[jmterry]

OK, Great. Here it is:

ComboFix 09-09-02.02 - latitude 09/02/2009 20:09.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.503 [GMT -4:00]
Running from: c:\documents and settings\latitude\Desktop\456out.com
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\74d60de.msp
.
((((((((((((((((((((((((( Files Created from 2009-08-03 to 2009-09-03 )))))))))))))))))))))))))))))))
.
2009-09-01 23:56 . 2009-09-01 23:59 -------- d-----w- C:\rsit
2009-09-01 23:27 . 2009-09-01 23:27 -------- d-----w- c:\documents and settings\latitude\Application Data\Malwarebytes
2009-09-01 23:27 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-01 23:27 . 2009-09-01 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-01 23:27 . 2009-09-01 23:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-01 23:27 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-30 00:29 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-08-29 23:16 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-08-29 23:02 . 2009-08-29 23:02 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
2009-08-29 23:02 . 2009-08-29 23:02 -------- d-----w- c:\program files\Lavasoft
2009-08-29 21:51 . 2009-09-01 23:52 -------- d-----w- c:\documents and settings\All Users\Application Data\gra
2009-08-25 00:35 . 2009-08-25 00:35 -------- d-----w- c:\documents and settings\jonathan\Local Settings\Application Data\Apple
2009-08-23 04:54 . 2009-08-23 04:54 -------- d-----w- c:\documents and settings\jonathan\Application Data\Research In Motion
2009-08-22 03:06 . 2009-08-27 22:55 -------- d-----w- c:\documents and settings\jonathan\Application Data\Audacity
2009-08-22 03:05 . 2009-08-22 03:06 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2009-08-16 16:29 . 2009-08-16 16:29 -------- d-----w- c:\documents and settings\jonathan\Local Settings\Application Data\Adobe
2009-08-15 21:26 . 2009-08-15 21:26 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-08-15 21:06 . 2009-08-15 21:06 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-08-15 21:05 . 2009-08-15 21:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-13 10:13 . 2009-08-13 10:13 -------- d-----w- C:\0a4e28f38f8974e08d888b
2009-08-12 10:50 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-06 02:22 . 2009-08-06 02:22 -------- d-----w- c:\windows\system32\Adobe
2009-08-06 02:19 . 1998-10-02 23:00 327168 ----a-w- c:\windows\IsUninst.exe
2009-08-05 15:48 . 2009-08-05 15:48 -------- d-----w- c:\documents and settings\jordan\Application Data\Research In Motion
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-08-30 23:02 . 2009-04-07 17:45 -------- d-----w- c:\documents and settings\latitude\Application Data\dvdcss
2009-08-29 22:42 . 2009-02-26 19:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-23 13:05 . 2009-08-03 04:23 63952 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-08-23 13:01 . 2009-03-09 13:53 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-23 13:01 . 2009-03-09 13:53 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-23 13:01 . 2009-03-09 13:53 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-23 13:01 . 2009-06-23 23:07 -------- d-----w- c:\documents and settings\jonathan\Application Data\acccore
2009-08-23 05:09 . 2009-06-23 23:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-08-23 05:08 . 2009-06-23 23:05 -------- d-----w- c:\program files\Common Files\AOL
2009-08-16 23:45 . 2009-03-24 23:32 -------- d-----w- c:\program files\Google
2009-08-14 19:16 . 2009-04-10 01:52 51972 ---ha-w- c:\windows\system32\mlfcache.dat
2009-08-06 02:22 . 2008-10-10 18:31 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-02 23:58 . 2009-02-26 12:42 -------- d-----w- c:\documents and settings\latitude\Application Data\InstallShield
2009-08-02 23:57 . 2009-06-19 23:03 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-08-02 23:55 . 2009-08-02 23:54 -------- d-----w- c:\program files\Roxio
2009-08-02 23:54 . 2009-06-19 23:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2009-08-02 23:54 . 2009-08-02 23:54 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-08-02 23:40 . 2009-06-19 22:59 -------- d-----w- c:\program files\Common Files\Research In Motion
2009-08-02 21:35 . 2009-08-02 21:34 -------- d-----w- c:\program files\QuickTime
2009-08-01 15:58 . 2009-01-09 18:55 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-30 21:38 . 2009-01-09 22:42 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-07-30 20:00 . 2009-01-09 22:42 -------- d-----w- c:\program files\NOS
2009-07-29 03:30 . 2009-07-29 03:30 -------- d-----w- c:\documents and settings\LocalService\Application Data\DivX
2009-07-27 11:46 . 2009-03-09 13:53 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-16 01:30 . 2009-03-31 11:58 -------- d-----w- c:\documents and settings\latitude\Application Data\Move Networks
2009-07-14 03:43 . 2004-08-04 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-08 23:15 . 2009-04-20 22:28 62568 ----a-w- c:\documents and settings\jordan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-01 15:33 . 2009-03-29 22:32 62568 ----a-w- c:\documents and settings\matthew\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 16:12 . 2004-08-04 12:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-25 08:25 . 2004-08-04 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2004-08-04 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2004-08-04 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-20 16:00 . 2009-06-19 23:10 256 ----a-w- c:\windows\system32\pool.bin
2009-06-19 23:11 . 2008-10-10 14:01 62568 -c--a-w- c:\documents and settings\latitude\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-17 22:06 . 2009-04-10 03:36 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2004-08-04 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2008-10-09 22:29 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-04 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2009-03-24 39408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-07 344064]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-07-21 1228800]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-23 2007832]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-28 68592]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-03-24 30192]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-07-02 623960]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-04-11 236016]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-8-5 113664]
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-23 13:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/29/2009 7:16 PM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [3/9/2009 9:53 AM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [3/9/2009 9:53 AM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [3/9/2009 9:53 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [3/9/2009 9:53 AM 297752]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 10:49 AM 1029456]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/23/2009 7:06 PM 24652]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtip ci21.sys [10/10/2008 10:39 AM 88192]
S2 gupdate1ca1dec4a3ebe56;Google Update Service (gupdate1ca1dec4a3ebe56);c:\program files\Google\Update\GoogleUpdate.exe [8/15/2009 5:06 PM 133104]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe --> c:\program files\NOS\bin\getPlus_HelperSvc.exe [?]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [3/24/2009 7:59 PM 30192]
.
Contents of the 'Scheduled Tasks' folder
2009-08-29 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]
2009-09-03 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 21:05]
2009-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-15 21:06]
2009-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-15 21:06]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
HKLM-Run-NWEReboot - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 20:19
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macrome d\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUt il10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(712)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(2244)
c:\windows\system32\WININET.dll
c:\program files\Google\Quick Search Box\bin\1.2.1137.3514\qsb.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\searchindexer.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
************************************************** ************************
.
Completion time: 2009-09-03 20:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-03 00:23
Pre-Run: 60,048,080,896 bytes free
Post-Run: 61,387,034,624 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect
242 --- E O F --- 2009-08-26 07:00