ComboFix 09-11-18.01 - johnlin 11/17/2009 13:46.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.512 [GMT -5:00]
Running from: c:\documents and settings\johnlin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\johnlin\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\tdlwsp.dll

----- BITS: Possible infected sites -----

hxxp://download.yimg.com
.
((((((((((((((((((((((((( Files Created from 2009-10-17 to 2009-11-17 )))))))))))))))))))))))))))))))
.

2009-11-12 14:40 . 2009-11-12 14:40 -------- d-----w- c:\documents and settings\johnlin\Local Settings\Application Data\Yahoo
2009-11-12 14:39 . 2009-11-12 14:39 262144 ----a-w- C:\ntuser.dat
2009-11-12 14:38 . 2009-11-12 18:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-11-12 14:38 . 2009-11-12 14:39 -------- d-----w- c:\documents and settings\johnlin\Application Data\Yahoo!
2009-11-12 14:36 . 2009-11-12 14:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-11-12 14:36 . 2009-05-27 00:50 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-11-12 14:36 . 2009-11-12 14:39 -------- d-----w- c:\program files\Yahoo!
2009-11-11 18:39 . 2009-11-11 18:39 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2009-11-05 16:17 . 2009-11-05 16:17 -------- d-----w- c:\windows\Sun
2009-11-05 16:16 . 2009-11-05 16:16 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-05 16:16 . 2009-11-05 16:16 -------- d-----w- c:\program files\Java
2009-11-05 16:16 . 2009-11-05 16:16 152576 ----a-w- c:\documents and settings\johnlin\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-04 18:52 . 2009-11-04 18:52 -------- d-----w- c:\documents and settings\johnlin\Application Data\Malwarebytes
2009-11-04 18:52 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-04 18:52 . 2009-11-04 18:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-04 18:52 . 2009-11-04 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-04 18:52 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-04 17:37 . 2009-11-04 17:37 -------- d-sh--w- c:\documents and settings\johnlin\IECompatCache
2009-11-04 17:36 . 2009-11-04 17:36 -------- d-sh--w- c:\documents and settings\johnlin\PrivacIE
2009-11-04 17:36 . 2009-11-04 17:36 -------- d-sh--w- c:\documents and settings\johnlin\IETldCache
2009-11-04 17:35 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-11-04 17:35 . 2009-11-04 17:35 -------- d-----w- c:\windows\ie8updates
2009-11-04 17:34 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-11-04 17:34 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-11-04 17:33 . 2009-11-04 17:34 -------- dc-h--w- c:\windows\ie8
2009-11-04 17:08 . 2009-11-04 17:08 -------- d-----w- c:\documents and settings\johnlin\Local Settings\Application Data\Identities
2009-10-30 15:51 . 2009-10-30 15:52 -------- d-----w- c:\program files\Windows Live Safety Center
2009-10-29 16:54 . 2009-10-29 17:10 1407680 ----a-w- c:\documents and settings\johnlin\Application Data\Move Networks\MoveMediaPlayerWin_071505000010.exe
2009-10-20 14:45 . 2009-10-20 14:45 -------- d-----w- c:\documents and settings\johnlin\Application Data\AdobeUM
2009-10-20 14:44 . 2009-10-20 14:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems
2009-10-20 14:43 . 2009-10-20 14:43 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-17 18:54 . 2009-09-18 17:45 -------- d-----w- c:\documents and settings\johnlin\Application Data\Nitro PDF
2009-11-11 18:41 . 2009-01-22 00:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-02 14:06 . 2009-02-03 22:22 56784 ----a-w- c:\documents and settings\johnlin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-30 17:53 . 2009-01-22 00:39 -------- d-----w- c:\program files\Microsoft Works
