Spyware / Malware / Virus Removal

[Resolved] Google France? I think I'm hijacked.

22 min read

Looking for the outcome? Ask AI

keltics Topic Starter

Post #1March 25, 2009, 10:36 AM UTC

Yesterday I had a virus warning. Ran spybot it found and fixed several things, also ran bit defender it also found and deleted several things. Right now my wallpaper is gone, the desktop icons are still there but the backround is black. I've sent along a hjt log. Any help much appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:28:29 AM, on 3/25/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterMute\PopSubtract\PopSub.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Wireless\Client Manager\CMAGS.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://activation.rr.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\InterMute\PopSubtract\PopSub.exe
O4 - Global Startup: Wireless Client Manager.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145569068859
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A526A2C7-723E-4081-BF70-A7A9913E8C4A} (LogData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\system32\IomegaAccess.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\system32\ZipToA.exe

–
End of file - 11985 bytes

keltics

Post #2March 25, 2009, 10:39 AM UTC

Oh yea I forgot to mention when I go to Google I get Google France.

oldman960

Post #3March 26, 2009, 1:42 AM UTC

Hi , welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Try this

Right click any where on your desktop, click properties. Click the Background tab.

Is there a background selected? If not select , select a background. Click apply, click OK

Download OTListIt2 to your desktop.

Double click on OTList2.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

No need for a Hijackthis log this time.

Thanks

keltics

Post #4March 26, 2009, 6:58 AM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:28:29 AM, on 3/25/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterMute\PopSubtract\PopSub.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Wireless\Client Manager\CMAGS.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://activation.rr.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\InterMute\PopSubtract\PopSub.exe
O4 - Global Startup: Wireless Client Manager.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145569068859
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A526A2C7-723E-4081-BF70-A7A9913E8C4A} (LogData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\system32\IomegaAccess.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\system32\ZipToA.exe

–
End of file - 11985 bytes

keltics

Post #5March 26, 2009, 6:59 AM UTC

oldman960

Post #6March 26, 2009, 7:04 AM UTC

Hi keltics,

You posted 2 HJT logs. I need the logs from OTListIt2.

Did you try to reset your background as suggested previously?

Thanks

keltics

Post #7March 26, 2009, 11:03 AM UTC

Yes I reset the background for the desktopand it worked. I tried right clicking on the desktop but there was no background tab. I use a photo from 'my phoyos' as background so I went to my photos and reset it that way. I that ok?

I'll try sending the two lists again. Maybe the HJT copied because it was still in the 'copy', paste' part of 'edit'. Sorry.

OTListIt logfile created on: 3/26/2009 1:53:16 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.7.2 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.48 Mb Total Physical Memory | 254.14 Mb Available Physical Memory | 50.48% Memory free
1.20 Gb Paging File | 0.70 Gb Available in Paging File | 58.64% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.44 Gb Total Space | 52.13 Gb Free Space | 74.01% Space Free | Partition Type: NTFS
Drive D: | 4.07 Gb Total Space | 0.78 Gb Free Space | 19.12% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-2S4KN5K0H3
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\WINDOWS\System32\gearsec.exe (GEAR Software)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Computer, Inc.)
PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
PRC - C:\Program Files\Iomega\DriveIcons\ImgIcon.exe (Iomega Corp.)
PRC - C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
PRC - C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files\HP\hpcoretech\hpcmpmgr.exe (Hewlett-Packard Company)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\InterMute\PopSubtract\PopSub.exe (interMute, Inc.)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Wireless\Client Manager\CMAGS.EXE ()
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Documents and Settings\Owner\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (AntiVirScheduler [Auto | Running]) – C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (AntiVirService [Auto | Running]) – C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (GEARSecurity [Auto | Running]) – C:\WINDOWS\System32\gearsec.exe (GEAR Software)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IomegaAccess [Auto | Stopped]) – C:\WINDOWS\system32\IomegaAccess.exe ( Iomega Corporation)
SRV - (iPodService [On_Demand | Running]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Computer, Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (MDM [Auto | Running]) – C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
SRV - (Net Driver HPZ12 [Auto | Running]) – C:\WINDOWS\system32\HPZinw12.dll (Hewlett-Packard)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Auto | Running]) – C:\WINDOWS\system32\HPZipm12.dll (Hewlett-Packard)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (ZipToA [Auto | Stopped]) – C:\WINDOWS\system32\ZipToA.exe (Iomega Corporation)

========== Driver Services (SafeList) ==========

DRV - (AFS2K [System | Running]) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (AgereSoftModem [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\AGRSM.sys (Agere Systems)
DRV - (ALCXSENS [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (ALCXWDM [On_Demand | Running]) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (Aspi32 [Auto | Running]) – C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec)
DRV - (avgio [System | Running]) – C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (avgntflt [On_Demand | Running]) – C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (avipbb [System | Running]) – C:\WINDOWS\system32\DRIVERS\avipbb.sys (Avira GmbH)
DRV - (fasttx2k [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys (GEAR Software)
DRV - (HPZid412 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HPZid412.sys (HP)
DRV - (HPZipr12 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (HP)
DRV - (HPZius12 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HPZius12.sys (HP)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (nv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (pavboot [Boot | Running]) – C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (Ps2 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (rtl8139 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (SASDIFSV [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM [On_Demand | Running]) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiS315 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp [System | Running]) – C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (ssmdrv [System | Running]) – C:\WINDOWS\system32\DRIVERS\ssmdrv.sys (Avira GmbH)
DRV - (tmcomm [Auto | Running]) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (viaagp1 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics, Inc.)
DRV - (wlags51b [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\wlags51b.sys (Agere Systems)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

