---

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:02:21, on 11.8.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Unable to get Internet Explorer version!

Boot mode: Normal



Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\Ati2evxx.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\Ati2evxx.exe

D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

D:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\system32\wuauclt.exe

D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

D:\Program Files\Mozilla Firefox\firefox.exe

\?\D:\WINDOWS\system32\WBEM\WMIADAP.EXE

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [hfxp] "D:\Program Files\Hf\hfxp.exe" /s

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)

O13 - Gopher Prefix: 

O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - D:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - D:\WINDOWS\System32\ups.exe (file missing)

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - D:\Program Files\Windows Media Player\WMPNetwk.exe



--

End of file - 4021 bytes

---

---

ComboFix 08-08-10.02 - Sami 2008-08-11 12:05:42.1 - NTFSx86



Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.1442 [GMT 3:00]

Running from: D:\Documents and Settings\Administrator\Desktop\ComboFix.exe



[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

.



(((((((((((((((((((((((((   Files Created from 2008-07-11 to 2008-08-11  )))))))))))))))))))))))))))))))

.



2008-08-11 12:01 . 2008-08-11 12:01	<DIR>	d--h-----	D:\WINDOWS\PIF

2008-08-11 02:02 . 2004-08-04 00:56	21,504	--a------	D:\WINDOWS\system32\hidserv.dll

2008-08-11 02:02 . 2001-08-17 13:59	3,072	--a------	D:\WINDOWS\system32\drivers\audstub.sys

2008-08-11 02:01 . 2004-08-03 22:59	57,472	--a------	D:\WINDOWS\system32\drivers\redbook.sys

2008-08-11 02:00 . 2008-08-10 23:21	<DIR>	dr---c---	D:\Documents and Settings\All Users\Documents

2008-08-11 00:22 . 2008-08-11 00:22	<DIR>	d----c---	D:\Documents and Settings\All Users\Application Data\Avira

2008-08-11 00:18 . 2008-08-11 00:18	11,286	--a------	D:\WINDOWS\system32\MRT.INI

2008-08-11 00:15 . 2008-08-11 00:15	<DIR>	d----c---	D:\Program Files\MSXML 6.0

2008-08-11 00:13 . 2008-08-11 00:18	<DIR>	d--h-----	D:\WINDOWS\$hf_mig$

2008-08-11 00:13 . 2008-08-11 00:13	<DIR>	d----c---	D:\Program Files\Malwarebytes' Anti-Malware

2008-08-11 00:13 . 2008-08-11 00:13	<DIR>	d----c---	D:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-08-11 00:13 . 2008-08-11 00:13	<DIR>	d----c---	D:\Documents and Settings\Administrator\Application Data\Malwarebytes

2008-08-11 00:13 . 2008-07-30 20:07	38,472	--a------	D:\WINDOWS\system32\drivers\mbamswissarmy.sys

2008-08-11 00:13 . 2008-07-30 20:07	17,144	--a------	D:\WINDOWS\system32\drivers\mbam.sys

2008-08-11 00:12 . 2008-08-11 00:12	<DIR>	d----c---	D:\Program Files\Common Files\Download Manager

2008-08-11 00:04 . 2008-08-11 00:04	0	--a------	D:\WINDOWS\ativpsrm.bin

2008-08-11 00:03 . 2008-08-11 00:03	<DIR>	d----c---	D:\Program Files\Webroot

2008-08-11 00:03 . 2008-08-11 00:03	<DIR>	d----c---	D:\Documents and Settings\LocalService\Application Data\Webroot

2008-08-11 00:03 . 2008-08-11 00:03	<DIR>	d----c---	D:\Documents and Settings\All Users\Application Data\Webroot

2008-08-11 00:03 . 2008-08-11 00:03	<DIR>	d----c---	D:\Documents and Settings\Administrator\Application Data\Webroot

2008-08-11 00:03 . 2007-06-15 13:38	1,521,216	--a------	D:\WINDOWS\WRSetup.dll

2008-08-11 00:03 . 2007-06-15 13:22	160,320	--a------	D:\WINDOWS\system32\drivers\ssidrv.sys

2008-08-11 00:03 . 2007-06-15 13:22	24,128	--a------	D:\WINDOWS\system32\drivers\sskbfd.sys

2008-08-11 00:03 . 2007-06-15 13:21	22,080	--a------	D:\WINDOWS\system32\drivers\sshrmd.sys

2008-08-11 00:03 . 2007-06-15 13:21	20,544	--a------	D:\WINDOWS\system32\drivers\SSFS0BB8.sys

