[Closed] Can't get rid of winIgn.exe

There's a certain file named winIgn.exe (with a capital I, not a lowercase L) I can't seem to shake off. I've tried deleting it with Hijackthis and removing it while on safe mode, but Spybot S&D notifies me every day or so that the file keeps reappearing, and Hijackthis confirms it. Here is a Hijackthis log. Help will be very appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:17 AM, on 3/4/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Executive

Software\DiskeeperLite\DkService.exe
C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\IDU\IDUServ.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys\Linksys

Updater\bin\LinksysUpdater.exe
C:\Program Files\Norton Internet Security\Norton

AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Common

Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VBTUCopy\VBTUCopy.exe
C:\Program Files\Common Files\Pure Networks

Shared\Platform\nmsrvc.exe
E:\dvd\Power ISO v3.8 + keygen [h33t]

[Original]\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Pure Networks

Shared\Platform\nmctxth.exe
C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys

EasyLink Advisor.exe
C:\Program

Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common

Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\NETGEAR\WPN111 Configuration

Utility\wpn111.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Norton Internet Security\Norton

AntiVirus\SAVScan.exe
C:\Program Files\Common

Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start

Page = http://www.gmail.com/
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search

Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start

Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window

Title = Microsoft Internet Explorer provided by Comcast
O2 - BHO: Spybot-S&D IE Protection -

{53707962-6F74-2D53-2644-206D7942484F} -

E:\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class -

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045}

- (no file)
O2 - BHO: Windows Live Sign-in Helper -

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Common Files\Microsoft Shared\Windows

Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO -

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program

Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe

RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline

Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [IgfxTray]

C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKLM\..\Run: [High Definition Audio Property Page

Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP

Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [LogitechCommunicationsManager]

"C:\Program Files\Common

Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program

Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VBTUCopy] C:\Program

Files\VBTUCopy\VBTUCopy.exe /a /f
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero

7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] E:\dvd\Power ISO v3.8 +

keygen [h33t] [Original]\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program

Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common

Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common

Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QTTask.exe"

-atboottime
O4 - HKLM\..\Run: [LELA] "C:\Program Files\Linksys\Linksys

EasyLink Advisor\Linksys EasyLink Advisor.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Program

Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program

Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Spybot - Search &

Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] E:\music\DAEMON Tools

Lite\daemon.exe -autorun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program

Files\Common Files\LightScribe\LightScribeControlPanel.exe

-hidden
O4 - HKCU\..\Run: [32NFG94-H61-2SF-N1P-5M1ERH6L6]

C:\RECYCLER\S-1-5-21-2727286392-8143256373-342365730-5195\wi

nIgn.exe
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ComcastHSI -

{669B269B-0D4E-41FB-A3D8-FD67CA94F646} -

http://www.comcast.net/ (file missing)
O9 - Extra button: AIM -

{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program

Files\AIM\aim.exe
O9 - Extra button: (no name) -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

E:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy

Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

E:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF: ActiveGS.cab -

http://virtualapple.org/activegs.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl

Class) -

http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}

(WUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en

/x86/client/wuweb_site.cab?1177062051374
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616}

(DivXBrowserPlugin Object) -

http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}

(MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en

/x86/client/muweb_site.cab?1177062041952
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A}

(MJLauncherCtrl Class) -

http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games

- Installer) -

http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsPAClient.

cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave

Flash Object) -

http://fpdownload2.macromedia.com/get/flashplayer/current/sw

flash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program

Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) -

Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) -

Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Diskeeper Lite.lnk (Diskeeper) - Executive

Software International, Inc. - C:\Program Files\Executive

Software\DiskeeperLite\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google -

C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Desktop Utilities Service

(iHCService) - OSA Technologies, Inc. - C:\Program

Files\Intel\IDU\IDUServ.exe
O23 - Service: LightScribeService Direct Disc Labeling

Service (LightScribeService) - Hewlett-Packard Company -

C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown

owner - C:\Program Files\Linksys\Linksys

Updater\bin\LinksysUpdater.exe
O23 - Service: Norton AntiVirus Auto Protect Service

(navapsvc) - Symantec Corporation - C:\Program Files\Norton

Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel®

Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pure Networks Platform Service (nmservice) -

Pure Networks, Inc. - C:\Program Files\Common Files\Pure

Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) -

NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program

Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec

Corporation -

C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) -

Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\SNDSrvc.exe

–
End of file - 10774 bytes

Alright then, here we go:


DDS (Ver_09-02-01.01) - FAT32x86
Run by [removed] at 10:49:21.04 on Wed 03/04/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_01
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.602 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\IDU\IDUServ.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VBTUCopy\VBTUCopy.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
E:\dvd\Power ISO v3.8 + keygen [h33t] [Original]\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\NETGEAR\WPN111 Configuration Utility\wpn111.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\music\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.gmail.com/
uSearch Page = hxxp://www.google.com
uWindow Title = Microsoft Internet Explorer provided by Comcast
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title = Microsoft Internet Explorer provided by Comcast
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - e:\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [BitTorrent] "c:\program files\bittorrent\bittorrent.exe" –force_start_minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] e:\spybot - search & destroy\TeaTimer.exe
uRun: [DAEMON Tools Lite] e:\music\daemon tools lite\daemon.exe -autorun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [32NFG94-H61-2SF-N1P-5M1ERH6L6] c:\recycler\s-1-5-21-2727286392-8143256373-342365730-5195\winIgn.exe
mRun: [USRpdA] c:\windows\system32\usrmlnka.exe runservices \device\3cpipe-USRpdA
mRun: [PC Booster] c:\program files\inkline global\pc booster\pcbooster.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [farstone] NULL
mRun: [High Definition Audio Property Page Shortcut] HDAShCut.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam10\QuickCam10.exe" /hide
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [VBTUCopy] c:\program files\vbtucopy\VBTUCopy.exe /a /f
mRun: [SecurDisc] c:\program files\nero\nero 7\incd\NBHGui.exe
mRun: [PWRISOVM.EXE] e:\dvd\power iso v3.8 + keygen [h33t] [original]\poweriso\PWRISOVM.EXE
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [QuickTime Task] "F:\QTTask.exe" -atboottime
mRun: [LELA] "c:\program files\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized
StartupFolder: c:\docume~1\x\startm~1\programs\startup\erunta~1.lnk - f:\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wpn111 configuration utility\wpn111.exe
IE: E&xport to Microsoft Excel - e:\office11\EXCEL.EXE/3000
IE: {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - f:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\spybot~1\SDHelper.dll
DPF: ActiveGS.cab - hxxp://virtualapple.org/activegs.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236144730984
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236144695546
DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp3.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\x\applic~1\mozilla\firefox\profiles\z51ruv2w.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - gmail.com
FF - plugin: c:\documents and settings\x\application data\mozilla\firefox\profiles\z51ruv2w.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: e:\divx web player\divx content uploader\npUpload.dll
FF - plugin: e:\divx web player\divx player\npDivxPlayerPlugin.dll
FF - plugin: e:\divx web player\divx web player\npdivx32.dll
FF - plugin: e:\real alternative\browser\plugins\nppl3260.dll
FF - plugin: e:\real alternative\browser\plugins\nprpjplug.dll
FF - plugin: f:\plugins\npqtplugin.dll
FF - plugin: f:\plugins\npqtplugin2.dll
FF - plugin: f:\plugins\npqtplugin3.dll
FF - plugin: f:\plugins\npqtplugin4.dll
FF - plugin: f:\plugins\npqtplugin5.dll
FF - plugin: f:\plugins\npqtplugin6.dll
FF - plugin: f:\plugins\npqtplugin7.dll

============= SERVICES / DRIVERS ===============

R0 VVBackd5;VVBackd5;c:\windows\system32\drivers\VVBackd5.sys [2007-4-19 180074]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2003-9-5 255136]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2003-9-5 218272]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2003-9-5 234656]
R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-4-18 204800]
R2 navapsvc;Norton AntiVirus Auto Protect Service;c:\program files\norton internet security\norton antivirus\navapsvc.exe [2003-8-17 158376]
R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2004-6-1 10386]
R2 SAVRTPEL;SAVRTPEL;c:\program files\norton internet security\norton antivirus\Savrtpel.sys [2003-8-6 35008]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20070418.024\NAVENG.Sys [2007-4-20 77688]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20070418.024\NavEx15.Sys [2007-4-20 852824]
R3 SAVRT;SAVRT;c:\program files\norton internet security\norton antivirus\savrt.sys [2003-8-6 300736]
R3 SAVScan;SAVScan;c:\program files\norton internet security\norton antivirus\SAVScan.exe [2003-8-9 193816]
S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2003-9-5 87200]

=============== Created Last 30 ================

2009-03-04 00:32 31,768 a——- c:\windows\system32\wucltui.dll.mui
2009-03-04 00:32 23,576 a——- c:\windows\system32\wuaucpl.cpl.mui
2009-03-04 00:32 18,456 a——- c:\windows\system32\wuaueng.dll.mui
2009-03-04 00:32 –d—– c:\windows\system32\SoftwareDistribution
2009-03-03 10:42 90,624 a——- c:\documents and settings\x\ine32.exe
2009-02-28 14:41 –d—– c:\program files\Trend Micro
2009-02-28 14:20 396,288 a——- c:\program files\HijackThis.exe
2009-02-27 23:53 90,624 a——- c:\documents and settings\x\uiove32.exe
2009-02-10 14:25 –d—– c:\windows\SxsCaPendDel
2009-02-09 17:07 44,097 a——- c:\documents and settings\x\jiri32.exe
2009-02-09 11:43 –d—– c:\program files\WebEx
2009-02-09 11:38 –d—– c:\windows\system32\XPSViewer
2009-02-09 11:36 14,048 ——– c:\windows\system32\spmsg2.dll
2009-02-09 11:35 –d—– c:\docume~1\alluse~1\applic~1\Linksys
2009-02-09 11:31 23,992 a——- c:\windows\system32\drivers\pnarp.sys
2009-02-09 11:31 25,272 a——- c:\windows\system32\drivers\purendis.sys
2009-02-09 11:31 –d—– c:\program files\common files\Pure Networks Shared
2009-02-09 11:31 –d—– c:\docume~1\alluse~1\applic~1\Pure Networks
2009-02-09 11:29 –d—– c:\program files\Linksys

==================== Find3M ====================

2009-02-26 23:52 44,114 a——- c:\documents and settings\x\cni32.exe
2009-02-15 23:23 44,097 a——- c:\documents and settings\x\vss632.exe
2009-01-30 12:40 44,097 a——- c:\documents and settings\x\vsss32.exe
2009-01-20 20:12 19,968 a——- c:\documents and settings\x\loku.exe
2009-01-20 20:12 19,968 —shr– c:\windows\fxstaller.exe
2009-01-19 09:53 29,250 a——- c:\documents and settings\x\winp32.exe
2009-01-09 11:41 29,249 a——- c:\documents and settings\x\winpadd23.exe
2008-11-30 17:45 87,608 a——- c:\docume~1\x\applic~1\inst.exe
2008-11-30 17:45 47,360 a——- c:\docume~1\x\applic~1\pcouffin.sys
2006-05-03 05:06 163,328 —shr– c:\windows\system32\flvDX.dll
2007-02-21 06:47 31,232 —shr– c:\windows\system32\msfDX.dll
2007-12-17 08:43 27,648 —sh— c:\windows\system32\Smab0.dll
2008-02-04 14:26 151,040 —sh— c:\windows\system32\VistaUltm.dll

============= FINISH: 10:50:32.75 ===============

OTMoveIT3 results:

========== PROCESSES ==========
Process teatimer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\32NFG94-H61-2SF-N1P-5M1ERH6L6 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\farstone deleted successfully.
========== FILES ==========
c:\documents and settings\x\cni32.exe moved successfully.
c:\documents and settings\x\vss632.exe moved successfully.
c:\documents and settings\x\vsss32.exe moved successfully.
c:\documents and settings\x\loku.exe moved successfully.
c:\windows\fxstaller.exe moved successfully.
c:\documents and settings\x\winp32.exe moved successfully.
c:\documents and settings\x\winpadd23.exe moved successfully.
c:\documents and settings\x\ine32.exe moved successfully.
c:\documents and settings\x\uiove32.exe moved successfully.
c:\windows\SxsCaPendDel moved successfully.
c:\documents and settings\x\jiri32.exe moved successfully.
File move failed. c:\recycler\s-1-5-21-2727286392-8143256373-342365730-5195\winIgn.exe scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\x\LOCALS~1\Temp\etilqs_gckvQaRmQvNRAGdALTWz scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\XUL.mfl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03052009_103825

Files moved on Reboot…
c:\recycler\s-1-5-21-2727286392-8143256373-342365730-5195\winIgn.exe moved successfully.
File C:\DOCUME~1\x\LOCALS~1\Temp\etilqs_gckvQaRmQvNRAGdALTWz not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\XUL.mfl moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\urlclassifier3.sqlite moved successfully.


Panda ActiveScan Results:


;*******************************************************************************
*********************************************************************************
*******************
ANALYSIS: 2009-03-05 23:19:57
PROTECTIONS: 1
MALWARE: 32
SUSPECTS: 0
;*******************************************************************************
*********************************************************************************
*******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
=================================================================================
===================
Norton Antivirus 2004 10.00 No No
;===============================================================================
=================================================================================
===================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
=================================================================================
===================
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@trafficmp[2].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@247realmedia[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@tribalfusion[1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.com.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@com[1].txt
00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.yadro.ru/]
00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.yadro.ru/]
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.xiti.com/]
00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@azjmp[1].txt
00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\[removed][1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\[removed]-sys[2].txt
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\[removed][2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\[removed][2].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.overture.com/]
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@overture[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.overture.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@realmedia[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@questionmarket[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.questionmarket.com/]
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.adultfriendfinder.com/]
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.adultfriendfinder.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.go.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.go.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.go.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.go.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.go.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.go.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.go.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.go.com/]
00199231 HackTool/EvID HackTools No 0 Yes No F:\MUSIC\EvID4226Patch223d-en\EvID4226Patch.exe
00199231 HackTool/EvID HackTools No 0 Yes No F:\MUSIC\EvID4226Patch223d-en.zip[EvID4226Patch.exe]
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[searchportal.information.com/]
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@target[1].txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@did-it[1].txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\FOUND.007\FILE0002.CHK[.did-it.com/]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\X\Cookies\x@atwola[1].txt
00457416 Bck/Sdbot.LZB Virus/Trojan No 1 Yes No C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\SMARTMGR.EXE
00958505 Generic Malware Virus/Trojan No 0 Yes No C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll
01192570 W32/Gaobot.PTC.worm Virus/Worm No 1 Yes No C:\WINDOWS\SYSTEM32\DCMHLP.EXE
02941683 ASF/GetaCodec.A Virus No 0 Yes No F:\MUSIC\ludacrus he-man.mp3
02941683 ASF/GetaCodec.A Virus No 0 Yes No F:\MUSIC\Mariah Carey - Vision of love.mp3
02941683 ASF/GetaCodec.A Virus No 0 Yes No F:\MUSIC\r kelly turnback hands of time.mp3
02941683 ASF/GetaCodec.A Virus No 0 Yes No F:\MUSIC\st james choir the sunshine.mp3
02941683 ASF/GetaCodec.A Virus No 0 Yes No F:\MUSIC\Dizzie Rascal - Where's the G's.mp3
02941683 ASF/GetaCodec.A Virus No 0 Yes No F:\MUSIC\Busta Rhymes - Put your Hands where my Eyes could See.mp3
02941683 ASF/GetaCodec.A Virus No 0 Yes No F:\MUSIC\Nelly, P Diddy feat Murphy Lee - Shake Ya Tailfeather.mp3
03009106 W32/Xor-encoded.A Virus No 0 Yes No C:\Documents and Settings\X\Local Settings\Application Data\DNA\Cache\E639DB82957B63AF8A705E422AA084CCEA0161E5
04745285 Trj/Downloader.MDW Virus/Trojan No 0 Yes No C:\Documents and Settings\X\IVENE32.EXE
04745285 Trj/Downloader.MDW Virus/Trojan No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\documents and settings\X\CNI32.EXE
04761683 Generic Trojan Virus/Trojan No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\WINDOWS\fxstaller.exe
04761683 Generic Trojan Virus/Trojan No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\documents and settings\X\LOKU.EXE
04835806 Trj/Downloader.MDW Virus/Trojan No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\documents and settings\X\VSSS32.EXE
04835806 Trj/Downloader.MDW Virus/Trojan No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\documents and settings\X\VSS632.EXE
04835806 Trj/Downloader.MDW Virus/Trojan No 0 Yes No C:\Documents and Settings\X\Local Settings\Temporary Internet Files\Content.IE5\705DJ8CA\vss[1].exe
04835806 Trj/Downloader.MDW Virus/Trojan No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\documents and settings\X\JIRI32.EXE
04943808 Generic Trojan Virus/Trojan No 0 Yes No C:\RECYCLER\S-1-5-21-0243336031-4052116379-881863308-0851\VSE432.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP397\A0089208.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP397\A0089168.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP400\A0089616.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP400\A0089593.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP398\A0089350.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\RECYCLER\S-1-5-21-6354859352-0936431374-240810291-5065\winIgn.exe
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP398\A0089334.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP398\A0089333.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP398\A0089293.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\RECYCLER\S-1-5-21-9891771236-2864104170-981624810-6146\winIgn.exe
05105479 Adware/AccesMembre Adware No 0 Yes No C:\RECYCLER\S-1-5-21-8719121488-9934513924-327428610-3894\winIgn.exe
05105479 Adware/AccesMembre Adware No 0 Yes No C:\RECYCLER\S-1-5-21-5865958530-1170005888-207459606-8110\winIgn.exe
05105479 Adware/AccesMembre Adware No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\documents and settings\X\INE32.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\documents and settings\X\UIOVE32.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{F3769F7F-C037-448B-9D3E-BC22BDC9F905}\RP398\A0089344.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No F:\_OTMoveIt\MovedFiles\03052009_103825\RECYCLER\s-1-5-21-2727286392-8143256373-342365730-5195\winIgn.exe
05105479 Adware/AccesMembre Adware No 0 Yes No C:\Documents and Settings\X\IVDENE32.EXE
05105479 Adware/AccesMembre Adware No 0 Yes No C:\Documents and Settings\X\Local Settings\Temporary Internet Files\Content.IE5\705DJ8CA\kim66[1].exe
05105479 Adware/AccesMembre Adware Yes 1 Yes No c:\recycler\s-1-5-21-8791402132-8232592034-363641285-2195\winign.exe
;===============================================================================
=================================================================================
===================
SUSPECTS
Sent Location 
;===============================================================================
=================================================================================
===================
;===============================================================================
=================================================================================
===================
VULNERABILITIES
Id Severity Description 
;===============================================================================
=================================================================================
===================
184380 MEDIUM MS08-002 
184379 MEDIUM MS08-001 
182048 HIGH MS07-069 
182046 HIGH MS07-067 
182043 HIGH MS07-064 
179553 HIGH MS07-061 
176382 HIGH MS07-057 
176383 HIGH MS07-058 
170911 HIGH MS07-050 
170907 HIGH MS07-046 
170906 HIGH MS07-045 
170904 HIGH MS07-043 
164915 HIGH MS07-035 
164913 HIGH MS07-033 
164911 HIGH MS07-031 
160623 HIGH MS07-027 
157262 HIGH MS07-022 
157261 HIGH MS07-021 
157260 HIGH MS07-020 
157259 HIGH MS07-019 
156477 HIGH MS07-017 
150253 HIGH MS07-016 
150249 HIGH MS07-013 
150248 HIGH MS07-012 
150247 HIGH MS07-011 
150243 HIGH MS07-008 
150242 HIGH MS07-007 
150241 MEDIUM MS07-006 
145501 HIGH MS07-004 
141034 HIGH MS06-076 
141033 MEDIUM MS06-075 
137571 HIGH MS06-070 
133387 MEDIUM MS06-065 
133386 MEDIUM MS06-064 
133385 MEDIUM MS06-063 
133379 HIGH MS06-057 
129977 MEDIUM MS06-053 
129976 MEDIUM MS06-052 
126093 HIGH MS06-051 
126092 MEDIUM MS06-050 
126087 HIGH MS06-046 
126086 MEDIUM MS06-045 
126082 HIGH MS06-041 
126081 HIGH MS06-040 
123421 HIGH MS06-036 
123420 HIGH MS06-035 
120825 MEDIUM MS06-032 
120823 MEDIUM MS06-030 
120818 HIGH MS06-025 
120815 HIGH MS06-022 
117384 MEDIUM MS06-018 
114666 HIGH MS06-015 
108744 MEDIUM MS06-008 
108743 MEDIUM MS06-007 
108742 MEDIUM MS06-006 
104567 HIGH MS06-002 
104237 HIGH MS06-001 
96574 HIGH MS05-053 
93395 HIGH MS05-051 
93394 HIGH MS05-050 
93454 MEDIUM MS05-049 
;===============================================================================
=================================================================================
===================

HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:56 PM, on 3/5/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\IDU\IDUServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VBTUCopy\VBTUCopy.exe
E:\dvd\Power ISO v3.8 + keygen [h33t] [Original]\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\NETGEAR\WPN111 Configuration Utility\wpn111.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VBTUCopy] C:\Program Files\VBTUCopy\VBTUCopy.exe /a /f
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] E:\dvd\Power ISO v3.8 + keygen [h33t] [Original]\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKLM\..\Run: [LELA] "C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] E:\music\DAEMON Tools Lite\daemon.exe -autorun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [32NFG94-H61-2SF-N1P-5M1ERH6L6] C:\RECYCLER\S-1-5-21-2727286392-8143256373-342365730-5195\winIgn.exe
O4 - Startup: ERUNT AutoBackup.lnk = F:\ERUNT\AUTOBACK.EXE
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ActiveGS.cab - http://virtualapple.org/activegs.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1236144730984
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1236144695546
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Diskeeper Lite.lnk (Diskeeper) - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Desktop Utilities Service (iHCService) - OSA Technologies, Inc. - C:\Program Files\Intel\IDU\IDUServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

–
End of file - 11101 bytes


I'm still getting the "C:/Recyclers" warnings from WinPatrol and Spybot S&D.

OTMoveIT3 results:

========== PROCESSES ==========
Process teatimer.exe killed successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\32NFG94-H61-2SF-N1P-5M1ERH6L6 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\farstone deleted successfully.
========== FILES ==========
C:\RECYCLER\S-1-5-21-0243336031-4052116379-881863308-0851\vse432.exe moved successfully.
C:\Documents and Settings\X\ivene32.exe moved successfully.
C:\RECYCLER\S-1-5-21-6354859352-0936431374-240810291-5065\winIgn.exe moved successfully.
C:\RECYCLER\S-1-5-21-9891771236-2864104170-981624810-6146\winIgn.exe moved successfully.
C:\RECYCLER\S-1-5-21-8719121488-9934513924-327428610-3894\winIgn.exe moved successfully.
C:\RECYCLER\S-1-5-21-5865958530-1170005888-207459606-8110\winIgn.exe moved successfully.
C:\Documents and Settings\X\ivdene32.exe moved successfully.
File move failed. c:\recycler\s-1-5-21-8791402132-8232592034-363641285-2195\winIgn.exe scheduled to be moved on reboot.
File move failed. C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\smartmgr.exe scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\x\LOCALS~1\Temp\etilqs_oAZIewFQfRSuZEPB1GrR scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_7c.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03062009_100130

Files moved on Reboot…
c:\recycler\s-1-5-21-8791402132-8232592034-363641285-2195\winIgn.exe moved successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\smartmgr.exe moved successfully.
File C:\DOCUME~1\x\LOCALS~1\Temp\etilqs_oAZIewFQfRSuZEPB1GrR not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_7c.dat not found!
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\x\Local Settings\Application Data\Mozilla\Firefox\Profiles\z51ruv2w.default\urlclassifier3.sqlite moved successfully.