2009-10-29 17:10 . 2009-09-10 16:41 126970 ----a-w- c:\documents and settings\johnlin\Application Data\Move Networks\uninstall.exe
2009-10-29 17:10 . 2009-05-11 17:52 -------- d-----w- c:\documents and settings\johnlin\Application Data\Move Networks
2009-10-29 17:10 . 2009-08-03 21:48 4187512 ----a-w- c:\documents and settings\johnlin\Application Data\Move Networks\plugins\npqmp071505000010.dll
2009-10-21 15:22 . 2009-01-22 16:11 -------- d-----w- c:\documents and settings\lewis.OCEANWAVES\Application Data\uTorrent
2009-10-21 15:22 . 2009-01-22 16:01 -------- d-----w- c:\documents and settings\kellyc.OCEANWAVES\Application Data\uTorrent
2009-10-20 14:43 . 2009-02-16 16:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-14 22:01 . 2009-06-16 18:22 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-09 17:02 . 2009-10-09 17:02 -------- d-----w- c:\program files\VS Revo Group
2009-09-21 18:09 . 2009-09-21 18:09 -------- d-----w- c:\program files\MSBuild
2009-09-21 18:09 . 2009-09-21 18:09 -------- d-----w- c:\program files\Reference Assemblies
2009-09-15 14:17 . 2009-09-15 14:17 61760 ----a-w- c:\windows\system32\ASTSRV.EXE
2009-09-15 14:16 . 2009-09-18 17:44 17728 ----a-w- c:\windows\system32\nitrolocalui.dll
2009-09-15 14:15 . 2009-09-18 17:44 26432 ----a-w- c:\windows\system32\nitrolocalmon.dll
2009-09-11 14:18 . 2004-08-04 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 16:41 . 2009-06-16 06:35 4183416 ----a-w- c:\documents and settings\johnlin\Application Data\Move Networks\plugins\npqmp071503000010.dll
2009-09-10 16:40 . 2009-09-10 16:40 1686272 ----a-w- c:\documents and settings\johnlin\Application Data\Move Networks\MoveMediaPlayerWin_071503000010.exe
2009-09-04 21:03 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2006-03-04 03:33 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2004-08-04 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-11-04_17.55.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-12-02 05:46 . 2006-12-02 05:46 65536 c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_ x-ww_6c18549a\vcomp.dll
+ 2009-11-16 14:10 . 2009-11-16 14:10 16384 c:\windows\temp\Perflib_Perfdata_81c.dat
+ 2009-11-17 18:53 . 2009-11-17 18:53 16384 c:\windows\temp\Perflib_Perfdata_688.dat
+ 2009-11-17 18:54 . 2009-11-17 18:54 16384 c:\windows\temp\Perflib_Perfdata_674.dat
+ 2009-01-22 00:39 . 2009-11-11 18:41 35088 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-01-22 00:39 . 2009-10-30 17:54 35088 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-01-22 00:39 . 2009-11-11 18:41 18704 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-01-22 00:39 . 2009-10-30 17:54 18704 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-01-22 00:39 . 2009-11-11 18:41 20240 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-01-22 00:39 . 2009-10-30 17:54 20240 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\cagicon.exe
- 2004-08-04 10:00 . 2009-03-08 09:33 726528 c:\windows\system32\jscript.dll
+ 2004-08-04 10:00 . 2009-06-22 06:44 726528 c:\windows\system32\jscript.dll
+ 2009-11-05 16:16 . 2009-11-05 16:16 149280 c:\windows\system32\javaws.exe
+ 2009-11-05 16:16 . 2009-11-05 16:16 145184 c:\windows\system32\javaw.exe
+ 2009-11-05 16:16 . 2009-11-05 16:16 145184 c:\windows\system32\java.exe
- 2009-01-21 15:41 . 2009-11-02 14:04 243920 c:\windows\system32\FNTCACHE.DAT
+ 2009-01-21 15:41 . 2009-11-11 18:50 243920 c:\windows\system32\FNTCACHE.DAT
- 2008-05-09 10:53 . 2009-03-08 09:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2008-05-09 10:53 . 2009-06-22 06:44 726528 c:\windows\system32\dllcache\jscript.dll
+ 2009-11-12 18:24 . 2009-11-13 18:55 262144 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
+ 2009-11-12 14:36 . 2009-11-12 14:36 331264 c:\windows\Installer\9ce58.msi