2008-08-10 23:50 . 2008-08-10 23:50	<DIR>	d----c---	D:\Program Files\Trend Micro

2008-08-10 23:49 . 2005-11-09 00:26	38,400	--a------	D:\WINDOWS\system32\moveex.exe

2008-08-10 23:48 . 2008-08-10 23:48	0	--a------	D:\WINDOWS\nsreg.dat

2008-08-10 23:40 . 2008-08-10 23:40	<DIR>	d----c---	D:\Documents and Settings\All Users\Application Data\ArcSoft

2008-08-10 23:40 . 2008-08-10 23:40	<DIR>	d----c---	D:\Documents and Settings\Administrator\Application Data\ArcSoft

2008-08-10 23:40 . 2006-11-10 15:05	18,688	--a------	D:\WINDOWS\system32\drivers\afc.sys

2008-08-10 23:39 . 2008-08-10 23:40	<DIR>	d----c---	D:\Program Files\Common Files\ArcSoft

2008-08-10 23:39 . 2008-08-10 23:39	<DIR>	d----c---	D:\Program Files\ArcSoft

2008-08-10 23:39 . 2008-08-10 23:39	306,816	--a------	D:\WINDOWS\system32\drivers\AF15BDA.SYS

2008-08-10 23:39 . 2005-04-27 16:36	245,408	--a------	D:\WINDOWS\system32\unicows.dll

2008-08-10 23:39 . 2008-08-10 23:39	28,672	--a------	D:\WINDOWS\system32\AF15BDAEX.dll

2008-08-10 23:39 . 2008-08-10 23:39	126	--a------	D:\WINDOWS\system32\AF15IRTBL.bin

2008-08-10 23:37 . 2008-08-10 23:37	<DIR>	d----c---	D:\Program Files\PlayFLV

2008-08-10 23:36 . 2008-08-10 23:36	<DIR>	d--hsc---	D:\Program Files\Common Files\WindowsLiveInstaller

2008-08-10 23:36 . 2008-08-10 23:36	<DIR>	d----c---	D:\Documents and Settings\All Users\Application Data\WLInstaller

2008-08-10 23:33 . 2008-08-10 23:37	<DIR>	d----c---	D:\Documents and Settings\Administrator\Application Data\Skype

2008-08-10 23:28 . 2008-08-10 23:28	<DIR>	d--------	D:\Program Files\Xvid

2008-08-10 23:28 . 2008-08-10 23:28	<DIR>	d----c---	D:\Program Files\RevConnect

2008-08-10 23:28 . 2007-06-28 18:55	77,824	--a------	D:\WINDOWS\system32\xvid.ax

2008-08-10 23:27 . 2008-08-10 23:27	<DIR>	d----c---	D:\Program Files\K-Lite Codec Pack

2008-08-10 23:26 . 2008-08-10 23:32	<DIR>	d----c---	D:\Program Files\WarRock

2008-08-10 23:26 . 2008-08-10 23:26	<DIR>	d----c---	D:\Program Files\Skype

2008-08-10 23:26 . 2008-08-10 23:26	<DIR>	d----c---	D:\Documents and Settings\All Users\Application Data\Skype

2008-08-10 23:25 . 2008-02-25 21:05	593,920	---------	D:\WINDOWS\system32\ati2sgag.exe

2008-08-10 23:24 . 2008-08-10 23:24	<DIR>	d---s----	D:\WINDOWS\system32\Microsoft

2008-08-10 23:24 . 2008-08-10 23:24	<DIR>	d--------	D:\WINDOWS\system32\Lang

2008-08-10 23:24 . 2008-08-10 23:24	940,794	--a------	D:\WINDOWS\system32\LoopyMusic.wav

2008-08-10 23:24 . 2008-08-10 23:24	146,650	--a------	D:\WINDOWS\system32\BuzzingBee.wav

2008-08-10 23:21 . 2008-08-10 23:21	<DIR>	d--------	D:\WINDOWS\PCHEALTH

2008-08-10 23:21 . 2008-08-10 23:21	<DIR>	d----c---	D:\Program Files\Avira

2008-08-10 23:21 . 2008-08-10 23:21	552	--a------	D:\WINDOWS\system32\d3d8caps.dat

2008-08-10 23:20 . 2008-08-10 23:20	<DIR>	d----c---	D:\Program Files\CCleaner

2008-08-10 23:20 . 2006-10-04 17:06	1,197,294	---------	D:\WINDOWS\system32\dllcache\sysmain.sdb

2008-08-10 23:20 . 2006-10-04 17:06	764,868	---------	D:\WINDOWS\system32\dllcache\apph_sp.sdb

2008-08-10 23:20 . 2006-10-04 17:06	217,118	---------	D:\WINDOWS\system32\dllcache\apphelp.sdb

