Hi:

Was having a problem with IE and Firefox browser redirects as well as constant script debugging pop ups; ran AVG, avast, malwarebytes. etc. and while several trojans were located, they did not seem to be the ones causing the redirect.  I see that you advise against using Combofix, but I see that too late (just joined this community today anhd already ran Combofix last night... sorry!).

Everything seems to be OK now (no more redirects or pop ups), but I would like to post the log to let somebody smarter than me tell me if it looks good... could you take a look?

Thanks much!

 

ComboFix 10-05-30.02 - Matt 05/30/2010  20:28:02.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.2038.1548 [GMT -4:00]
Running from: c:\program files\ComboFix.exe
AV:  *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW:  *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\SET8F6.tmp
c:\program files\Internet Explorer\SET92F.tmp
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
G:\Autorun.inf.vir

Infected copy of c:\windows\system32\drivers\intelppm.sys was found and disinfected
Restored copy from - Kitty had a snack :p
.
(((((((((((((((((((((((((   Files Created from 2010-04-28 to 2010-05-31  )))))))))))))))))))))))))))))))
.

2010-05-31 00:07 . 2010-05-31 00:08 3701026 ----a-r- c:\program files\ComboFix.exe
2010-05-30 23:33 . 2010-02-28 00:46 3691384 ----a-w- c:\documents and settings\Matt\Application Data\Simply Super Software\Trojan Remover\dnv1.exe
2010-05-30 23:29 . 2010-02-28 00:46 3691384 ----a-w- c:\documents and settings\Matt\Application Data\Simply Super Software\Trojan Remover\wqyA.exe
2010-05-30 23:22 . 2006-06-19 16:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-05-30 23:22 . 2006-05-25 18:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-05-30 23:22 . 2005-08-26 04:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-05-30 23:22 . 2003-02-02 23:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-05-30 23:22 . 2002-03-06 04:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-05-30 23:22 . 2010-05-30 23:22 -------- d-----w- c:\program files\Trojan Remover
2010-05-30 23:22 . 2010-05-30 23:22 -------- d-----w- c:\documents and settings\Matt\Application Data\Simply Super Software
2010-05-30 23:22 . 2010-05-30 23:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2010-05-29 19:52 . 2010-05-30 23:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-05-29 19:52 . 2010-05-29 19:52 -------- d-----w- c:\program files\Alwil Software
2010-05-29 15:52 . 2010-05-29 15:52 12872 ----a-w- c:\windows\system32\bootdelete.exe
2010-05-29 15:45 . 2010-05-29 15:54 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-05-29 15:45 . 2010-05-29 15:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-05-29 15:45 . 2010-05-29 15:45 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-05-29 12:44 . 2010-05-30 23:57 0 ----a-w- c:\documents and settings\Matt\Local Settings\Application Data\prvlcl.dat
2010-05-26 20:39 . 2010-05-29 02:26 -------- d-----w- c:\documents and settings\Matt\Local Settings\Application Data\mdqcoajft
2010-05-01 21:21 . 2010-05-01 21:21 -------- d-----w- c:\documents and settings\Matt\Local Settings\Application Data\AVG Security Toolbar

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-31 00:10 . 2009-04-18 22:02 -------- d-----w- c:\documents and settings\Matt\Application Data\StumbleUpon
2010-05-30 23:34 . 2008-12-15 22:33 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-29 16:01 . 2009-04-04 18:03 -------- d-----w- c:\program files\Registry Easy
2010-05-29 15:52 . 2009-07-22 03:29 -------- d-----w- c:\documents and settings\Matt\Application Data\IMVUClient
2010-05-29 14:02 . 2010-03-08 14:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-26 20:46 . 2009-06-21 21:46 400040 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-05-19 19:47 . 2009-07-11 14:42 -------- d-----w- c:\program files\Runes of Magic
2010-05-16 19:08 . 2010-02-17 22:28 -------- d-----w- c:\documents and settings\Matt\Application Data\Skype
2010-05-13 20:53 . 2010-04-05 00:46 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-05-12 12:08 . 2010-02-17 22:31 -------- d-----w- c:\documents and settings\Matt\Application Data\skypePM
2010-04-29 19:39 . 2010-03-08 14:48 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2010-03-08 14:48 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-21 13:03 . 2010-04-05 00:47 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-07 18:43 . 2010-04-07 18:43 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-04-07 18:43 . 2010-03-30 17:30 -------- d-----w- c:\program files\McAfee Security Scan
2010-04-06 22:26 . 2008-09-15 21:01 -------- d-----w- c:\program files\Curse
2010-04-05 01:13 . 2008-02-23 20:18 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-04-05 00:47 . 2010-04-05 00:47 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-04-05 00:47 . 2010-04-05 00:47 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-04-05 00:47 . 2010-04-05 00:47 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-04-05 00:43 . 2010-04-05 00:43 -------- d-----w- c:\program files\AVG
2010-04-05 00:43 . 2010-04-05 00:43 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-04-01 01:19 . 2009-09-17 00:58 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-11 12:38 . 2004-08-10 16:51 832512 ----a-w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2004-08-10 16:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2004-08-10 16:50 17408 ----a-w- c:\windows\system32\corpol.dll
2010-03-09 11:09 . 2004-08-10 16:51 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-04 21:47 . 2007-11-04 20:22 3766 -csha-w- c:\windows\system32\KGyGaAvL.sys
2010-03-04 21:47 . 2007-11-04 20:22 88 -csh--r- c:\windows\system32\B84294D66C.sys
2006-12-03 20:23 . 2006-12-03 20:23 774144 -c--a-w- c:\program files\RngInterstitial.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-04-19 14:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 1117184]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2010-02-28 1165192]