SystemLook scan:

SystemLook v1.0 by jpshortstuff (02.03.09)
Log created at 10:07 on 06/03/2009 by x (Administrator - Elevation successful)

========== file ==========

C:\WINDOWS\SYSTEM32\DCMHLP.EXE - File found and opened.
MD5: 19C1B1A57B03D867EED68DF1086E3F2E
Created at 05:11 on 23/06/2007
Modified at 23:40 on 17/06/2007
Size: 366080 bytes
Attributes: –a—
No version information available.

========== dir ==========

C:\recycler - Parameters: "/s"

—Files—
None found.

C:\recycler\S-1-5-21-0243336031-4052116379-881863308-0850 dr-hs- [02:57 03/01/2009]
Desktop.ini –ahs- 63 bytes [02:57 03/01/2009] [04:51 04/03/2009]

C:\recycler\S-1-5-21-0243336031-4052116379-881863308-0851 dr-hs- [22:07 09/02/2009]
Desktop.ini –ahs- 63 bytes [22:07 09/02/2009] [06:26 26/02/2009]

C:\recycler\S-1-5-21-0243336031-4052116379-881863308-0950 dr-hs- [20:43 09/01/2009]
Desktop.ini –ahs- 63 bytes [20:43 09/01/2009] [14:53 19/01/2009]

C:\recycler\S-1-5-21-0243356031-1052126379-381833308-1850 dr-hs- [00:49 29/01/2009]
Desktop.ini –ahs- 63 bytes [00:49 29/01/2009] [05:55 05/03/2009]

C:\recycler\S-1-5-21-0427800380-7298178523-711718374-5639 dr-hs- [16:08 05/03/2009]
Desktop.ini –ahs- 63 bytes [16:08 05/03/2009] [16:08 05/03/2009]

C:\recycler\S-1-5-21-0926215482-1651316048-657076140-3888 dr-hs- [15:27 05/03/2009]
Desktop.ini –ahs- 63 bytes [15:27 05/03/2009] [15:27 05/03/2009]

C:\recycler\S-1-5-21-1386194150-5813800350-415221598-3978 dr-hs- [06:11 28/02/2009]
Desktop.ini –ahs- 63 bytes [06:11 28/02/2009] [06:11 28/02/2009]

C:\recycler\S-1-5-21-1459734226-5315470274-846081254-9221 dr-hs- [14:54 06/03/2009]
Desktop.ini –ahs- 63 bytes [14:54 06/03/2009] [14:54 06/03/2009]

C:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013 dr-hs- [20:50 02/01/2009]
Desktop.ini –ahs- 62 bytes [20:50 02/01/2009] [14:53 06/03/2009]

C:\recycler\S-1-5-21-2727286392-8143256373-342365730-5195 dr-hs- [04:53 28/02/2009]
Desktop.ini –ahs- 63 bytes [04:53 28/02/2009] [04:53 28/02/2009]

C:\recycler\S-1-5-21-2757996846-3558984656-557492912-4044 dr-hs- [14:50 03/03/2009]
Desktop.ini –ahs- 63 bytes [14:50 03/03/2009] [14:50 03/03/2009]

C:\recycler\S-1-5-21-4108953138-9631668022-662499817-3730 dr-hs- [15:27 05/03/2009]
Desktop.ini –ahs- 63 bytes [15:27 05/03/2009] [15:27 05/03/2009]

C:\recycler\S-1-5-21-4322104078-2274279845-385016827-9486 dr-hs- [19:53 28/02/2009]
Desktop.ini –ahs- 63 bytes [19:53 28/02/2009] [19:53 28/02/2009]

C:\recycler\S-1-5-21-4960809831-0925141102-061357755-3119 dr-hs- [19:53 28/02/2009]
Desktop.ini –ahs- 63 bytes [19:53 28/02/2009] [19:53 28/02/2009]

C:\recycler\S-1-5-21-5099860461-9747548218-089263247-3653 dr-hs- [14:07 01/03/2009]
Desktop.ini –ahs- 63 bytes [14:07 01/03/2009] [14:07 01/03/2009]

C:\recycler\S-1-5-21-5557472070-7060955789-443712896-8149 dr-hs- [15:43 03/03/2009]
Desktop.ini –ahs- 63 bytes [15:43 03/03/2009] [15:43 03/03/2009]

C:\recycler\S-1-5-21-5754049538-7343161171-857716711-6859 dr-hs- [16:57 28/02/2009]
Desktop.ini –ahs- 63 bytes [16:57 28/02/2009] [16:57 28/02/2009]

C:\recycler\S-1-5-21-5865958530-1170005888-207459606-8110 dr-hs- [19:53 28/02/2009]
Desktop.ini –ahs- 63 bytes [19:53 28/02/2009] [19:53 28/02/2009]

C:\recycler\S-1-5-21-6218661689-3012551568-812372920-4665 dr-hs- [15:36 28/02/2009]
Desktop.ini –ahs- 63 bytes [15:36 28/02/2009] [15:36 28/02/2009]

C:\recycler\S-1-5-21-6354859352-0936431374-240810291-5065 dr-hs- [15:44 05/03/2009]
Desktop.ini –ahs- 63 bytes [15:44 05/03/2009] [15:44 05/03/2009]

