h2oman2000
Topic Starter
The system in question is a Dell Precision M6400, OS: Windows Vista Ultimate SP1 with Norton Internet Security 2009,Avast!antivirus and MBAM.
The last avast! Antivirus boot scan that I ran Identified the Win32:agent-ABKH and the last MBAM I ran detected “Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.”
After browsing the forum I've discovered a few more things. In my startup files from MSCONFIG There is an entry for C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe /T:NTRU12. There are few more strange looking entries in here as well.
I had to switch computers to enter this topic because it would not let attach the any thing. Firefox made the page look different.
Help Please!!!!
Here is the DDS log as requested.
DDS (Ver_09-03-16.01) - NTFSx86
Run by [removed] at 18:28:38.25 on Mon 03/16/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_12
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.3571.2005 [GMT -5:00]
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_505c1590\STacSV.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_505c1590\aestsrv.exe
C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe
C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\Program Files\EPSON Projector\EPSON USB Display V1.4\EMP_UDSA.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\rundll32.exe
C:\Windows\system32\sdclt.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Toby Lott PRN\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = https://remote.coastalmc.com/Remote/logon.a…e%2flogoff.aspx
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.5.0.134\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.5.0.134\IPSBHO.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.5.0.134\coIEPlg.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
uRun: [NVIDIA nTune] c:\program files\nvidia corporation\ntune\nTuneCmd.exe resetprofile
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ChangeTPMAuth] c:\program files\wave systems corp\common\ChangeTPMAuth.exe /T:NTRU12
mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
mRun: [SecureUpgrade] c:\program files\wave systems corp\SecureUpgrade.exe
mRun: [EmbassySecurityCheck] "c:\program files\wave systems corp\embassy security setup\EMBASSYSecurityCheck.exe"
mRun: [DCPstrApp] c:\program files\dell\dell controlpoint\security manager\SecurityDeviceInfoSetRegistryString.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"
mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"
mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\programdata\scansoft\paperport\11\config\ereg\Ereg.ini"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,Start
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [basicsmssmenu] "c:\program files\seagate\basics\basics status\MaxMenuMgrBasics.exe"
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [NBKeyScan] "c:\program files\nero\nero backitup 4\NBKeyScan.exe"
mRun: [QuickBooksDB19] c:\progra~1\intuit\quickb~1\qbdbmgrn.exe -n qb_tobylottprn2-pc_19 -qs -gd all -gk all -gp 4096 -gu all -ch 64m -c 32m -x tcpip(broadcastlistener=no;port=55333) -ti 0 -ec simple -qi -qw -tl 120 -oe c:\progra~2\intuit\quickb~2\DBSTAR~1.LOG -y
mRun: [EPSON_UD_START] "c:\program files\epson projector\epson usb display v1.4\EMP_UD.exe" -UDCONNECT
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\eventl~1.lnk - c:\program files\jm integrated remote station\cms\EventLogger.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{871df2be-41d2-4334-ac33-839af16fc8fe}\Icon3E5562ED7.ico