2008-08-10 23:20 . 2008-08-10 23:20	23,392	--a------	D:\WINDOWS\system32\nscompat.tlb

2008-08-10 23:20 . 2008-08-10 23:20	16,832	--a------	D:\WINDOWS\system32\amcompat.tlb

2008-08-10 23:19 . 2008-08-10 23:32	<DIR>	d--------	D:\WINDOWS\system32\LogFiles

2008-08-10 23:19 . 2008-08-10 23:20	<DIR>	d--------	D:\Program Files\Your Uninstaller 2008

2008-08-10 23:19 . 2008-08-10 23:19	<DIR>	d----c---	D:\Program Files\UltraISO

2008-08-10 23:19 . 2008-08-10 23:19	<DIR>	d----c---	D:\Program Files\Common Files\EZB Systems

2008-08-10 23:19 . 2008-08-11 12:01	<DIR>	d-a--c---	D:\Documents and Settings\All Users\Application Data\TEMP

2008-08-10 23:19 . 2008-08-10 23:19	<DIR>	d----c---	D:\Documents and Settings\Administrator\Application Data\URSoft

2008-08-10 23:19 . 2008-08-10 23:19	316,640	--a------	D:\WINDOWS\WMSysPr9.prx

2008-08-10 23:19 . 2006-09-25 17:58	23,856	--a------	D:\WINDOWS\system32\spupdsvc.exe

2008-08-10 23:18 . 2008-08-10 23:18	<DIR>	d----c---	D:\Program Files\QuickTime

2008-08-10 23:18 . 2008-08-10 23:18	<DIR>	d----c---	D:\Program Files\ImTOO

2008-08-10 23:17 . 2008-08-10 23:17	<DIR>	d--------	D:\Program Files\Webteh

2008-08-10 23:17 . 2004-03-09 01:00	1,081,616	--a------	D:\WINDOWS\system32\MSCOMCTL.OCX

2008-08-10 23:17 . 2004-08-04 08:00	92,672	--a------	D:\WINDOWS\system32\dskquota.dll

2008-08-10 23:17 . 2008-08-10 23:17	51,355	--a------	D:\WINDOWS\system32\muzika.xm

2008-08-10 23:16 . 2008-08-10 23:16	<DIR>	d----c---	D:\Program Files\Hf

2008-08-10 23:16 . 2007-01-23 00:26	17,264	--a------	D:\WINDOWS\system32\drivers\hfxp2.sys

2008-08-10 23:15 . 2008-08-10 23:15	<DIR>	d----c---	D:\Program Files\Realtek

2008-08-10 23:14 . 2008-08-10 23:25	<DIR>	d----c---	D:\Program Files\Common Files\InstallShield

2008-08-10 23:13 . 2008-08-10 23:13	<DIR>	d----c---	D:\WINDOWS\system32\DRVSTORE

2008-08-10 23:13 . 2008-08-10 23:39	<DIR>	d--h-c---	D:\Program Files\InstallShield Installation Information

2008-08-10 23:13 . 2008-08-10 23:13	<DIR>	d----c---	D:\Program Files\AMD

2008-08-10 23:13 . 2008-08-10 23:13	<DIR>	d----c---	D:\Documents and Settings\Administrator\Application Data\InstallShield

2008-08-10 23:13 . 2006-07-01 23:37	39,424	--a------	D:\WINDOWS\system32\drivers\AmdK8.sys

2008-08-10 23:06 . 2008-08-10 23:06	<DIR>	d--hsc---	D:\Documents and Settings\LocalService

2008-08-10 23:06 . 2008-08-11 00:09	<DIR>	d----c---	D:\Documents and Settings\Administrator

2008-08-10 23:06 . 2008-08-10 23:06	8,192	--a------	D:\WINDOWS\REGLOCS.OLD

2008-08-10 23:05 . 2008-08-10 23:06	<DIR>	d--hsc---	D:\Documents and Settings\NetworkService

2008-08-10 23:05 . 2008-08-10 23:05	2,577	--a------	D:\WINDOWS\system32\CONFIG.NT

2008-08-10 23:05 . 2008-08-10 23:05	0	--a------	D:\WINDOWS\control.ini

2008-08-10 23:04 . 2008-08-11 00:18	<DIR>	d--------	D:\WINDOWS\system32\dllcache

2008-08-10 23:04 . 2008-08-10 23:04	749	-rah-----	D:\WINDOWS\WindowsShell.Manifest

2008-08-10 23:04 . 2008-08-10 23:04	749	-rah-----	D:\WINDOWS\system32\wuaucpl.cpl.manifest

2008-08-10 23:04 . 2008-08-10 23:04	749	-rah-----	D:\WINDOWS\system32\sapi.cpl.manifest