O1 HOSTS File: (304378 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 127.0.0.1 163ns.com
O1 - Hosts: 10489 more lines…
O2 - BHO: (Yahoo! Companion BHO) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll (Yahoo! Inc.)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AGRSMMSG] AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min (Avira GmbH)
O4 - HKLM..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" (Hewlett-Packard Company)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe (Iomega Corp.)
O4 - HKLM..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe (Iomega Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKLM..\Run: [VTTimer] VTTimer.exe File not found
O4 - HKCU..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe" (Microsoft Corp.)
O4 - HKCU..\Run: [RecordNow!] File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Development Company, L.P.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PopSubtract.lnk = C:\Program Files\InterMute\PopSubtract\PopSub.exe (interMute, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless Client Manager.lnk = C:\Program Files\Wireless\Client Manager\CMAGS.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 55 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://activation.rr.com/install/download/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://www.pandasecurity.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} https://support.microsoft.com/OAS/ActiveX/odc.cab (Microsoft PID Sniffer)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1145569068859 (MUWebControl Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} http://acs.pandasoftware.com/activescan/as5free/asinst.cab (ActiveScan Installer Class)
O16 - DPF: {A526A2C7-723E-4081-BF70-A7A9913E8C4A} https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab (LogData Class)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx (Get_ActiveX Control)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab (iTunesDetector Class)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - D:\AUTOEXEC.BAT () - [ FAT32 ]
O32 - Autorun File - D:\Autorun.inf () - [ FAT32 ]
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\Info.exe – [2002/09/10 05:54:58 | 00,040,960 | -HS- | M] (XSS)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/03/26 01:49:14 | 00,498,688 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/03/24 16:49:30 | 52,801,1264 | -HS- | C] () – C:\hiberfil.sys
[2009/03/24 11:51:25 | 00,001,394 | —- | C] () – C:\WINDOWS\System32\ahtn.htm
[2009/03/17 11:07:15 | 00,015,872 | —- | C] () – C:\Documents and Settings\Owner\My Documents\March 2009 deposits.wps
[2009/03/12 15:30:06 | 05,555,216 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Open_Your_Heart_Change_Your_World.mp3
[2009/03/11 06:29:47 | 00,016,896 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Aya rent default.wps
[2009/03/10 15:47:12 | 00,014,336 | —- | C] () – C:\Documents and Settings\Owner\My Documents\RS 09.wps
[2009/02/24 15:48:12 | 00,033,280 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Bus cards2.doc

========== Files - Modified Within 30 Days ==========

[2 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009/03/26 01:49:21 | 00,498,688 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/03/26 01:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At26.job
[2009/03/26 01:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At2.job
[2009/03/26 00:42:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At25.job
[2009/03/26 00:31:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2009/03/25 23:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At48.job
[2009/03/25 23:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At24.job
[2009/03/25 22:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At47.job
[2009/03/25 22:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At23.job
[2009/03/25 21:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At46.job
[2009/03/25 21:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At22.job
[2009/03/25 20:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At45.job
[2009/03/25 20:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At21.job
[2009/03/25 19:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At44.job
[2009/03/25 19:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At20.job
[2009/03/25 18:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At43.job
[2009/03/25 18:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At19.job
[2009/03/25 17:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At42.job
[2009/03/25 17:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At18.job
[2009/03/25 16:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At41.job
[2009/03/25 16:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At17.job
[2009/03/25 15:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At40.job
[2009/03/25 15:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At16.job
[2009/03/25 14:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At39.job
[2009/03/25 14:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At15.job
[2009/03/25 13:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At38.job
[2009/03/25 13:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At14.job
[2009/03/25 12:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At37.job
[2009/03/25 12:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At13.job
[2009/03/25 11:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At36.job
[2009/03/25 11:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At12.job
[2009/03/25 10:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At35.job
[2009/03/25 10:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At11.job
[2009/03/25 09:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At34.job
[2009/03/25 09:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At10.job
[2009/03/25 08:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At9.job
[2009/03/25 08:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At33.job
[2009/03/25 07:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At8.job
[2009/03/25 07:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At32.job
[2009/03/25 06:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At7.job
[2009/03/25 06:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At31.job
[2009/03/25 05:19:15 | 00,000,188 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2009/03/25 05:18:49 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/03/25 05:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At6.job
[2009/03/25 05:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At30.job
[2009/03/25 04:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At5.job
[2009/03/25 04:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At29.job
[2009/03/25 03:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2009/03/25 03:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At28.job
[2009/03/25 02:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At3.job
[2009/03/25 02:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At27.job
[2009/03/24 20:05:17 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/03/24 20:05:14 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/03/24 20:05:13 | 52,801,1264 | -HS- | M] () – C:\hiberfil.sys
[2009/03/24 17:06:37 | 00,034,652 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Landscape Invoce WTP.sxw
[2009/03/24 17:03:32 | 00,009,225 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Landscape Invoice BLC.sxw
[2009/03/24 11:53:51 | 00,001,394 | —- | M] () – C:\WINDOWS\System32\ahtn.htm
[2009/03/21 13:30:03 | 00,304,378 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/03/20 13:56:19 | 00,015,872 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Flex Fax.wps
[2009/03/17 12:04:36 | 00,015,360 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Commercial Flex Fax.wps
[2009/03/17 11:31:35 | 00,015,872 | —- | M] () – C:\Documents and Settings\Owner\My Documents\March 2009 deposits.wps
[2009/03/13 08:10:01 | 00,304,126 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090321-133003.backup
[2009/03/12 16:43:25 | 05,555,216 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Open_Your_Heart_Change_Your_World.mp3
[2009/03/12 15:30:01 | 00,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2009/03/11 10:41:57 | 00,016,896 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Aya rent default.wps
[2009/03/11 06:43:48 | 00,016,384 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Flex Dev. Env..wps
[2009/03/11 03:09:59 | 00,197,752 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/11 03:01:49 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/03/10 15:47:13 | 00,014,336 | —- | M] () – C:\Documents and Settings\Owner\My Documents\RS 09.wps
[2009/03/10 15:04:24 | 00,027,136 | —- | M] () – C:\Documents and Settings\Owner\My Documents\BLCcert rr 1108.wps
[2009/03/05 17:43:42 | 00,303,898 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090313-081001.backup
[2009/02/26 09:09:17 | 00,303,804 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090305-174342.backup
[2009/02/25 12:55:00 | 24,768,960 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/02/24 15:48:14 | 00,033,280 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Bus cards2.doc
[2009/02/24 09:24:20 | 00,002,483 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Word.lnk