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {D6E0B119-DCF2-4CD6-8DFB-7CFF1B70F7FF} - hxxps://bis.na.blackberry.com/html/web/client_tools/TOImport.cab
Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2009\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\engine\16.5.0.134\CoIEPlg.dll
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll
LSA: Authentication Packages = msv1_0 wvauth
================= FIREFOX ===================
FF - ProfilePath - c:\users\tobylo~1\appdata\roaming\mozilla\firefox\profiles\x34iy6k3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - component: c:\program files\mozilla firefox\extensions\{01a8ca0a-4c96-465b-a49b-65c46fad54f9}\components\Contribute.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npContribute.dll
FF - plugin: c:\program files\vistacodecpack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\vistacodecpack\rm\browser\plugins\nprpjplug.dll
============= SERVICES / DRIVERS ===============
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1005000.086\SymEFA.sys [2009-3-5 310320]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-3-15 114768]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1005000.086\BHDrvx86.sys [2009-3-5 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1005000.086\cchpx86.sys [2009-3-5 482352]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090310.003\IDSvix86.sys [2009-3-11 292912]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_505c1590\AEstSrv.exe [2009-3-7 81920]
R2 alssvc;Ambient Light Sensor;c:\program files\dell\ambient light sensor\AlsSvc.exe [2008-6-3 382232]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-3-15 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-3-15 51792]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\dell\dell controlpoint\DCPButtonSvc.exe [2008-9-4 406808]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2008-7-31 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2008-7-31 21352]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2008-11-11 451872]
R2 EMP_UDSA;EMP_UDSA;c:\program files\epson projector\epson usb display v1.4\EMP_UDSA.exe [2009-2-27 94208]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\common files\nero\nero backitup 4\NBService.exe [2008-12-5 935208]
R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\engine\16.5.0.134\ccSvcHst.exe [2009-3-5 115560]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\dell\dell controlpoint\connection manager\SMManager.exe [2008-9-9 69632]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-12-18 212992]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2008-12-18 29736]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [2008-12-18 32808]
R3 eppvad_simple;EPSON Projector UD Audio Device;c:\windows\system32\drivers\EMP_UDAU.sys [2009-2-27 17664]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-26 101936]
R3 qrkis;TetherBerry Miniport;c:\windows\system32\drivers\qrkis.sys [2009-3-8 45608]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\nis\1005000.086\symndisv.sys [2009-3-5 39984]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 288112]
S4 QuickBooksDB19;QuickBooksDB19;c:\progra~1\intuit\quickb~1\qbdbmgrn.exe -hvquickbooksdb19 –> c:\progra~1\intuit\quickb~1\QBDBMgrN.exe -hvQuickBooksDB19 [?]
=============== Created Last 30 ================
2009-03-16 14:52 –d—– c:\users\tobylo~1\appdata\roaming\wsInspector
2009-03-16 14:31 –d—– c:\program files\Startup Inspector for Windows
2009-03-16 08:45 22,872 a—-r– c:\windows\system32\AdobePDFUI.dll
2009-03-15 14:43 161,792 a——- c:\windows\SWREG.exe