2008-08-10 23:04 . 2008-08-10 23:04	749	-rah-----	D:\WINDOWS\system32\nwc.cpl.manifest

2008-08-10 23:04 . 2008-08-10 23:04	749	-rah-----	D:\WINDOWS\system32\ncpa.cpl.manifest

2008-08-10 23:04 . 2008-08-10 23:04	749	-rah-----	D:\WINDOWS\system32\cdplayer.exe.manifest

2008-08-10 23:04 . 2008-08-10 23:04	488	-rah-----	D:\WINDOWS\system32\WindowsLogon.manifest

2008-08-10 23:04 . 2008-08-10 23:04	488	-rah-----	D:\WINDOWS\system32\logonui.exe.manifest

2008-08-10 23:02 . 2008-08-10 23:03	<DIR>	d--------	D:\Program Files\Windows Media Connect 2

2008-08-04 15:32 . 2008-08-04 15:32	984,576	--a------	D:\WINDOWS\system32\syssetup.dll

2008-08-04 15:32 . 2008-06-20 13:44	360,960	--a------	D:\WINDOWS\system32\drivers\tcpip.sys

2008-08-04 15:32 . 2008-08-04 15:32	140,288	--a------	D:\WINDOWS\system32\sfc_os.dll

2008-08-04 15:32 . 2008-08-04 15:32	1,435	--a------	D:\WINDOWS\system32\mmdriver.inf

2008-08-04 13:42 . 2008-02-21 10:55	286,336	--a------	D:\WINDOWS\system32\drivers\yk51x86.sys



.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-10 20:15	315,392	----a-w	D:\WINDOWS\HideWin.exe

2008-06-20 17:36	245,248	----a-w	D:\WINDOWS\system32\mswsock.dll

2008-06-20 17:36	245,248	------w	D:\WINDOWS\system32\dllcache\mswsock.dll

2008-06-20 17:36	147,968	------w	D:\WINDOWS\system32\dllcache\dnsapi.dll

2008-06-20 10:44	360,960	------w	D:\WINDOWS\system32\dllcache\tcpip.sys

2008-06-20 10:44	138,368	----a-w	D:\WINDOWS\system32\drivers\afd.sys

2008-06-20 10:44	138,368	------w	D:\WINDOWS\system32\dllcache\afd.sys

2008-06-20 09:32	225,920	------w	D:\WINDOWS\system32\dllcache\tcpip6.sys

2008-06-13 13:10	272,128	------w	D:\WINDOWS\system32\drivers\bthport.sys

2008-06-13 13:10	272,128	------w	D:\WINDOWS\system32\dllcache\bthport.sys

.



(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4



[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hfxp"="D:\Program Files\Hf\hfxp.exe" [2007-06-21 18:51 271828]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]



[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:56 15360]



[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

"ShowDeskFix"="shell32" [X]



[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoDesktopCleanupWizard"= 1 (0x1)

"HideRunAsVerb"= 1 (0x1)



[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMHelp"= 1 (0x1)

"ForceClassicControlPanel"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

"NoResolveSearch"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)



[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoInternetIcon"= 1 (0x1)

"NoSMHelp"= 1 (0x1)

"ForceClassicControlPanel"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

"NoResolveSearch"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)



[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.YV12"= yv12vfw.dll



[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders	schannel.dll, digest.dll



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=



R0 HFXP2;HFXP2;D:\WINDOWS\system32\DRIVERS\HFXP2.SYS [2007-01-23 00:26]

R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;D:\WINDOWS\system32\Drivers\SSFS0BB8.SYS [2007-06-15 13:21]

R2 ACDaemon;ArcSoft Connect Daemon;D:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2007-12-18 10:15]

R3 MBAMSwissArmy;MBAMSwissArmy;D:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-07-30 20:07]



[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

DcomLaunch	REG_MULTI_SZ   	DcomLaunch



*Newly Created Service* - CATCHME

*Newly Created Service* - MBAMSWISSARMY

.

.

------- Supplementary Scan -------

.

FireFox -: Profile - D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dqzth5mj.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fi





**************************************************************************



catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-11 12:06:14

Windows 5.1.2600 Service Pack 2 NTFS



scanning hidden processes ... 



scanning hidden autostart entries ...



scanning hidden files ... 



scan completed successfully

hidden files: 0



**************************************************************************

.

Completion time: 2008-08-11 12:06:32

ComboFix-quarantined-files.txt  2008-08-11 09:06:31



Pre-Run: 18,347,479,040 bytes free

Post-Run: 18,336,079,872 bytes free



192	--- E O F ---	2008-08-10 21:18:36

---