========== LOP Check ==========

[2009/02/21 15:04:03 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2008/03/11 13:22:18 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2004/04/02 17:34:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009/02/21 15:04:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avira
[2008/06/18 13:00:53 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2009/02/11 17:06:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HP
[2009/02/13 10:08:10 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HP Product Assistant
[2009/01/20 17:26:47 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kodak
[2008/08/12 14:44:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2009/01/10 08:50:27 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2008/02/27 14:52:35 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2004/04/02 18:06:39 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Motive
[2005/11/21 16:30:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2004/04/02 15:00:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBSI
[2009/02/14 09:04:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/01/09 18:40:15 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2004/08/18 14:31:11 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Support.com
[2004/09/14 14:59:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Symantec
[2009/03/21 13:24:24 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2005/10/25 10:04:42 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/07/29 14:10:13 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/02/12 14:29:28 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Owner\Application Data
[2008/03/19 11:53:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Adobe
[2007/01/17 07:32:22 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AdobeUM
[2004/09/05 07:02:45 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Apple Computer
[2005/04/11 15:44:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\FileMaker
[2007/06/18 19:47:28 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Grisoft
[2005/02/25 19:45:50 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Help
[2004/09/16 17:33:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Hewlett-Packard
[2009/02/11 17:14:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\HP
[2009/02/24 11:04:38 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\HPAppData
[2004/04/02 14:55:29 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Identities
[2009/02/13 16:19:18 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Image Zone Express
[2004/08/26 19:41:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterVideo
[2008/02/27 14:52:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Lavasoft
[2004/09/18 07:11:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Leadertech
[2006/12/21 18:20:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Macromedia
[2009/01/10 08:50:36 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2008/11/15 15:42:41 | 00,000,000 | –SD | M] – C:\Documents and Settings\Owner\Application Data\Microsoft
[2004/09/07 15:52:51 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Motive
[2008/04/14 16:30:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Real
[2004/04/02 18:24:59 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2005/08/09 11:10:20 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SmartDraw
[2004/09/18 07:15:51 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Sonic
[2004/04/02 16:11:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Sun
[2009/01/09 18:39:50 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
[2004/04/02 21:42:29 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Symantec
[2004/09/01 17:51:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Template
[2005/10/07 15:56:43 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Viewpoint
[2007/06/23 07:33:01 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WholeSecurity
[2009/03/26 00:31:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At1.job
[2009/03/25 09:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At10.job
[2009/03/25 10:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At11.job
[2009/03/25 11:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At12.job
[2009/03/25 12:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At13.job
[2009/03/25 13:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At14.job
[2009/03/25 14:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At15.job
[2009/03/25 15:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At16.job
[2009/03/25 16:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At17.job
[2009/03/25 17:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At18.job
[2009/03/25 18:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At19.job
[2009/03/26 01:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At2.job
[2009/03/25 19:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At20.job
[2009/03/25 20:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At21.job
[2009/03/25 21:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At22.job
[2009/03/25 22:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At23.job
[2009/03/25 23:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At24.job
[2009/03/26 00:42:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At25.job
[2009/03/26 01:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At26.job
[2009/03/25 02:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At27.job
[2009/03/25 03:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At28.job
[2009/03/25 04:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At29.job
[2009/03/25 02:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At3.job
[2009/03/25 05:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At30.job
[2009/03/25 06:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At31.job
[2009/03/25 07:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At32.job
[2009/03/25 08:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At33.job
[2009/03/25 09:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At34.job
[2009/03/25 10:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At35.job
[2009/03/25 11:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At36.job
[2009/03/25 12:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At37.job
[2009/03/25 13:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At38.job
[2009/03/25 14:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At39.job
[2009/03/25 03:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At4.job
[2009/03/25 15:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At40.job
[2009/03/25 16:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At41.job
[2009/03/25 17:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At42.job
[2009/03/25 18:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At43.job
[2009/03/25 19:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At44.job
[2009/03/25 20:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At45.job
[2009/03/25 21:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At46.job
[2009/03/25 22:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At47.job
[2009/03/25 23:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At48.job
[2009/03/25 04:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At5.job
[2009/03/25 05:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At6.job
[2009/03/25 06:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At7.job
[2009/03/25 07:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At8.job
[2009/03/25 08:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At9.job
[2003/08/16 11:14:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/03/24 20:05:17 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >

keltics

Post #8March 26, 2009, 11:07 AM UTC

OTListIt logfile created on: 3/26/2009 1:53:16 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.7.2 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.48 Mb Total Physical Memory | 254.14 Mb Available Physical Memory | 50.48% Memory free
1.20 Gb Paging File | 0.70 Gb Available in Paging File | 58.64% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.44 Gb Total Space | 52.13 Gb Free Space | 74.01% Space Free | Partition Type: NTFS
Drive D: | 4.07 Gb Total Space | 0.78 Gb Free Space | 19.12% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-2S4KN5K0H3
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\WINDOWS\System32\gearsec.exe (GEAR Software)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Computer, Inc.)
PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
PRC - C:\Program Files\Iomega\DriveIcons\ImgIcon.exe (Iomega Corp.)
PRC - C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
PRC - C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files\HP\hpcoretech\hpcmpmgr.exe (Hewlett-Packard Company)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\InterMute\PopSubtract\PopSub.exe (interMute, Inc.)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Wireless\Client Manager\CMAGS.EXE ()
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Documents and Settings\Owner\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (AntiVirScheduler [Auto | Running]) – C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (AntiVirService [Auto | Running]) – C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (GEARSecurity [Auto | Running]) – C:\WINDOWS\System32\gearsec.exe (GEAR Software)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IomegaAccess [Auto | Stopped]) – C:\WINDOWS\system32\IomegaAccess.exe ( Iomega Corporation)
SRV - (iPodService [On_Demand | Running]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Computer, Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (MDM [Auto | Running]) – C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
SRV - (Net Driver HPZ12 [Auto | Running]) – C:\WINDOWS\system32\HPZinw12.dll (Hewlett-Packard)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Auto | Running]) – C:\WINDOWS\system32\HPZipm12.dll (Hewlett-Packard)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (ZipToA [Auto | Stopped]) – C:\WINDOWS\system32\ZipToA.exe (Iomega Corporation)

========== Driver Services (SafeList) ==========

DRV - (AFS2K [System | Running]) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (AgereSoftModem [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\AGRSM.sys (Agere Systems)
DRV - (ALCXSENS [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (ALCXWDM [On_Demand | Running]) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (Aspi32 [Auto | Running]) – C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec)
DRV - (avgio [System | Running]) – C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (avgntflt [On_Demand | Running]) – C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (avipbb [System | Running]) – C:\WINDOWS\system32\DRIVERS\avipbb.sys (Avira GmbH)
DRV - (fasttx2k [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys (GEAR Software)
DRV - (HPZid412 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HPZid412.sys (HP)
DRV - (HPZipr12 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (HP)
DRV - (HPZius12 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HPZius12.sys (HP)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (nv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (pavboot [Boot | Running]) – C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (Ps2 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (rtl8139 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (SASDIFSV [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM [On_Demand | Running]) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiS315 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp [System | Running]) – C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (ssmdrv [System | Running]) – C:\WINDOWS\system32\DRIVERS\ssmdrv.sys (Avira GmbH)
DRV - (tmcomm [Auto | Running]) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (viaagp1 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics, Inc.)
DRV - (wlags51b [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\wlags51b.sys (Agere Systems)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