2009-03-15 14:43 98,816 a——- c:\windows\sed.exe
2009-03-15 12:45 –d—– c:\users\tobylo~1\appdata\roaming\Malwarebytes
2009-03-15 12:45 15,504 a——- c:\windows\system32\drivers\mbam.sys
2009-03-15 12:45 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-15 12:45 –d—– c:\programdata\Malwarebytes
2009-03-15 12:45 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-03-15 12:45 –d—– c:\progra~2\Malwarebytes
2009-03-15 04:25 118 a——- c:\windows\system32\MRT.INI
2009-03-15 01:25 51,792 a——- c:\windows\system32\drivers\aswMonFlt.sys
2009-03-15 01:22 162,304 a——- c:\windows\system32\ztvunrar36.dll
2009-03-15 01:22 153,088 a——- c:\windows\system32\UNRAR3.dll
2009-03-15 01:22 77,312 a——- c:\windows\system32\ztvunace26.dll
2009-03-15 01:22 75,264 a——- c:\windows\system32\unacev2.dll
2009-03-15 01:22 69,632 a——- c:\windows\system32\ztvcabinet.dll
2009-03-15 01:22 –d—– c:\users\tobylo~1\appdata\roaming\Simply Super Software
2009-03-15 01:22 –d—– c:\programdata\Simply Super Software
2009-03-15 01:22 –d—– c:\program files\Trojan Remover
2009-03-15 01:22 –d—– c:\progra~2\Simply Super Software
2009-03-15 00:16 a-d—– c:\programdata\TEMP
2009-03-14 13:44 –d—– c:\program files\common files\Sonic Shared
2009-03-14 13:44 –d—– c:\program files\Roxio
2009-03-12 14:23 –d—– c:\users\toby lott prn\.asdm
2009-03-12 12:56 –d—– c:\program files\JM Integrated Remote Station
2009-03-12 10:51 256 a——- c:\windows\system32\pool.bin
2009-03-11 13:57 –d—– c:\users\tobylo~1\appdata\roaming\Blackberry Desktop
2009-03-11 13:43 –d—– c:\users\tobylo~1\appdata\roaming\Research In Motion
2009-03-11 13:04 –d—– c:\program files\common files\Research In Motion
2009-03-11 13:04 –d—– c:\program files\Research In Motion
2009-03-11 11:48 7,680 a——- c:\windows\system32\spwmp.dll
2009-03-11 11:48 4,096 a——- c:\windows\system32\msdxm.ocx
2009-03-11 11:48 4,096 a——- c:\windows\system32\dxmasf.dll
2009-03-11 11:48 8,147,456 a——- c:\windows\system32\wmploc.DLL
2009-03-11 11:47 268,288 a——- c:\windows\system32\schannel.dll
2009-03-11 11:47 2,033,152 a——- c:\windows\system32\win32k.sys
2009-03-08 22:08 26,496 a——- c:\windows\system32\drivers\RimSerial.sys
2009-03-08 22:04 45,608 a——- c:\windows\system32\drivers\qrkis.sys
2009-03-08 22:04 –d—– c:\program files\TetherBerry
2009-03-07 11:20 25,728 a——- c:\windows\system32\drivers\hidparse.sys
2009-03-07 11:11 –d—– c:\program files\Cisco
2009-03-07 11:11 772,936 a——- c:\windows\system32\oem87.inf
2009-03-07 10:58 53,248 a——- c:\windows\system32\CSVer.dll
2009-03-07 10:29 429,056 a——- c:\windows\system32\stapi32.dll
2009-03-07 10:29 404,480 a——- c:\windows\system32\stcplx.dll
2009-03-07 10:29 393,216 a——- c:\windows\system32\drivers\stwrt.sys
2009-03-07 10:29 168,960 a——- c:\windows\system32\st326124.dll
2009-03-06 20:26 –d—– C:\ExQuickRef
2009-02-27 19:16 17,664 a——- c:\windows\system32\drivers\EMP_UDAU.sys
2009-02-27 19:16 –d—– c:\program files\EPSON Projector
2009-02-27 19:07 –d—– c:\program files\epson
2009-02-27 19:00 27 a——- c:\windows\EX70.ini
2009-02-26 14:17 51 a——- c:\windows\DESI.INI
2009-02-26 14:16 –d—– c:\program files\DESI
2009-02-24 13:55 –d—– c:\program files\AskTBar
2009-02-23 16:34 –d–r– c:\program files\Norton Support
2009-02-19 20:05 34 a——- c:\windows\system32\bd407cdw.dat
2009-02-19 20:05 26 a——- c:\windows\BRPP2KA.INI
2009-02-16 09:50 428,544 a——- c:\windows\system32\EncDec.dll
2009-02-16 09:50 217,088 a——- c:\windows\system32\psisrndr.ax
2009-02-16 09:50 293,376 a——- c:\windows\system32\psisdecd.dll
2009-02-16 09:50 177,664 a——- c:\windows\system32\mpg2splt.ax
2009-02-16 09:50 80,896 a——- c:\windows\system32\MSNP.ax