C:\recycler\S-1-5-21-6581656074-3109655013-139461691-3277 dr-hs- [14:50 03/03/2009]
Desktop.ini –ahs- 63 bytes [14:50 03/03/2009] [14:50 03/03/2009]

C:\recycler\S-1-5-21-6890065135-8674050363-245126793-1209 dr-hs- [05:59 06/03/2009]
Desktop.ini –ahs- 63 bytes [05:59 06/03/2009] [05:59 06/03/2009]

C:\recycler\S-1-5-21-7060446128-8991424471-092728327-8403 dr-hs- [15:27 05/03/2009]
Desktop.ini –ahs- 63 bytes [15:27 05/03/2009] [15:27 05/03/2009]

C:\recycler\S-1-5-21-8566783970-6393249137-144528731-9370 dr-hs- [16:09 05/03/2009]
Desktop.ini –ahs- 63 bytes [16:09 05/03/2009] [16:09 05/03/2009]

C:\recycler\S-1-5-21-8642865800-9556614243-384002000-1143 dr-hs- [16:08 05/03/2009]
Desktop.ini –ahs- 63 bytes [16:08 05/03/2009] [16:08 05/03/2009]

C:\recycler\S-1-5-21-8719121488-9934513924-327428610-3894 dr-hs- [04:36 04/03/2009]
Desktop.ini –ahs- 63 bytes [04:36 04/03/2009] [04:36 04/03/2009]

C:\recycler\S-1-5-21-8791402132-8232592034-363641285-2195 dr-hs- [15:58 05/03/2009]
Desktop.ini –ahs- 63 bytes [15:58 05/03/2009] [15:58 05/03/2009]

C:\recycler\S-1-5-21-9022668546-4756274125-581064370-9634 dr-hs- [04:24 05/03/2009]
Desktop.ini –ahs- 63 bytes [04:24 05/03/2009] [04:24 05/03/2009]

C:\recycler\S-1-5-21-9891771236-2864104170-981624810-6146 dr-hs- [05:17 04/03/2009]
Desktop.ini –ahs- 63 bytes [05:17 04/03/2009] [05:18 04/03/2009]

C:\recycler\S-1-5-21-9986192023-6883142626-169855927-3926 dr-hs- [16:08 05/03/2009]
Desktop.ini –ahs- 63 bytes [16:08 05/03/2009] [16:08 05/03/2009]

-=End Of File=-

DDS scan:


DDS (Ver_09-02-01.01) - FAT32x86
Run by [removed] at 10:09:21.35 on Fri 03/06/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.347 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\IDU\IDUServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\java.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VBTUCopy\VBTUCopy.exe
E:\dvd\Power ISO v3.8 + keygen [h33t] [Original]\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\NETGEAR\WPN111 Configuration Utility\wpn111.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\music\SystemLook.exe
C:\WINDOWS\notepad.exe
F:\music\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.gmail.com/
uSearch Page = hxxp://www.google.com
uWindow Title = Microsoft Internet Explorer provided by Comcast
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title = Microsoft Internet Explorer provided by Comcast
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - e:\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [BitTorrent] "c:\program files\bittorrent\bittorrent.exe" –force_start_minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] e:\spybot - search & destroy\TeaTimer.exe
uRun: [DAEMON Tools Lite] e:\music\daemon tools lite\daemon.exe -autorun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [32NFG94-H61-2SF-N1P-5M1ERH6L6] c:\recycler\s-1-5-21-2727286392-8143256373-342365730-5195\winIgn.exe
mRun: [USRpdA] c:\windows\system32\usrmlnka.exe runservices \device\3cpipe-USRpdA
mRun: [PC Booster] c:\program files\inkline global\pc booster\pcbooster.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [High Definition Audio Property Page Shortcut] HDAShCut.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam10\QuickCam10.exe" /hide
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [VBTUCopy] c:\program files\vbtucopy\VBTUCopy.exe /a /f
mRun: [SecurDisc] c:\program files\nero\nero 7\incd\NBHGui.exe
mRun: [PWRISOVM.EXE] e:\dvd\power iso v3.8 + keygen [h33t] [original]\poweriso\PWRISOVM.EXE
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [QuickTime Task] "F:\QTTask.exe" -atboottime
mRun: [farstone] NULL
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [LELA] "c:\program files\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized
StartupFolder: c:\docume~1\x\startm~1\programs\startup\erunta~1.lnk - f:\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wpn111 configuration utility\wpn111.exe
IE: E&xport to Microsoft Excel - e:\office11\EXCEL.EXE/3000
IE: {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - f:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\spybot~1\SDHelper.dll
DPF: ActiveGS.cab - hxxp://virtualapple.org/activegs.cab
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236144730984
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236144695546
DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp3.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\x\applic~1\mozilla\firefox\profiles\z51ruv2w.default\
FF - prefs.js: browser.startup.homepage - gmail.com
FF - plugin: c:\documents and settings\x\application data\mozilla\firefox\profiles\z51ruv2w.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: e:\divx web player\divx content uploader\npUpload.dll
FF - plugin: e:\divx web player\divx player\npDivxPlayerPlugin.dll
FF - plugin: e:\divx web player\divx web player\npdivx32.dll
FF - plugin: e:\real alternative\browser\plugins\nppl3260.dll
FF - plugin: e:\real alternative\browser\plugins\nprpjplug.dll
FF - plugin: f:\plugins\npqtplugin.dll
FF - plugin: f:\plugins\npqtplugin2.dll
FF - plugin: f:\plugins\npqtplugin3.dll
FF - plugin: f:\plugins\npqtplugin4.dll
FF - plugin: f:\plugins\npqtplugin5.dll
FF - plugin: f:\plugins\npqtplugin6.dll
FF - plugin: f:\plugins\npqtplugin7.dll