O1 HOSTS File: (304378 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 127.0.0.1 163ns.com
O1 - Hosts: 10489 more lines…
O2 - BHO: (Yahoo! Companion BHO) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll (Yahoo! Inc.)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AGRSMMSG] AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min (Avira GmbH)
O4 - HKLM..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" (Hewlett-Packard Company)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe (Iomega Corp.)
O4 - HKLM..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe (Iomega Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKLM..\Run: [VTTimer] VTTimer.exe File not found
O4 - HKCU..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe" (Microsoft Corp.)
O4 - HKCU..\Run: [RecordNow!] File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Development Company, L.P.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PopSubtract.lnk = C:\Program Files\InterMute\PopSubtract\PopSub.exe (interMute, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless Client Manager.lnk = C:\Program Files\Wireless\Client Manager\CMAGS.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 55 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://activation.rr.com/install/download/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://www.pandasecurity.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} https://support.microsoft.com/OAS/ActiveX/odc.cab (Microsoft PID Sniffer)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1145569068859 (MUWebControl Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} http://acs.pandasoftware.com/activescan/as5free/asinst.cab (ActiveScan Installer Class)
O16 - DPF: {A526A2C7-723E-4081-BF70-A7A9913E8C4A} https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab (LogData Class)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx (Get_ActiveX Control)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab (iTunesDetector Class)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - D:\AUTOEXEC.BAT () - [ FAT32 ]
O32 - Autorun File - D:\Autorun.inf () - [ FAT32 ]
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\Info.exe – [2002/09/10 05:54:58 | 00,040,960 | -HS- | M] (XSS)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/03/26 01:49:14 | 00,498,688 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/03/24 16:49:30 | 52,801,1264 | -HS- | C] () – C:\hiberfil.sys
[2009/03/24 11:51:25 | 00,001,394 | —- | C] () – C:\WINDOWS\System32\ahtn.htm
[2009/03/17 11:07:15 | 00,015,872 | —- | C] () – C:\Documents and Settings\Owner\My Documents\March 2009 deposits.wps
[2009/03/12 15:30:06 | 05,555,216 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Open_Your_Heart_Change_Your_World.mp3
[2009/03/11 06:29:47 | 00,016,896 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Aya rent default.wps
[2009/03/10 15:47:12 | 00,014,336 | —- | C] () – C:\Documents and Settings\Owner\My Documents\RS 09.wps
[2009/02/24 15:48:12 | 00,033,280 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Bus cards2.doc

========== Files - Modified Within 30 Days ==========

[2 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009/03/26 01:49:21 | 00,498,688 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/03/26 01:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At26.job
[2009/03/26 01:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At2.job
[2009/03/26 00:42:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At25.job
[2009/03/26 00:31:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2009/03/25 23:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At48.job
[2009/03/25 23:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At24.job
[2009/03/25 22:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At47.job
[2009/03/25 22:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At23.job
[2009/03/25 21:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At46.job
[2009/03/25 21:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At22.job
[2009/03/25 20:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At45.job
[2009/03/25 20:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At21.job
[2009/03/25 19:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At44.job
[2009/03/25 19:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At20.job
[2009/03/25 18:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At43.job
[2009/03/25 18:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At19.job
[2009/03/25 17:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At42.job
[2009/03/25 17:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At18.job
[2009/03/25 16:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At41.job
[2009/03/25 16:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At17.job
[2009/03/25 15:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At40.job
[2009/03/25 15:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At16.job
[2009/03/25 14:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At39.job
[2009/03/25 14:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At15.job
[2009/03/25 13:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At38.job
[2009/03/25 13:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At14.job
[2009/03/25 12:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At37.job
[2009/03/25 12:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At13.job
[2009/03/25 11:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At36.job
[2009/03/25 11:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At12.job
[2009/03/25 10:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At35.job
[2009/03/25 10:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At11.job
[2009/03/25 09:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At34.job
[2009/03/25 09:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At10.job
[2009/03/25 08:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At9.job
[2009/03/25 08:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At33.job
[2009/03/25 07:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At8.job
[2009/03/25 07:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At32.job
[2009/03/25 06:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At7.job
[2009/03/25 06:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At31.job
[2009/03/25 05:19:15 | 00,000,188 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2009/03/25 05:18:49 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/03/25 05:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At6.job
[2009/03/25 05:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At30.job
[2009/03/25 04:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At5.job
[2009/03/25 04:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At29.job
[2009/03/25 03:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2009/03/25 03:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At28.job
[2009/03/25 02:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At3.job
[2009/03/25 02:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\tasks\At27.job
[2009/03/24 20:05:17 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/03/24 20:05:14 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/03/24 20:05:13 | 52,801,1264 | -HS- | M] () – C:\hiberfil.sys
[2009/03/24 17:06:37 | 00,034,652 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Landscape Invoce WTP.sxw
[2009/03/24 17:03:32 | 00,009,225 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Landscape Invoice BLC.sxw
[2009/03/24 11:53:51 | 00,001,394 | —- | M] () – C:\WINDOWS\System32\ahtn.htm
[2009/03/21 13:30:03 | 00,304,378 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/03/20 13:56:19 | 00,015,872 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Flex Fax.wps
[2009/03/17 12:04:36 | 00,015,360 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Commercial Flex Fax.wps
[2009/03/17 11:31:35 | 00,015,872 | —- | M] () – C:\Documents and Settings\Owner\My Documents\March 2009 deposits.wps
[2009/03/13 08:10:01 | 00,304,126 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090321-133003.backup
[2009/03/12 16:43:25 | 05,555,216 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Open_Your_Heart_Change_Your_World.mp3
[2009/03/12 15:30:01 | 00,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2009/03/11 10:41:57 | 00,016,896 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Aya rent default.wps
[2009/03/11 06:43:48 | 00,016,384 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Flex Dev. Env..wps
[2009/03/11 03:09:59 | 00,197,752 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/11 03:01:49 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/03/10 15:47:13 | 00,014,336 | —- | M] () – C:\Documents and Settings\Owner\My Documents\RS 09.wps
[2009/03/10 15:04:24 | 00,027,136 | —- | M] () – C:\Documents and Settings\Owner\My Documents\BLCcert rr 1108.wps
[2009/03/05 17:43:42 | 00,303,898 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090313-081001.backup
[2009/02/26 09:09:17 | 00,303,804 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090305-174342.backup
[2009/02/25 12:55:00 | 24,768,960 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/02/24 15:48:14 | 00,033,280 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Bus cards2.doc
[2009/02/24 09:24:20 | 00,002,483 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Word.lnk