==================== Find3M ====================
2009-03-16 14:56 6,396 a——- c:\windows\bthservsdp.dat
2009-03-16 08:02 270,339 a——- c:\programdata\nvModes.dat
2009-03-16 08:02 270,339 a——- c:\progra~2\nvModes.dat
2009-03-14 13:38 143,360 a——- c:\windows\inf\infstrng.dat
2009-03-14 13:38 86,016 a——- c:\windows\inf\infpub.dat
2009-03-14 13:38 86,016 a——- c:\windows\inf\infstor.dat
2009-03-07 11:30 665,600 a——- c:\windows\inf\drvindex.dat
2009-03-05 12:32 124,464 a——- c:\windows\system32\drivers\SYMEVENT.SYS
2009-03-05 12:32 7,386 a——- c:\windows\system32\drivers\SYMEVENT.CAT
2009-03-05 12:32 805 a——- c:\windows\system32\drivers\SYMEVENT.INF
2009-03-05 08:35 410,984 a——- c:\windows\system32\deploytk.dll
2009-02-27 06:20 25,136 a—-r– c:\windows\system32\drivers\SymIMV.sys
2009-02-04 17:33 0 a—h— c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-01-19 12:47 73,312 a——- c:\windows\system32\drivers\adfs.sys
2009-01-15 01:11 827,392 a——- c:\windows\system32\wininet.dll
2008-12-18 16:04 15,872 a——- c:\windows\system32\hcrstco.dll
2008-12-18 16:04 8,704 a——- c:\windows\system32\hccoin.dll
2008-12-18 16:03 26,112 a——- c:\windows\system32\hidserv.dll
2008-12-18 16:03 22,016 a——- c:\windows\system32\hid.dll
2008-12-18 16:03 468,992 a——- c:\windows\system32\newdev.dll
2008-12-18 16:03 74,752 a——- c:\windows\system32\newdev.exe
2008-12-18 16:01 738,304 a——- c:\windows\system32\inetcomm.dll
2008-12-18 16:01 269,312 a——- c:\windows\system32\es.dll
2008-12-18 15:58 361,984 a——- c:\windows\system32\IPSECSVC.DLL
2008-12-18 15:58 303,616 a——- c:\windows\system32\wmpeffects.dll
2008-12-18 15:57 885,248 a——- c:\windows\system32\RacEngn.dll
2008-12-18 15:56 1,314,816 a——- c:\windows\system32\quartz.dll
2008-12-18 15:56 1,695,744 a——- c:\windows\system32\gameux.dll
2008-12-18 15:55 12,240,896 a——- c:\windows\system32\NlsLexicons0007.dll
2008-12-18 15:55 2,644,480 a——- c:\windows\system32\NlsLexicons0009.dll
2008-12-18 15:55 801,280 a——- c:\windows\system32\NaturalLanguage6.dll
2008-12-18 15:54 3,601,464 a——- c:\windows\system32\ntkrnlpa.exe
2008-12-18 15:54 3,549,240 a——- c:\windows\system32\ntoskrnl.exe
2008-12-18 15:53 784,896 a——- c:\windows\system32\rpcrt4.dll
2008-12-18 15:53 15,360 a——- c:\windows\system32\pacerprf.dll
2008-12-18 15:53 988,216 a——- c:\windows\system32\winload.exe
2008-12-18 15:53 927,288 a——- c:\windows\system32\winresume.exe
2008-12-18 15:53 378,368 a——- c:\windows\system32\srcore.dll
2008-12-18 15:53 318,464 a——- c:\windows\system32\rstrui.exe
2008-12-18 15:53 40,960 a——- c:\windows\system32\srclient.dll
2008-12-18 15:53 14,848 a——- c:\windows\system32\srdelayed.exe
2008-12-18 15:53 6,656 a——- c:\windows\system32\kbd106n.dll
2008-12-18 15:53 615,992 a——- c:\windows\system32\ci.dll
2008-12-18 15:53 46,592 a——- c:\windows\system32\setbcdlocale.dll
2008-12-18 15:53 19,000 a——- c:\windows\system32\kd1394.dll
2008-12-18 15:52 408,064 a——- c:\windows\system32\msinfo32.exe
2008-12-18 15:52 2,560 a——- c:\windows\apppatch\AcRes.dll
2008-12-18 15:52 246,840 a——- c:\windows\system32\clfs.sys
2008-01-20 21:41 174 a–sh— c:\program files\desktop.ini
2006-11-02 07:40 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:40 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:40 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:40 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 18:29:26.83 ===============
The last avast! Antivirus boot scan that I ran Identified the Win32:agent-ABKH and the last MBAM I ran detected “Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.”