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-3-5 28544]
R0 VVBackd5;VVBackd5;c:\windows\system32\drivers\VVBackd5.sys [2007-4-19 180074]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2003-9-5 255136]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2003-9-5 218272]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2003-9-5 234656]
R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-4-18 204800]
R2 navapsvc;Norton AntiVirus Auto Protect Service;c:\program files\norton internet security\norton antivirus\navapsvc.exe [2003-8-17 158376]
R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2004-6-1 10386]
R2 SAVRTPEL;SAVRTPEL;c:\program files\norton internet security\norton antivirus\Savrtpel.sys [2003-8-6 35008]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20070418.024\NAVENG.Sys [2007-4-20 77688]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20070418.024\NavEx15.Sys [2007-4-20 852824]
R3 SAVRT;SAVRT;c:\program files\norton internet security\norton antivirus\savrt.sys [2003-8-6 300736]
R3 SAVScan;SAVScan;c:\program files\norton internet security\norton antivirus\SAVScan.exe [2003-8-9 193816]
S2 SBService;ScriptBlocking Service;c:\progra~1\common~1\symant~1\script~1\SBServ.exe [2003-6-24 66784]
S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2003-9-5 87200]
S4 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2007-4-20 23856]

=============== Created Last 30 ================

2009-03-05 11:18 28,544 a——- c:\windows\system32\drivers\pavboot.sys
2009-03-05 11:18 –d—– c:\program files\Panda Security
2009-03-05 11:13 410,984 a——- c:\windows\system32\deploytk.dll
2009-03-05 11:13 73,728 a——- c:\windows\system32\javacpl.cpl
2009-03-04 00:32 31,768 a——- c:\windows\system32\wucltui.dll.mui
2009-03-04 00:32 23,576 a——- c:\windows\system32\wuaucpl.cpl.mui
2009-03-04 00:32 18,456 a——- c:\windows\system32\wuaueng.dll.mui
2009-03-04 00:32 23,576 a——- c:\windows\system32\wuapi.dll.mui
2009-03-04 00:32 –d—– c:\windows\system32\SoftwareDistribution
2009-02-28 14:41 –d—– c:\program files\Trend Micro
2009-02-28 14:20 396,288 a——- c:\program files\HijackThis.exe
2009-02-09 11:43 –d—– c:\program files\WebEx
2009-02-09 11:38 –d—– c:\windows\system32\XPSViewer
2009-02-09 11:36 14,048 ——– c:\windows\system32\spmsg2.dll
2009-02-09 11:35 –d—– c:\docume~1\alluse~1\applic~1\Linksys
2009-02-09 11:31 23,992 a——- c:\windows\system32\drivers\pnarp.sys
2009-02-09 11:31 25,272 a——- c:\windows\system32\drivers\purendis.sys
2009-02-09 11:31 –d—– c:\program files\common files\Pure Networks Shared
2009-02-09 11:31 –d—– c:\docume~1\alluse~1\applic~1\Pure Networks
2009-02-09 11:29 –d—– c:\program files\Linksys

==================== Find3M ====================

2008-11-30 17:45 87,608 a——- c:\docume~1\x\applic~1\inst.exe
2008-11-30 17:45 47,360 a——- c:\docume~1\x\applic~1\pcouffin.sys
2006-05-03 05:06 163,328 —shr– c:\windows\system32\flvDX.dll
2007-02-21 06:47 31,232 —shr– c:\windows\system32\msfDX.dll
2007-12-17 08:43 27,648 —sh— c:\windows\system32\Smab0.dll
2008-02-04 14:26 151,040 —sh— c:\windows\system32\VistaUltm.dll

============= FINISH: 10:09:59.40 ===============


I didn't receive any C:/Recyclers warnings this time around, but I'll give it about a week before I start celebrating.

I have sent you the file you've requested, here's another Hijackthis log. The winign.exe file didn't show up in the scan this time around, and I'm leaving Farstone alone. The computer seems to run fine now. Thank you for your help.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:47:07 AM, on 3/7/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\IDU\IDUServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VBTUCopy\VBTUCopy.exe
E:\dvd\Power ISO v3.8 + keygen [h33t] [Original]\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\NETGEAR\WPN111 Configuration Utility\wpn111.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VBTUCopy] C:\Program Files\VBTUCopy\VBTUCopy.exe /a /f
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] E:\dvd\Power ISO v3.8 + keygen [h33t] [Original]\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] E:\music\DAEMON Tools Lite\daemon.exe -autorun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - Startup: ERUNT AutoBackup.lnk = F:\ERUNT\AUTOBACK.EXE
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ActiveGS.cab - http://virtualapple.org/activegs.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1236144730984
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1236144695546
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Diskeeper Lite.lnk (Diskeeper) - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Desktop Utilities Service (iHCService) - OSA Technologies, Inc. - C:\Program Files\Intel\IDU\IDUServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