========== LOP Check ==========

[2009/02/21 15:04:03 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2008/03/11 13:22:18 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2004/04/02 17:34:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009/02/21 15:04:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avira
[2008/06/18 13:00:53 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2009/02/11 17:06:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HP
[2009/02/13 10:08:10 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HP Product Assistant
[2009/01/20 17:26:47 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kodak
[2008/08/12 14:44:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2009/01/10 08:50:27 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2008/02/27 14:52:35 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2004/04/02 18:06:39 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Motive
[2005/11/21 16:30:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2004/04/02 15:00:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBSI
[2009/02/14 09:04:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/01/09 18:40:15 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2004/08/18 14:31:11 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Support.com
[2004/09/14 14:59:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Symantec
[2009/03/21 13:24:24 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2005/10/25 10:04:42 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/07/29 14:10:13 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/02/12 14:29:28 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Owner\Application Data
[2008/03/19 11:53:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Adobe
[2007/01/17 07:32:22 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AdobeUM
[2004/09/05 07:02:45 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Apple Computer
[2005/04/11 15:44:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\FileMaker
[2007/06/18 19:47:28 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Grisoft
[2005/02/25 19:45:50 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Help
[2004/09/16 17:33:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Hewlett-Packard
[2009/02/11 17:14:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\HP
[2009/02/24 11:04:38 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\HPAppData
[2004/04/02 14:55:29 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Identities
[2009/02/13 16:19:18 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Image Zone Express
[2004/08/26 19:41:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterVideo
[2008/02/27 14:52:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Lavasoft
[2004/09/18 07:11:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Leadertech
[2006/12/21 18:20:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Macromedia
[2009/01/10 08:50:36 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2008/11/15 15:42:41 | 00,000,000 | –SD | M] – C:\Documents and Settings\Owner\Application Data\Microsoft
[2004/09/07 15:52:51 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Motive
[2008/04/14 16:30:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Real
[2004/04/02 18:24:59 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2005/08/09 11:10:20 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SmartDraw
[2004/09/18 07:15:51 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Sonic
[2004/04/02 16:11:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Sun
[2009/01/09 18:39:50 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
[2004/04/02 21:42:29 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Symantec
[2004/09/01 17:51:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Template
[2005/10/07 15:56:43 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Viewpoint
[2007/06/23 07:33:01 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WholeSecurity
[2009/03/26 00:31:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At1.job
[2009/03/25 09:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At10.job
[2009/03/25 10:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At11.job
[2009/03/25 11:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At12.job
[2009/03/25 12:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At13.job
[2009/03/25 13:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At14.job
[2009/03/25 14:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At15.job
[2009/03/25 15:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At16.job
[2009/03/25 16:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At17.job
[2009/03/25 17:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At18.job
[2009/03/25 18:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At19.job
[2009/03/26 01:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At2.job
[2009/03/25 19:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At20.job
[2009/03/25 20:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At21.job
[2009/03/25 21:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At22.job
[2009/03/25 22:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At23.job
[2009/03/25 23:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At24.job
[2009/03/26 00:42:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At25.job
[2009/03/26 01:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At26.job
[2009/03/25 02:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At27.job
[2009/03/25 03:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At28.job
[2009/03/25 04:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At29.job
[2009/03/25 02:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At3.job
[2009/03/25 05:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At30.job
[2009/03/25 06:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At31.job
[2009/03/25 07:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At32.job
[2009/03/25 08:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At33.job
[2009/03/25 09:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At34.job
[2009/03/25 10:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At35.job
[2009/03/25 11:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At36.job
[2009/03/25 12:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At37.job
[2009/03/25 13:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At38.job
[2009/03/25 14:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At39.job
[2009/03/25 03:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At4.job
[2009/03/25 15:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At40.job
[2009/03/25 16:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At41.job
[2009/03/25 17:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At42.job
[2009/03/25 18:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At43.job
[2009/03/25 19:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At44.job
[2009/03/25 20:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At45.job
[2009/03/25 21:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At46.job
[2009/03/25 22:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At47.job
[2009/03/25 23:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At48.job
[2009/03/25 04:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At5.job
[2009/03/25 05:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At6.job
[2009/03/25 06:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At7.job
[2009/03/25 07:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At8.job
[2009/03/25 08:00:00 | 00,000,350 | —- | M] () – C:\WINDOWS\Tasks\At9.job
[2003/08/16 11:14:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/03/24 20:05:17 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >

oldman960

Post #9March 26, 2009, 4:33 PM UTC

Hi keltics,

Sorry about that, it should have been Desktop tab, not Background tab.

There should have been a file on your desktop called Extras.txt. Please post it in your next reply.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with

Extras.txt
combofix log
new HJT log taken after all other steps

How is your computer at the moment?

Thanks

keltics

Post #10March 26, 2009, 7:55 PM UTC

Here is the extras sorry I thought I included them last time. The machine has been fine, not as fast as when new but that was a few years ago. I'll send the combo log and new hjt log next. Do you think it is a coincidence that google France showed up on my pc and my wife's laptop at the same time? Her laptop shows no sign of infection, her os is vista.The only connection they share is the wireless router/cable modem. Thanx for all your help so far.