After browsing the forum I've discovered a few more things. In my startup files from MSCONFIG There is an entry for C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe /T:NTRU12. There are few more strange looking entries in here as well.
I had to switch computers to enter this topic because it would not let attach the any thing. Firefox made the page look different.
Help Please!!!!
Here is the DDS log as requested.
DDS (Ver_09-03-16.01) - NTFSx86
Run by [removed] at 18:28:38.25 on Mon 03/16/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_12
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.3571.2005 [GMT -5:00]
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_505c1590\STacSV.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_505c1590\aestsrv.exe
C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe
C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\Program Files\EPSON Projector\EPSON USB Display V1.4\EMP_UDSA.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\rundll32.exe
C:\Windows\system32\sdclt.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Toby Lott PRN\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = https://remote.coastalmc.com/Remote/logon.a…e%2flogoff.aspx
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.5.0.134\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.5.0.134\IPSBHO.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.5.0.134\coIEPlg.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
uRun: [NVIDIA nTune] c:\program files\nvidia corporation\ntune\nTuneCmd.exe resetprofile
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ChangeTPMAuth] c:\program files\wave systems corp\common\ChangeTPMAuth.exe /T:NTRU12
mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
mRun: [SecureUpgrade] c:\program files\wave systems corp\SecureUpgrade.exe
mRun: [EmbassySecurityCheck] "c:\program files\wave systems corp\embassy security setup\EMBASSYSecurityCheck.exe"
mRun: [DCPstrApp] c:\program files\dell\dell controlpoint\security manager\SecurityDeviceInfoSetRegistryString.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"
mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"
mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\programdata\scansoft\paperport\11\config\ereg\Ereg.ini"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,Start
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [basicsmssmenu] "c:\program files\seagate\basics\basics status\MaxMenuMgrBasics.exe"
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [NBKeyScan] "c:\program files\nero\nero backitup 4\NBKeyScan.exe"
mRun: [QuickBooksDB19] c:\progra~1\intuit\quickb~1\qbdbmgrn.exe -n qb_tobylottprn2-pc_19 -qs -gd all -gk all -gp 4096 -gu all -ch 64m -c 32m -x tcpip(broadcastlistener=no;port=55333) -ti 0 -ec simple -qi -qw -tl 120 -oe c:\progra~2\intuit\quickb~2\DBSTAR~1.LOG -y
mRun: [EPSON_UD_START] "c:\program files\epson projector\epson usb display v1.4\EMP_UD.exe" -UDCONNECT
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\eventl~1.lnk - c:\program files\jm integrated remote station\cms\EventLogger.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{871df2be-41d2-4334-ac33-839af16fc8fe}\Icon3E5562ED7.ico
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {D6E0B119-DCF2-4CD6-8DFB-7CFF1B70F7FF} - hxxps://bis.na.blackberry.com/html/web/client_tools/TOImport.cab
Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2009\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\engine\16.5.0.134\CoIEPlg.dll
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll
LSA: Authentication Packages = msv1_0 wvauth
================= FIREFOX ===================
FF - ProfilePath - c:\users\tobylo~1\appdata\roaming\mozilla\firefox\profiles\x34iy6k3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - component: c:\program files\mozilla firefox\extensions\{01a8ca0a-4c96-465b-a49b-65c46fad54f9}\components\Contribute.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npContribute.dll
FF - plugin: c:\program files\vistacodecpack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\vistacodecpack\rm\browser\plugins\nprpjplug.dll
============= SERVICES / DRIVERS ===============
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1005000.086\SymEFA.sys [2009-3-5 310320]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-3-15 114768]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1005000.086\BHDrvx86.sys [2009-3-5 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1005000.086\cchpx86.sys [2009-3-5 482352]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090310.003\IDSvix86.sys [2009-3-11 292912]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_505c1590\AEstSrv.exe [2009-3-7 81920]
R2 alssvc;Ambient Light Sensor;c:\program files\dell\ambient light sensor\AlsSvc.exe [2008-6-3 382232]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-3-15 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-3-15 51792]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\dell\dell controlpoint\DCPButtonSvc.exe [2008-9-4 406808]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2008-7-31 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2008-7-31 21352]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2008-11-11 451872]
R2 EMP_UDSA;EMP_UDSA;c:\program files\epson projector\epson usb display v1.4\EMP_UDSA.exe [2009-2-27 94208]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\common files\nero\nero backitup 4\NBService.exe [2008-12-5 935208]
R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\engine\16.5.0.134\ccSvcHst.exe [2009-3-5 115560]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\dell\dell controlpoint\connection manager\SMManager.exe [2008-9-9 69632]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-12-18 212992]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2008-12-18 29736]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [2008-12-18 32808]
R3 eppvad_simple;EPSON Projector UD Audio Device;c:\windows\system32\drivers\EMP_UDAU.sys [2009-2-27 17664]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-26 101936]
R3 qrkis;TetherBerry Miniport;c:\windows\system32\drivers\qrkis.sys [2009-3-8 45608]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\nis\1005000.086\symndisv.sys [2009-3-5 39984]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 288112]
S4 QuickBooksDB19;QuickBooksDB19;c:\progra~1\intuit\quickb~1\qbdbmgrn.exe -hvquickbooksdb19 –> c:\progra~1\intuit\quickb~1\QBDBMgrN.exe -hvQuickBooksDB19 [?]
=============== Created Last 30 ================
2009-03-16 14:52 –d—– c:\users\tobylo~1\appdata\roaming\wsInspector
2009-03-16 14:31 –d—– c:\program files\Startup Inspector for Windows
2009-03-16 08:45 22,872 a—-r– c:\windows\system32\AdobePDFUI.dll
2009-03-15 14:43 161,792 a——- c:\windows\SWREG.exe
2009-03-15 14:43 98,816 a——- c:\windows\sed.exe
2009-03-15 12:45 –d—– c:\users\tobylo~1\appdata\roaming\Malwarebytes