c:\documents and settings\Matt\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2010-4-6 0]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-04-05 00:47 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ    \0
path=
backup=
backupExtension=Common Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG111T Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WG111T Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt^Start Menu^Programs^Startup^IMVU.lnk]
backup=c:\windows\pss\IMVU.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt^Start Menu^Programs^Startup^Xfire.lnk]
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Aware]
2005-05-27 18:24 865280 ----a-w- c:\program files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 21:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 15:09 460784 ----a-w- c:\program files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellTransferAgent]
2007-11-13 21:46 135168 ----a-w- c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 09:20 122940 ----a-w- c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-11-01 07:12 94208 ----a-w- c:\program files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-10-15 00:46 77824 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-10-15 00:50 114688 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2005-10-15 00:49 94208 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-06-10 14:44 249856 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-06-10 14:44 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-07-13 18:03 292128 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 4200 Series]
2004-01-16 10:04 57344 ----a-w- c:\program files\Lexmark 4200 Series\lxbmbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 19:39 1090952 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2006-07-30 00:34 5354792 ----a-w- c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 18:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-08-14 02:24 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-10-17 00:23 77824 ----a-w- c:\program files\Java\jre1.6.0\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-09-17 00:59 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
2006-06-29 23:42 707376 ----a-w- c:\windows\vVX1000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WTClient]
2007-04-11 16:27 40960 ----a-w- c:\windows\system32\WTClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinTabService"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"Symantec Core LC"=2 (0x2)
"StumbleUponUpdateService"=3 (0x3)
"SQLAgent$MICROSOFTSMLBIZ"=3 (0x3)
"PnkBstrA"=2 (0x2)
"MSSQLServerADHelper"=3 (0x3)
"MSSQL$MICROSOFTSMLBIZ"=2 (0x2)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\123Movies2PSP\\123Movies2PSP.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\msncall.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\America's Army Deploy Client\\AADeployClient.exe"=
"c:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"57024:TCP"= 57024:TCP:Pando Media Booster
"57024:UDP"= 57024:UDP:Pando Media Booster

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/4/2010 8:47 PM 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/4/2010 8:47 PM 242896]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [4/4/2010 8:45 PM 308064]
R3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\drivers\PTSimBus.sys [6/7/2007 1:16 PM 18944]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/7/2010 6:58 PM 135664]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [4/4/2010 8:46 PM 430152]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [7/11/2006 12:51 PM 17149]
S3 HitmanPro35Crusader;Hitman Pro 3.5 Crusader;c:\program files\Hitman Pro 3.5\HitmanPro35[1].exe [5/29/2010 11:45 AM 5937984]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
S3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\drivers\PTSimHid.sys [4/23/2007 11:28 AM 10752]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S4 StumbleUponUpdateService;StumbleUponUpdateService;c:\program files\StumbleUpon\StumbleUponUpdateService.exe [12/8/2009 6:41 PM 120232]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/26/2009 9:59 PM 24652]
.
Contents of the 'Scheduled Tasks' folder

2010-05-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 22:58]

2010-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 22:58]

2010-05-29 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe [2009-04-04 20:29]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyOverride =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
IE: { {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Matt\Start Menu\Programs\IMVU\Run IMVU.lnk
IE: { {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Trusted Zone: musicmatch.com\online
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-CurseClient - c:\program files\Curse\CurseClient.exe
MSConfigStartUp-SBAMTray - c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe
MSConfigStartUp-Steam - f:\new folder\Steam.exe
AddRemove-JSSPELL - c:\ka\JSSPELL\DeIsL1.isu
AddRemove-Steam App 10180 - f:\new folder\steam.exe
AddRemove-Steam App 10190 - f:\new folder\steam.exe
AddRemove-IMVU Avatar chat client software BETA - c:\documents and settings\Matt\Application Data\IMVUClient\Uninstall.exe

 

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-30 20:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
"ImagePath"="\"c:\program files\Hitman Pro 3.5\HitmanPro35
[1].exe\" /crusader"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HitmanPro35Crusader]
"ImagePath"="\"c:\program files\Hitman Pro 3.5\HitmanPro35
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-939190463-3541678745-1569300308-1009\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
@SACL=
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(820)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-05-30  20:42:19
ComboFix-quarantined-files.txt  2010-05-31 00:42

Pre-Run: 8,799,412,224 bytes free
Post-Run: 9,210,122,240 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - EC112BE91BB766ADA489C2A06FA509D5