OTListIt Extras logfile created on: 3/26/2009 6:40:51 AM - Run 3
OTListIt2 by OldTimer - Version 2.0.7.2 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.48 Mb Total Physical Memory | 230.44 Mb Available Physical Memory | 45.77% Memory free
1.20 Gb Paging File | 0.70 Gb Available in Paging File | 58.42% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.44 Gb Total Space | 52.13 Gb Free Space | 74.01% Space Free | Partition Type: NTFS
Drive D: | 4.07 Gb Total Space | 0.78 Gb Free Space | 19.12% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-2S4KN5K0H3
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\InterMute\SpamSubtract\SpamSub.exe:*:Disabled:SpamSubtract Main Module File not found
C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe:*:Disabled:BackWeb-1940576 File not found
C:\Program Files\Real\RealOne Player\realplay.exe:*:Disabled:RealPlayer File not found
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Computer, Inc.)
C:\Program Files\Hewlett-Packard\HP Software Update\HPWUCli.exe:*:Enabled:HP Software Update Client (Hewlett-Packard)
C:\Program Files\Conference\Conference.dll:*:Enabled:Audio/Video Conference by KIOSK Team (©Telco Advertisng, Ltd.)
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater File not found
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare File not found
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe File not found
C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe File not found
C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe File not found
C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer (Microsoft Corporation)
C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console (Microsoft Corporation)
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe ()
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe (Hewlett-Packard)
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcopy.exe:*:Enabled:hpqcopy.exe (Hewlett-Packard Co.)
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe (Hewlett-Packard)
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe ( )
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe (Hewlett-Packard Development Company, L.P.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0A55CDBB-0566-4AA2-A15B-24C7F27C6FF4}" = BPD_Scan
"{138BD312-3557-40F8-BC5E-6DFF00A6880D}" = BPDSoftware_Ini
"{14589F05-C658-4594-9429-D437BA688686}" = IntelliMover Data Transfer Demo
"{17E81C48-407E-499f-A105-1B49ACDB9BA4}" = ProductContext
"{1D643CD7-4DD6-11D7-A4E0-000874180BB3}" = Microsoft Money 2004
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{2405665A-16C9-4D3A-B70E-F006220E1472}" = Overland
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java™ 6 Update 12
"{26BB11D7-36D1-49ee-986F-8F8AD4D051C8}" = L7600
"{27678F85-7234-4CEB-B84D-2C44E9C4B18E}" = Wireless Client Manager
"{2BBC9458-07CA-4843-848B-5C8146E5EFA8}" = CreativeProjects
"{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{34A59AC3-6C5C-4A09-A7F5-369A37176C8A}" = AiOSoftware
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{363790D2-DA98-41DD-9C9F-69FA36B169DE}" = PanoStandAlone
"{369B36BE-3D64-4641-9AEA-808D436FE130}" = Microsoft Picture It! Express 7.0
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{3AE681E0-4E8D-453F-950A-48534D3C0724}" = Copy
"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{4AE80E7B-6633-4046-9C15-D3B281C4F73D}" = BPDSoftware
"{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant
"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade
"{54DE0B75-6CD9-44C4-B10A-1F25DA9899D8}" = Quicken 2004
"{595D0DE8-C38A-4432-B851-47DECC1A99BD}" = HP Unload DLL Patch
"{597D73A8-5FDB-4bc1-9893-40B54459F1BC}" = ProductContext
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6994491D-D491-48F1-AE1F-E179C1FFFC2F}" = HP Photosmart Essential
"{6ABA1658-6429-4D01-875C-0EA6EE851AD1}" = Drivers
"{6DE9751D-3FFE-400E-8761-26A92DB734DE}" = BPD_HPSU
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{766273C1-A39B-47EB-ACE8-DEBDD8094BCC}" = overland
"{7729A02E-D1AD-4830-8FC5-11853500D90D}" = HP Officejet Pro All-In-One Series
"{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}" = URGE
"{8C045626-4496-4238-B3B8-394CC6D46427}" = 7500_7600_7700_Help
"{8C64E145-54BA-11D6-91B1-00500462BE80}" = Microsoft Money 2004 System Pack
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91A5B6C0-EF4E-4830-AC7D-6761C0A9B292}" = hp deskjet 3600
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = RecordNow!
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{9705A7E1-3DD1-4BAC-8CA9-FE7B1473BEC9}" = iTunes
"{981FB376-8418-4EA8-BBED-9DE5AA63E7D5}" = SkinsHP1
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD Player
"{9CB2512B-3EC4-43DF-8002-46BDAB5EDD1B}" = QuickProjects
"{9EEBF8D5-8712-4D1D-88F4-4CDC2D270BC3}" = PrintScreen
"{A1062847-0846-427A-92A1-BB8251A91E91}" = HP PSC & OfficeJet 4.2
"{A1DCC235-DACC-4E1F-8D11-D630634B4AEF}" = PhotoGallery
"{A2500497-FD32-493e-B8E5-28D6728DBEF5}" = Readme
"{A4EA3AB4-E78C-4286-96DF-26035507CE55}" = AiO_Scan
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Memories Disc
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B45D9FEE-1AF4-46F3-9A83-2545F81547F5}" = CreativeProjectsTemplates
"{B56D5B09-C4FB-4EA0-8EAD-7BC3E2715A2D}" = DocumentViewer
"{BA248A92-1136-497E-8E1A-2591CBFB18EB}" = HP Smart Web Printing
"{BCC992E5-5C81-4066-9B55-03DC10B24D21}" = InstantShare
"{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}" = Microsoft Plus! Digital Media Edition
"{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE24344F-DFD8-40C8-8FD8-C9740B5F25AC}" = BPDfax
"{D48AD533-BAD5-469B-A9AA-272C6D80E70B}" = MPM
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp
"{E0828692-FD9D-459F-9312-C645C3CA6650}" = HP Photo and Imaging 2.0 - Deskjet Series
"{E1B80DEE-A795-4258-8445-074C06AE3AB8}" = MarketResearch
"{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations
"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update
"{FF26F7EA-BCEE-478C-9A1B-6B4F88717D73}" = CueTour
"0254DF9A-618A-4A2C-A5ED-FA7115988B02" = Word Symphony from Compaq (remove only)
"29FF6D07-4A15-41F1-9D5E-E0F3A58012C6" = Bounce Symphony from Compaq (remove only)
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Atmosphere Player" = Adobe Atmosphere Player for Acrobat and Adobe Reader
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"BackWeb-1940576 Uninstaller" = Compaq Connections
"CleanUp!" = CleanUp!
"Compaq Instant Support" = Compaq Instant Support
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"Flight Simulator 98" = Microsoft Flight Simulator 98
"HijackThis" = HijackThis 2.0.2
"Hijackthis_is1" = Hijackthis 1.99.1
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Photo & Imaging" = HP Image Zone 4.2
"hp print screen utility" = hp print screen utility
"HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0
"HPExtendedCapabilities" = HP Customer Participation Program 7.0
"HPOCR" = OCR Software by I.R.I.S 7.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{54DE0B75-6CD9-44C4-B10A-1F25DA9899D8}" = Quicken 2004
"InstallShield_{9705A7E1-3DD1-4BAC-8CA9-FE7B1473BEC9}" = iTunes
"IomegaWare" = IomegaWare
"KandaInst_EWH_1_0" = The Encyclopedia of World History
"LiveUpdate" = LiveUpdate 1.90 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA" =
"OpenOffice.org 1.0" = OpenOffice.org 1.0
"Panda ActiveScan" = Panda ActiveScan
"PopSubtract" = PopSubtract
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Python 2.2.1" = Python 2.2.1
"RealPlayer 6.0" = RealPlayer
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"SpywareBlaster_is1" = SpywareBlaster 4.1
"System Security Suite 1.04" = System Security Suite 1.04
"TWC_RoadRunnerMedic" = Road Runner Medic 5.2
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Audio/Video Conference" = Audio/Video Conference 4.1
"Confidence Online EE" = Confidence Online™ for Web Applications

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/21/2008 3:17:17 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Hang | ID = 1002
Description = Hanging application nda.exe, version 1.0.0.203, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 7/24/2008 4:41:08 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Error | ID = 1000
Description = Faulting application dllhost.exe, version 5.1.2600.2180, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 7/30/2008 7:40:58 AM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/1/2008 8:12:09 AM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Error | ID = 1000
Description = Faulting application ad-aware2007.exe, version 7.0.2.7, faulting module
ad-aware2007.exe, version 7.0.2.7, fault address 0x0009691a.

Error - 8/5/2008 6:37:20 AM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16674, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 8/5/2008 1:50:36 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16674, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/5/2008 2:41:56 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16674, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 8/12/2008 3:18:12 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Hang | ID = 1002
Description = Hanging application WksWP.exe, version 7.2.710.1, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/12/2008 3:20:57 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Hang | ID = 1002
Description = Hanging application Ad-Aware2007.exe, version 7.0.2.7, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/14/2008 7:42:25 AM | Computer Name = YOUR-2S4KN5K0H3 | Source = Application Error | ID = 1000
Description = Faulting application dllhost.exe, version 5.1.2600.2180, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

[ System Events ]
Error - 3/7/2009 7:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At19.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 7:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At43.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 8:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At20.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 8:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At44.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 9:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At21.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 9:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At45.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 10:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At22.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 10:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At46.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 11:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At23.job command failed to start due to the following error: %%2147942402

Error - 3/7/2009 11:00:00 PM | Computer Name = YOUR-2S4KN5K0H3 | Source = Schedule | ID = 7901
Description = The At47.job command failed to start due to the following error: %%2147942402

< End of report >

keltics

Post #11March 26, 2009, 8:47 PM UTC

Here are the Combofix and HJT logs. Thanx for all your help. Do you think it is a coincidence that Google France showed up on my wife's laptop the same day it was on my pc? The onley thing these machines have in common is the wireless router/cable modem.