2009-03-15 12:45 15,504 a——- c:\windows\system32\drivers\mbam.sys
2009-03-15 12:45 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-15 12:45 –d—– c:\programdata\Malwarebytes
2009-03-15 12:45 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-03-15 12:45 –d—– c:\progra~2\Malwarebytes
2009-03-15 04:25 118 a——- c:\windows\system32\MRT.INI
2009-03-15 01:25 51,792 a——- c:\windows\system32\drivers\aswMonFlt.sys
2009-03-15 01:22 162,304 a——- c:\windows\system32\ztvunrar36.dll
2009-03-15 01:22 153,088 a——- c:\windows\system32\UNRAR3.dll
2009-03-15 01:22 77,312 a——- c:\windows\system32\ztvunace26.dll
2009-03-15 01:22 75,264 a——- c:\windows\system32\unacev2.dll
2009-03-15 01:22 69,632 a——- c:\windows\system32\ztvcabinet.dll
2009-03-15 01:22 –d—– c:\users\tobylo~1\appdata\roaming\Simply Super Software
2009-03-15 01:22 –d—– c:\programdata\Simply Super Software
2009-03-15 01:22 –d—– c:\program files\Trojan Remover
2009-03-15 01:22 –d—– c:\progra~2\Simply Super Software
2009-03-15 00:16 a-d—– c:\programdata\TEMP
2009-03-14 13:44 –d—– c:\program files\common files\Sonic Shared
2009-03-14 13:44 –d—– c:\program files\Roxio
2009-03-12 14:23 –d—– c:\users\toby lott prn\.asdm
2009-03-12 12:56 –d—– c:\program files\JM Integrated Remote Station
2009-03-12 10:51 256 a——- c:\windows\system32\pool.bin
2009-03-11 13:57 –d—– c:\users\tobylo~1\appdata\roaming\Blackberry Desktop
2009-03-11 13:43 –d—– c:\users\tobylo~1\appdata\roaming\Research In Motion
2009-03-11 13:04 –d—– c:\program files\common files\Research In Motion
2009-03-11 13:04 –d—– c:\program files\Research In Motion
2009-03-11 11:48 7,680 a——- c:\windows\system32\spwmp.dll
2009-03-11 11:48 4,096 a——- c:\windows\system32\msdxm.ocx
2009-03-11 11:48 4,096 a——- c:\windows\system32\dxmasf.dll
2009-03-11 11:48 8,147,456 a——- c:\windows\system32\wmploc.DLL
2009-03-11 11:47 268,288 a——- c:\windows\system32\schannel.dll
2009-03-11 11:47 2,033,152 a——- c:\windows\system32\win32k.sys
2009-03-08 22:08 26,496 a——- c:\windows\system32\drivers\RimSerial.sys
2009-03-08 22:04 45,608 a——- c:\windows\system32\drivers\qrkis.sys
2009-03-08 22:04 –d—– c:\program files\TetherBerry
2009-03-07 11:20 25,728 a——- c:\windows\system32\drivers\hidparse.sys
2009-03-07 11:11 –d—– c:\program files\Cisco
2009-03-07 11:11 772,936 a——- c:\windows\system32\oem87.inf
2009-03-07 10:58 53,248 a——- c:\windows\system32\CSVer.dll
2009-03-07 10:29 429,056 a——- c:\windows\system32\stapi32.dll
2009-03-07 10:29 404,480 a——- c:\windows\system32\stcplx.dll
2009-03-07 10:29 393,216 a——- c:\windows\system32\drivers\stwrt.sys
2009-03-07 10:29 168,960 a——- c:\windows\system32\st326124.dll
2009-03-06 20:26 –d—– C:\ExQuickRef
2009-02-27 19:16 17,664 a——- c:\windows\system32\drivers\EMP_UDAU.sys
2009-02-27 19:16 –d—– c:\program files\EPSON Projector
2009-02-27 19:07 –d—– c:\program files\epson
2009-02-27 19:00 27 a——- c:\windows\EX70.ini
2009-02-26 14:17 51 a——- c:\windows\DESI.INI
2009-02-26 14:16 –d—– c:\program files\DESI
2009-02-24 13:55 –d—– c:\program files\AskTBar
2009-02-23 16:34 –d–r– c:\program files\Norton Support
2009-02-19 20:05 34 a——- c:\windows\system32\bd407cdw.dat
2009-02-19 20:05 26 a——- c:\windows\BRPP2KA.INI
2009-02-16 09:50 428,544 a——- c:\windows\system32\EncDec.dll
2009-02-16 09:50 217,088 a——- c:\windows\system32\psisrndr.ax
2009-02-16 09:50 293,376 a——- c:\windows\system32\psisdecd.dll
2009-02-16 09:50 177,664 a——- c:\windows\system32\mpg2splt.ax