+ 2009-11-05 16:16 . 2009-11-05 16:16 537600 c:\windows\Installer\726c21.msi
+ 2009-01-22 00:39 . 2009-11-11 18:41 888080 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-01-22 00:39 . 2009-10-30 17:54 888080 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-01-22 00:39 . 2009-11-11 18:41 845584 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\outicon.exe
- 2009-01-22 00:39 . 2009-10-30 17:54 845584 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-01-22 00:39 . 2009-11-11 18:41 217864 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\misc.exe
- 2009-01-22 00:39 . 2009-10-30 17:54 217864 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\misc.exe
+ 2009-11-05 19:03 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB976749-IE8\spuninst\updspapi.dll
+ 2009-11-05 19:03 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB976749-IE8\spuninst\spuninst.exe
+ 2009-11-05 19:03 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB971961-IE8\spuninst\updspapi.dll
+ 2009-11-05 19:03 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB971961-IE8\spuninst\spuninst.exe
+ 2009-11-05 19:03 . 2009-03-08 09:33 726528 c:\windows\ie8updates\KB971961-IE8\jscript.dll
+ 2004-08-04 10:00 . 2009-08-14 13:21 1850624 c:\windows\system32\win32k.sys
+ 2006-03-23 17:32 . 2009-10-22 09:19 5939712 c:\windows\system32\mshtml.dll
+ 2009-01-22 08:07 . 2009-08-14 13:21 1850624 c:\windows\system32\dllcache\win32k.sys
+ 2006-03-23 17:32 . 2009-10-22 09:19 5939712 c:\windows\system32\dllcache\mshtml.dll
+ 2009-10-16 12:03 . 2009-10-16 12:03 5003776 c:\windows\Installer\fb3fc2.msp
+ 2009-08-18 17:58 . 2009-08-18 17:58 8301056 c:\windows\Installer\fb3fb2.msp
+ 2009-08-18 17:57 . 2009-08-18 17:57 9122304 c:\windows\Installer\fb3fa2.msp
- 2009-01-22 00:39 . 2009-10-30 17:54 1172240 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-01-22 00:39 . 2009-11-11 18:41 1172240 c:\windows\Installer\{91120000-0013-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-11-05 19:03 . 2009-08-29 08:08 5940224 c:\windows\ie8updates\KB976749-IE8\mshtml.dll
+ 2009-01-23 16:15 . 2009-11-05 17:36 26768832 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-02 68856]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2008-05-15 95536]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-24 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-24 118784]
"CTSVolFE"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2005-11-21 45056]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 49152]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-05 149280]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2009-10-20 25214]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Best\\90cs\\MAS90\\HOME\\PVXWIN32.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List]
"1224:UDP"= 1224:UDP:Windows Media Format SDK (iexplore.exe)
"1225:UDP"= 1225:UDP:Windows Media Format SDK (iexplore.exe)
"1226:UDP"= 1226:UDP:Windows Media Format SDK (iexplore.exe)
"1358:UDP"= 1358:UDP:Windows Media Format SDK (iexplore.exe)
"1359:UDP"= 1359:UDP:Windows Media Format SDK (iexplore.exe)
"1360:UDP"= 1360:UDP:Windows Media Format SDK (iexplore.exe)
"2152:UDP"= 2152:UDP:Windows Media Format SDK (iexplore.exe)
"2155:UDP"= 2155:UDP:Windows Media Format SDK (iexplore.exe)
"2154:UDP"= 2154:UDP:Windows Media Format SDK (iexplore.exe)
"1204:UDP"= 1204:UDP:Windows Media Format SDK (iexplore.exe)
"1205:UDP"= 1205:UDP:Windows Media Format SDK (iexplore.exe)
"1206:UDP"= 1206:UDP:Windows Media Format SDK (iexplore.exe)
"1256:UDP"= 1256:UDP:Windows Media Format SDK (iexplore.exe)
"1257:UDP"= 1257:UDP:Windows Media Format SDK (iexplore.exe)
"1258:UDP"= 1258:UDP:Windows Media Format SDK (iexplore.exe)
"1621:UDP"= 1621:UDP:Windows Media Format SDK (iexplore.exe)
"1624:UDP"= 1624:UDP:Windows Media Format SDK (iexplore.exe)
"1625:UDP"= 1625:UDP:Windows Media Format SDK (iexplore.exe)
"1361:UDP"= 1361:UDP:Windows Media Format SDK (iexplore.exe)
"1362:UDP"= 1362:UDP:Windows Media Format SDK (iexplore.exe)
"1340:UDP"= 1340:UDP:Windows Media Format SDK (iexplore.exe)
"1341:UDP"= 1341:UDP:Windows Media Format SDK (iexplore.exe)
"1342:UDP"= 1342:UDP:Windows Media Format SDK (iexplore.exe)

R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\Nitro PDF\Professional\NitroPDFDriverService.exe [9/15/2009 9:20 AM 188736]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-10-14 c:\windows\Tasks\Norton Security Scan for Johnlin.job
- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2009-07-22 23:58]

2009-11-17 c:\windows\Tasks\User_Feed_Synchronization-{17BD2D1D-81CB-43B0-8EA7-AEF1A5EF0512}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Search
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-17 13:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3176)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ASTSRV.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2009-11-17 13:58 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-17 18:58
ComboFix2.txt 2009-11-04 17:56

Pre-Run: 37,224,566,784 bytes free
Post-Run: 38,000,295,936 bytes free

- - End Of File - - A6CF9BAC7902629C5B26DC841711AD2E

Leaving work now, I'll check back tomorrow. Thanks for all the help so far.