03:18]
.
2013-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-838170752-1801674531-1003Core.job
- c:\documents and settings\Sam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-11 07:23]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-838170752-1801674531-1003UA.job
- c:\documents and settings\Sam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-11 07:23]
.
2013-05-23 c:\windows\Tasks\QuickConnectSupportTask.job
- c:\program files\Qwest\QuickConnect\QuickConnect.exe [2011-10-17 21:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://isearch.glarysoft.com/?src=iehome
mStart Page = hxxp://isearch.glarysoft.com/?src=iehome
uInternet Settings,ProxyOverride = <local>;*.local
uSearchAssistant = hxxp://
www.google.com/ie
uSearchURL,(Default) = hxxp://
www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1 205.171.3.25
FF - ProfilePath - c:\documents and settings\Sam\Application Data\Mozilla\Firefox\Profiles\b2pd2wan.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Glary Search
FF - prefs.js: browser.startup.homepage - hxxp://isearch.glarysoft.com/?src=ffhome
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - ExtSQL: 2013-05-23 03:49;
wrc@avast.com; c:\progra~1\AVASTS~1\Avast\WebRep\FF
FF - user.js: extensions.zonealarm_i.newTab - false
FF - user.js: extensions.zonealarm_i.vrsnTs - 1.6.7.414:28
FF - user.js: extensions.zonealarm_i.smplGrp - none
FF - user.js: extensions.zonealarm.hpOld0 - hxxp://isearch.glarysoft.com/?src=ffhome
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?src=tb&tbid=base2013&Lan={dfltLng}&gu=fadf3cd3eadc4408895a010c45edd45d&tu=10GX0008B2B0008&sku=&tstsId=&ver=&&q=
FF - user.js: extensions.zonealarm.id - 44d06554000000000000001a6bcbd126
FF - user.js: extensions.zonealarm.appId - {C56C48A0-DA4E-46F6-9859-1553DC865F84}
FF - user.js: extensions.zonealarm.instlDay - 15847
FF - user.js: extensions.zonealarm.vrsn - 1.8.11.11
FF - user.js: extensions.zonealarm.vrsni - 1.8.11.11
FF - user.js: extensions.zonealarm.vrsnTs - 1.8.11.1117:18
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1025
FF - user.js: extensions.zonealarm.smplGrp - none
FF - user.js: extensions.zonealarm.tlbrId - base2013
FF - user.js: extensions.zonealarm.instlRef - ZLN16524721347397-1001
FF - user.js: extensions.zonealarm.dfltLng - en
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.ffxUnstlRst - false
FF - user.js: extensions.zonealarm.admin - false
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm.rvrt - true
FF - user.js: extensions.zonealarm.hmpg - true
FF - user.js: extensions.zonealarm.hmpgUrl - hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=en&gu=fadf3cd3eadc4408895a010c45edd45d&tu=10GX0008B2B0008&sku=&tstsId=&ver=&
FF - user.js: extensions.zonealarm.newTab - true
FF - user.js: extensions.zonealarm.newTabUrl - hxxp://search.zonealarm.com/?src=nt&tbid=base2013&Lan=en&gu=fadf3cd3eadc4408895a010c45edd45d&tu=10GX0008B2B0008&sku=&tstsId=&ver=&
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-ISW - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2013-05-24 00:36
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
c:\windows\system32\sys_drv.dat 6024 bytes
c:\windows\system32\sys_drv_2.dat 5020 bytes
c:\windows\system32\WinFLdrv.sys 17984 bytes executable
c:\documents and settings\Sam\Application Data\systemfl.$dk 990 bytes
.
scan completed successfully
hidden files: 4
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_ca0e279.dll"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
.
[HKEY_LOCAL_MACHINE\System\VritualRoot\MACHINE\Software\CLASSES\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\System\VritualRoot\MACHINE\Software\CLASSES\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\System\VritualRoot\MACHINE\Software\CLASSES\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(952)
c:\windows\system32\guard32.dll
c:\windows\system32\mswsock.dll
c:\windows\System32\wshtcpip.dll
.
- - - - - - - > 'explorer.exe'(2020)
c:\windows\system32\WININET.dll
c:\windows\system32\guard32.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WS2_32.dll
c:\windows\system32\WS2HELP.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
- - - - - - - > 'csrss.exe'(856)
c:\windows\system32\cmdcsr.dll
.
Completion time: 2013-05-24 00:40:58
ComboFix-quarantined-files.txt 2013-05-24 05:40
.
Pre-Run: 40,356,335,616 bytes free
Post-Run: 40,703,680,512 bytes free
.
- - End Of File - - 7100E80E7045D93AD3A8D958B5EA9ACC