2009-02-16 09:50 80,896 a——- c:\windows\system32\MSNP.ax
==================== Find3M ====================
2009-03-16 14:56 6,396 a——- c:\windows\bthservsdp.dat
2009-03-16 08:02 270,339 a——- c:\programdata\nvModes.dat
2009-03-16 08:02 270,339 a——- c:\progra~2\nvModes.dat
2009-03-14 13:38 143,360 a——- c:\windows\inf\infstrng.dat
2009-03-14 13:38 86,016 a——- c:\windows\inf\infpub.dat
2009-03-14 13:38 86,016 a——- c:\windows\inf\infstor.dat
2009-03-07 11:30 665,600 a——- c:\windows\inf\drvindex.dat
2009-03-05 12:32 124,464 a——- c:\windows\system32\drivers\SYMEVENT.SYS
2009-03-05 12:32 7,386 a——- c:\windows\system32\drivers\SYMEVENT.CAT
2009-03-05 12:32 805 a——- c:\windows\system32\drivers\SYMEVENT.INF
2009-03-05 08:35 410,984 a——- c:\windows\system32\deploytk.dll
2009-02-27 06:20 25,136 a—-r– c:\windows\system32\drivers\SymIMV.sys
2009-02-04 17:33 0 a—h— c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-01-19 12:47 73,312 a——- c:\windows\system32\drivers\adfs.sys
2009-01-15 01:11 827,392 a——- c:\windows\system32\wininet.dll
2008-12-18 16:04 15,872 a——- c:\windows\system32\hcrstco.dll
2008-12-18 16:04 8,704 a——- c:\windows\system32\hccoin.dll
2008-12-18 16:03 26,112 a——- c:\windows\system32\hidserv.dll
2008-12-18 16:03 22,016 a——- c:\windows\system32\hid.dll
2008-12-18 16:03 468,992 a——- c:\windows\system32\newdev.dll
2008-12-18 16:03 74,752 a——- c:\windows\system32\newdev.exe
2008-12-18 16:01 738,304 a——- c:\windows\system32\inetcomm.dll
2008-12-18 16:01 269,312 a——- c:\windows\system32\es.dll
2008-12-18 15:58 361,984 a——- c:\windows\system32\IPSECSVC.DLL
2008-12-18 15:58 303,616 a——- c:\windows\system32\wmpeffects.dll
2008-12-18 15:57 885,248 a——- c:\windows\system32\RacEngn.dll
2008-12-18 15:56 1,314,816 a——- c:\windows\system32\quartz.dll
2008-12-18 15:56 1,695,744 a——- c:\windows\system32\gameux.dll
2008-12-18 15:55 12,240,896 a——- c:\windows\system32\NlsLexicons0007.dll
2008-12-18 15:55 2,644,480 a——- c:\windows\system32\NlsLexicons0009.dll
2008-12-18 15:55 801,280 a——- c:\windows\system32\NaturalLanguage6.dll
2008-12-18 15:54 3,601,464 a——- c:\windows\system32\ntkrnlpa.exe
2008-12-18 15:54 3,549,240 a——- c:\windows\system32\ntoskrnl.exe
2008-12-18 15:53 784,896 a——- c:\windows\system32\rpcrt4.dll
2008-12-18 15:53 15,360 a——- c:\windows\system32\pacerprf.dll
2008-12-18 15:53 988,216 a——- c:\windows\system32\winload.exe
2008-12-18 15:53 927,288 a——- c:\windows\system32\winresume.exe
2008-12-18 15:53 378,368 a——- c:\windows\system32\srcore.dll
2008-12-18 15:53 318,464 a——- c:\windows\system32\rstrui.exe
2008-12-18 15:53 40,960 a——- c:\windows\system32\srclient.dll
2008-12-18 15:53 14,848 a——- c:\windows\system32\srdelayed.exe
2008-12-18 15:53 6,656 a——- c:\windows\system32\kbd106n.dll
2008-12-18 15:53 615,992 a——- c:\windows\system32\ci.dll
2008-12-18 15:53 46,592 a——- c:\windows\system32\setbcdlocale.dll
2008-12-18 15:53 19,000 a——- c:\windows\system32\kd1394.dll
2008-12-18 15:52 408,064 a——- c:\windows\system32\msinfo32.exe
2008-12-18 15:52 2,560 a——- c:\windows\apppatch\AcRes.dll
2008-12-18 15:52 246,840 a——- c:\windows\system32\clfs.sys
2008-01-20 21:41 174 a–sh— c:\program files\desktop.ini
2006-11-02 07:40 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:40 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:40 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:40 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 18:29:26.83 ===============