ComboFix 09-03-25.04 - Owner 2009-03-26 15:31:36.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.200 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((( Files Created from 2009-02-26 to 2009-03-26 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-21 18:24 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-21 18:24 ——— d—–w c:\program files\SpywareBlaster
2009-03-14 13:07 ——— d—–w c:\program files\Spybot - Search & Destroy
2009-02-25 15:25 ——— d—–w c:\program files\SUPERAntiSpyware
2009-02-24 16:04 ——— d—–w c:\documents and settings\Owner\Application Data\HPAppData
2009-02-22 00:23 ——— d—–w c:\program files\Iomega
2009-02-21 20:04 ——— d—–w c:\program files\Avira
2009-02-21 20:04 ——— d—–w c:\documents and settings\All Users\Application Data\Avira
2009-02-21 14:48 ——— d—–w c:\program files\Lavasoft
2009-02-21 14:48 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2009-02-21 14:10 ——— d—–w c:\program files\Eusing Free Registry Cleaner
2009-02-20 21:04 ——— d—–w c:\program files\MSECache
2009-02-19 14:41 ——— d—–w c:\program files\Java
2009-02-14 14:04 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-13 21:22 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-02-13 21:19 ——— d—–w c:\documents and settings\Owner\Application Data\Image Zone Express
2009-02-13 15:09 ——— d—–w c:\program files\HP
2009-02-13 15:08 ——— d—–w c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-02-11 22:14 ——— d—–w c:\documents and settings\Owner\Application Data\HP
2009-02-11 22:06 ——— d—–w c:\program files\Hewlett-Packard
2009-02-11 22:06 ——— d—–w c:\program files\Common Files\HP
2009-02-11 22:06 ——— d—–w c:\documents and settings\All Users\Application Data\HP
2009-02-11 15:19 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 15:19 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-02-09 11:13 1,846,784 —-a-w c:\windows\system32\win32k.sys
2009-01-17 18:29 410,984 —-a-w c:\windows\system32\deploytk.dll
2009-01-06 14:21 28,672 —-a-w c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\InetWrap.dll
2004-09-20 17:15 0 -csha-w c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-25 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2004-01-16 229376]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"Iomega Startup Options"="c:\program files\Iomega\Common\ImgStart.exe" [2000-06-02 32768]
"Iomega Drive Icons"="c:\program files\Iomega\DriveIcons\ImgIcon.exe" [2000-06-13 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-09-01 176128]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-14 185896]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-16 28672]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-17 148888]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 c:\windows\AGRSMMSG.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
HP Image Zone Fast Start.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
PopSubtract.lnk - c:\program files\InterMute\PopSubtract\PopSub.exe [2004-08-24 233472]
Wireless Client Manager.lnk - c:\program files\Wireless\Client Manager\CMAGS.EXE [2004-09-04 339968]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv41"= ir41_32.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\Conference\\Conference.dll"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqcopy.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-05 28544]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
R3 wlags51b;Wireless LAN USB Driver;c:\windows\system32\drivers\wlags51b.sys [2004-09-04 177664]
S2 mrtRate;mrtRate; [x]
S2 TBQIZVJN;TBQIZVJN;\??\c:\windows\system32\tbqizvjn.ocn –> c:\windows\system32\tbqizvjn.ocn [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\Info.exe folder.htt 480 480
.
Contents of the 'Scheduled Tasks' folder

2009-03-26 c:\windows\Tasks\At1.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At10.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At11.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At11.job
- =:\ []

2009-03-26 c:\windows\Tasks\At12.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At13.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At14.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At15.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At16.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At17.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At18.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At19.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At2.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At20.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At21.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At22.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At23.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At24.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At25.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At26.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At27.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At28.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At29.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At3.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At30.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At31.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At32.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At33.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At34.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At35.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At36.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At37.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At38.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At39.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At4.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At40.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At41.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At42.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At43.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At44.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At45.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At46.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At47.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At48.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At5.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At6.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At7.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At8.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At9.job
- c:\windows\system32\4LU7K1qI.exe []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.rr.com/flash/index.cfm
uInternet Connection Wizard,ShellNext = hxxp://activation.rr.com/
uInternet Settings,ProxyOverride = localhost
IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-26 15:33:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TBQIZVJN]
"ImagePath"="\??\c:\windows\system32\tbqizvjn.ocn"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-174384309-967217451-886241972-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(556)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-03-26 15:36:52
ComboFix-quarantined-files.txt 2009-03-26 20:36:36
ComboFix2.txt 2009-03-26 20:06:28