–
End of file - 10648 bytes

DDS (Ver_09-02-01.01) - FAT32x86
Run by [removed] at 9:31:55.03 on Tue 03/10/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.393 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\IDU\IDUServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VBTUCopy\VBTUCopy.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
E:\dvd\Power ISO v3.8 + keygen [h33t] [Original]\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\NETGEAR\WPN111 Configuration Utility\wpn111.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\music\utorrent.exe
E:\Spybot - Search & Destroy\TeaTimer.exe
F:\music\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.gmail.com/
uSearch Page = hxxp://www.google.com
uWindow Title = Microsoft Internet Explorer provided by Comcast
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title = Microsoft Internet Explorer provided by Comcast
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - e:\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [BitTorrent] "c:\program files\bittorrent\bittorrent.exe" –force_start_minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DAEMON Tools Lite] e:\music\daemon tools lite\daemon.exe -autorun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [SpybotSD TeaTimer] e:\spybot - search & destroy\TeaTimer.exe
uRun: [32NFG94-H61-2SF-N1P-5M1ERH6L6] c:\recycler\s-1-5-21-2727286392-8143256373-342365730-5195\winIgn.exe
mRun: [USRpdA] c:\windows\system32\usrmlnka.exe runservices \device\3cpipe-USRpdA
mRun: [PC Booster] c:\program files\inkline global\pc booster\pcbooster.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [High Definition Audio Property Page Shortcut] HDAShCut.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam10\QuickCam10.exe" /hide
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [VBTUCopy] c:\program files\vbtucopy\VBTUCopy.exe /a /f
mRun: [SecurDisc] c:\program files\nero\nero 7\incd\NBHGui.exe
mRun: [PWRISOVM.EXE] e:\dvd\power iso v3.8 + keygen [h33t] [original]\poweriso\PWRISOVM.EXE
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [QuickTime Task] "F:\QTTask.exe" -atboottime
mRun: [farstone] NULL
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [LELA] "c:\program files\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized
StartupFolder: c:\docume~1\x\startm~1\programs\startup\erunta~1.lnk - f:\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wpn111 configuration utility\wpn111.exe
IE: E&xport to Microsoft Excel - e:\office11\EXCEL.EXE/3000
IE: {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - f:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\spybot~1\SDHelper.dll
DPF: ActiveGS.cab - hxxp://virtualapple.org/activegs.cab
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236144730984
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236144695546
DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp3.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\x\applic~1\mozilla\firefox\profiles\z51ruv2w.default\
FF - prefs.js: browser.startup.homepage - gmail.com
FF - plugin: c:\documents and settings\x\application data\mozilla\firefox\profiles\z51ruv2w.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: e:\divx web player\divx content uploader\npUpload.dll
FF - plugin: e:\divx web player\divx player\npDivxPlayerPlugin.dll
FF - plugin: e:\divx web player\divx web player\npdivx32.dll
FF - plugin: e:\real alternative\browser\plugins\nppl3260.dll
FF - plugin: e:\real alternative\browser\plugins\nprpjplug.dll
FF - plugin: f:\plugins\npqtplugin.dll
FF - plugin: f:\plugins\npqtplugin2.dll
FF - plugin: f:\plugins\npqtplugin3.dll
FF - plugin: f:\plugins\npqtplugin4.dll
FF - plugin: f:\plugins\npqtplugin5.dll
FF - plugin: f:\plugins\npqtplugin6.dll
FF - plugin: f:\plugins\npqtplugin7.dll

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-3-5 28544]
R0 VVBackd5;VVBackd5;c:\windows\system32\drivers\VVBackd5.sys [2007-4-19 180074]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2003-9-5 255136]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2003-9-5 218272]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2003-9-5 234656]
R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-4-18 204800]
R2 navapsvc;Norton AntiVirus Auto Protect Service;c:\program files\norton internet security\norton antivirus\navapsvc.exe [2003-8-17 158376]
R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2004-6-1 10386]
R2 SAVRTPEL;SAVRTPEL;c:\program files\norton internet security\norton antivirus\Savrtpel.sys [2003-8-6 35008]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20070418.024\NAVENG.Sys [2007-4-20 77688]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20070418.024\NavEx15.Sys [2007-4-20 852824]
R3 SAVRT;SAVRT;c:\program files\norton internet security\norton antivirus\savrt.sys [2003-8-6 300736]
R3 SAVScan;SAVScan;c:\program files\norton internet security\norton antivirus\SAVScan.exe [2003-8-9 193816]
S2 SBService;ScriptBlocking Service;c:\progra~1\common~1\symant~1\script~1\SBServ.exe [2003-6-24 66784]
S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2003-9-5 87200]
S4 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2007-4-20 23856]

=============== Created Last 30 ================

2009-03-05 11:18 28,544 a——- c:\windows\system32\drivers\pavboot.sys
2009-03-05 11:18 –d—– c:\program files\Panda Security
2009-03-05 11:13 410,984 a——- c:\windows\system32\deploytk.dll
2009-03-05 11:13 73,728 a——- c:\windows\system32\javacpl.cpl
2009-03-04 00:32 31,768 a——- c:\windows\system32\wucltui.dll.mui
2009-03-04 00:32 23,576 a——- c:\windows\system32\wuaucpl.cpl.mui
2009-03-04 00:32 18,456 a——- c:\windows\system32\wuaueng.dll.mui
2009-03-04 00:32 23,576 a——- c:\windows\system32\wuapi.dll.mui
2009-03-04 00:32 –d—– c:\windows\system32\SoftwareDistribution
2009-02-28 14:41 –d—– c:\program files\Trend Micro
2009-02-28 14:20 396,288 a——- c:\program files\HijackThis.exe
2009-02-09 11:43 –d—– c:\program files\WebEx
2009-02-09 11:38 –d—– c:\windows\system32\XPSViewer
2009-02-09 11:36 14,048 ——– c:\windows\system32\spmsg2.dll
2009-02-09 11:35 –d—– c:\docume~1\alluse~1\applic~1\Linksys
2009-02-09 11:31 23,992 a——- c:\windows\system32\drivers\pnarp.sys
2009-02-09 11:31 25,272 a——- c:\windows\system32\drivers\purendis.sys
2009-02-09 11:31 –d—– c:\program files\common files\Pure Networks Shared
2009-02-09 11:31 –d—– c:\docume~1\alluse~1\applic~1\Pure Networks
2009-02-09 11:29 –d—– c:\program files\Linksys

==================== Find3M ====================

2008-11-30 17:45 87,608 a——- c:\docume~1\x\applic~1\inst.exe
2008-11-30 17:45 47,360 a——- c:\docume~1\x\applic~1\pcouffin.sys
2006-05-03 05:06 163,328 —shr– c:\windows\system32\flvDX.dll
2007-02-21 06:47 31,232 —shr– c:\windows\system32\msfDX.dll
2007-12-17 08:43 27,648 —sh— c:\windows\system32\Smab0.dll
2008-02-04 14:26 151,040 —sh— c:\windows\system32\VistaUltm.dll

============= FINISH: 9:32:29.45 ===============