Pre-Run: 55,856,869,376 bytes free
Post-Run: 55,845,654,528 bytes free

254 — E O F — 2009-03-21 08:04:39

ComboFix 09-03-25.04 - Owner 2009-03-26 15:31:36.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.200 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((( Files Created from 2009-02-26 to 2009-03-26 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-21 18:24 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-21 18:24 ——— d—–w c:\program files\SpywareBlaster
2009-03-14 13:07 ——— d—–w c:\program files\Spybot - Search & Destroy
2009-02-25 15:25 ——— d—–w c:\program files\SUPERAntiSpyware
2009-02-24 16:04 ——— d—–w c:\documents and settings\Owner\Application Data\HPAppData
2009-02-22 00:23 ——— d—–w c:\program files\Iomega
2009-02-21 20:04 ——— d—–w c:\program files\Avira
2009-02-21 20:04 ——— d—–w c:\documents and settings\All Users\Application Data\Avira
2009-02-21 14:48 ——— d—–w c:\program files\Lavasoft
2009-02-21 14:48 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2009-02-21 14:10 ——— d—–w c:\program files\Eusing Free Registry Cleaner
2009-02-20 21:04 ——— d—–w c:\program files\MSECache
2009-02-19 14:41 ——— d—–w c:\program files\Java
2009-02-14 14:04 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-13 21:22 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-02-13 21:19 ——— d—–w c:\documents and settings\Owner\Application Data\Image Zone Express
2009-02-13 15:09 ——— d—–w c:\program files\HP
2009-02-13 15:08 ——— d—–w c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-02-11 22:14 ——— d—–w c:\documents and settings\Owner\Application Data\HP
2009-02-11 22:06 ——— d—–w c:\program files\Hewlett-Packard
2009-02-11 22:06 ——— d—–w c:\program files\Common Files\HP
2009-02-11 22:06 ——— d—–w c:\documents and settings\All Users\Application Data\HP
2009-02-11 15:19 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 15:19 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-02-09 11:13 1,846,784 —-a-w c:\windows\system32\win32k.sys
2009-01-17 18:29 410,984 —-a-w c:\windows\system32\deploytk.dll
2009-01-06 14:21 28,672 —-a-w c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\InetWrap.dll
2004-09-20 17:15 0 -csha-w c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-25 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2004-01-16 229376]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"Iomega Startup Options"="c:\program files\Iomega\Common\ImgStart.exe" [2000-06-02 32768]
"Iomega Drive Icons"="c:\program files\Iomega\DriveIcons\ImgIcon.exe" [2000-06-13 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-09-01 176128]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-14 185896]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-16 28672]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-17 148888]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 c:\windows\AGRSMMSG.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
HP Image Zone Fast Start.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
PopSubtract.lnk - c:\program files\InterMute\PopSubtract\PopSub.exe [2004-08-24 233472]
Wireless Client Manager.lnk - c:\program files\Wireless\Client Manager\CMAGS.EXE [2004-09-04 339968]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv41"= ir41_32.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\Conference\\Conference.dll"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqcopy.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-05 28544]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
R3 wlags51b;Wireless LAN USB Driver;c:\windows\system32\drivers\wlags51b.sys [2004-09-04 177664]
S2 mrtRate;mrtRate; [x]
S2 TBQIZVJN;TBQIZVJN;\??\c:\windows\system32\tbqizvjn.ocn –> c:\windows\system32\tbqizvjn.ocn [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\Info.exe folder.htt 480 480
.
Contents of the 'Scheduled Tasks' folder

2009-03-26 c:\windows\Tasks\At1.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At10.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At11.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At11.job
- =:\ []

2009-03-26 c:\windows\Tasks\At12.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At13.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At14.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At15.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At16.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At17.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At18.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At19.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At2.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At20.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At21.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At22.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At23.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At24.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At25.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At26.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At27.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At28.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At29.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At3.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At30.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At31.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At32.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At33.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At34.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At35.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At36.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At37.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At38.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At39.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At4.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At40.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At41.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At42.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-25 c:\windows\Tasks\At43.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At44.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At45.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At46.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At47.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At48.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At5.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At6.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At7.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At8.job
- c:\windows\system32\4LU7K1qI.exe []

2009-03-26 c:\windows\Tasks\At9.job
- c:\windows\system32\4LU7K1qI.exe []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.rr.com/flash/index.cfm
uInternet Connection Wizard,ShellNext = hxxp://activation.rr.com/
uInternet Settings,ProxyOverride = localhost
IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-26 15:33:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TBQIZVJN]
"ImagePath"="\??\c:\windows\system32\tbqizvjn.ocn"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-174384309-967217451-886241972-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(556)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-03-26 15:36:52
ComboFix-quarantined-files.txt 2009-03-26 20:36:36
ComboFix2.txt 2009-03-26 20:06:28

Pre-Run: 55,856,869,376 bytes free
Post-Run: 55,845,654,528 bytes free

254 — E O F — 2009-03-21 08:04:39

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:25:31 PM, on 3/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterMute\PopSubtract\PopSub.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Wireless\Client Manager\CMAGS.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://activation.rr.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\InterMute\PopSubtract\PopSub.exe
O4 - Global Startup: Wireless Client Manager.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145569068859
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A526A2C7-723E-4081-BF70-A7A9913E8C4A} (LogData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\system32\IomegaAccess.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\system32\ZipToA.exe

–
End of file - 11970 bytes

oldman960

Post #12March 26, 2009, 11:41 PM UTC

Hi keltics,

Do you think it is a coincidence that Google France showed up on my wife's laptop the same day it was on my pc?

I'm not sure.

On the google tool bar, click the tool icon (it looks like a wrench). This will bring up the Toolbar options page. Make the appropriate settings adjustments.

You will need to disable Spybot's Tea Timer function, if it is running, as it may interfere. - this is a two step process.
First step:

Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
If you have Version 1.4, Click on Exit Spybot S&D Resident

Second step, For Either Version :

Open Spybot S&D
Click Mode, choose Advanced Mode
Go To the bottom of the Vertical Panel on the Left, Click Tools
then, also in left panel, click Resident shows a red/white shield.
If your firewall raises a question, say OK
In the Resident protection status frame, Uncheck the box labelled Resident "Tea-Timer"(Protection of over-all system settings) active
OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine fully for the changes to take effect.

It looks like combofix was ran twice which may explain why a file isn't showing in the logs. In windows Explorer, please look at C:\combofix.txt for a file named combofix2.txt. I need to see the top portion of the log, the section named
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

Please post that section.

1st

You have some old vulnerable java to uninstall. Please go to add/remove programs and uninstall

J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
J2SE Runtime Environment 5.0 Update 10
Java™ SE Runtime Environment 6 Update 1
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Java 2 Runtime Environment, SE v1.4.2_03

Do Not uninstall Java™ 6 Update 12

Next

There are some signs of infection which we will remove.

It is important that you allow this next tool to reboot when prompted

Next, Double click on OTList2.exe

Copy and paste in all of the the text in the code box into the window Under the Custom Scans/Fixes box at the bottom,
Do Not copy the word CODE
please note the fix starts with the :

:Processes
Explorer.EXE 

:Services
TBQIZVJN

:Reg
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TBQIZVJN]

:Files
c:\windows\Tasks\At*.job
c:\windows\system32\4LU7K1qI.exe
c:\windows\system32\tbqizvjn.ocn 
C:\WINDOWS\System32\ahtn.htm

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post back with

deletion section from combofix2
OTLISTIT2 log
new HJT log

keltics

Post #13March 27, 2009, 10:41 AM UTC

The google tool bar has no wrench. There is an icon that looks like a 'gear' and when I put the cursor on it says tools, could that be it? What are the apprpriate settingsyou mention?

keltics

Post #14March 27, 2009, 10:54 AM UTC

I'm going to be away from this machine from Friday afternoon thru Sunday afternoon, so if I you don't hear from me I haven't abandoned the forum.

oldman960

Post #15March 27, 2009, 11:18 AM UTC

Hi keltics, No problem. Thanks for letting me know. This is what I have for a google toolbar 📎google.PNG If you click it, you will get a menu, Click options and you will get a screen like this 📎google1.PNG You could always uninstall the toolbar and go to google.com and get a new one in the language of your choice.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Google France? I think I'm hijacked.

✨ Ask AI

Ask AI