[Resolved] Firefox Redirecting / Malware wont update or run

Thank you for your assistance.

Firefox initially gave me problems with any pdf documents. It would not view them. I tried downloading the latest version of Acrobat Reader, but that did not solve the problem. Firefox then began to hang. Most recently it is redirecting searches to other sites.

I have updated and run spybot with nothing identified. I attemped to run Malwarebytes unsuccessfully (it would not update). When I run Symantec Corp. Anti Virus there are a number of files that come up in the event log as "Scan Ommissions" where the error says that the listed file could not be scanned due to extraction errors encountered by the decomposer engines.

I went to geekstogo to attempt to solve this independently. They had me download Malwarebytes Anti-Malware. I already had this installed from last September; however, I couldn't get the program to update. It reports that it cannot reach the update site. I went ahead and downloaded the program again on the assumption that perhaps there was a newer version. When I went to launch it and said look for updates, I received the standard Windows "…has encountered a problem and needs to close. We are sorry for the inconvenience" error.

I've pasted my hjt report below. Thank you in advance for your assistance. I will reply to you at least 1x each day once I hear from you. This is my wife's work computer and she is on hold until I get it fixed.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:33:10 PM, on 4/13/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Spyware Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Canon\MultiPASS4\monitr32.exe
C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://v4.windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [monitr32] C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - HKLM\..\Run: [MPTBox] C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [fxredir] C:\WINDOWS\system32\fxredir.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2005\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Spyware Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MpService - Canon Inc - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

–
End of file - 11520 bytes

Thanks for the quick reply.

I have run Combofix and provided the log below. A couple of things to know in case these are problems. After the Combofix generated re-boot, the system went through it's regular start up and tried to auto run the Symantec Anti-Virus. I canceled this when it came up. Also, when I just started Firefox to write this, it started in Safe Mode.

Thanks. Harold

ComboFix 09-04-15.08 - Marcia Gordon 04/15/2009 13:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.173 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt
c:\windows\msagent\rabofin.bak1
c:\windows\msagent\rabofin.bak2
c:\windows\msagent\rabofin.ini
c:\windows\msagent\rabofin.ini2
c:\windows\msagent\rabofin.tmp
c:\windows\system32\bszip.dll
c:\windows\system32\Cache
c:\windows\yaljo.hvv

.
((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 )))))))))))))))))))))))))))))))
.

2009-04-15 20:32 . 2009-04-15 20:32 ——– d—–w c:\windows\LastGood
2009-04-09 05:42 . 2009-04-09 05:42 54584 —-a-w c:\documents and settings\harold\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-08 04:16 . 2009-04-08 20:29 ——– d—–w c:\documents and settings\All Users\Application Data\Adobe(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-15 20:31 . 2006-11-08 00:59 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-15 17:20 . 2009-02-02 05:07 ——– d—–w c:\documents and settings\Marcia Gordon\Application Data\gSyncit
2009-04-14 03:14 . 2008-09-14 16:22 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 04:14 . 2005-11-13 04:43 ——– d—–w c:\program files\Common Files\Adobe
2009-04-08 03:54 . 2009-04-08 20:23 259340 —-a-w c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-04-08 02:14 . 2009-03-04 05:11 ——– d—–w c:\documents and settings\All Users\Application Data\NOS
2009-04-06 22:32 . 2008-09-14 16:22 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 22:32 . 2008-09-14 16:22 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-01 11:21 . 2005-12-06 17:08 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-16 15:20 . 2008-05-02 22:21 ——– d—–w c:\program files\Apple Software Update
2009-03-04 05:20 . 2009-03-04 05:20 ——– d—–w c:\program files\Common Files\Adobe AIR
2009-03-04 05:11 . 2009-03-04 05:11 ——– d—–w c:\program files\NOS
2009-02-19 01:34 . 2008-04-01 02:37 ——– d—–w c:\documents and settings\Marcia Gordon\Application Data\U3
2009-02-09 10:19 . 2007-03-08 13:47 1846272 ——w c:\windows\system32\dllcache\win32k.sys
2009-02-09 10:19 . 2004-08-11 22:00 1846272 —-a-w c:\windows\system32\win32k.sys
2009-01-17 05:35 . 2006-05-19 15:08 3594752 ——w c:\windows\system32\dllcache\mshtml.dll
2008-12-30 01:27 . 2005-11-17 04:59 54584 —-a-w c:\documents and settings\Marcia Gordon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-01-14 00:33 . 2008-01-14 00:33 32 —-a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2006-12-12 01:38 . 2006-12-12 01:38 56912 —-a-w c:\documents and settings\Marcia Gordon\g2mdlhlpx.exe
2006-01-04 20:01 . 2006-01-04 20:01 563712 —-a-w c:\documents and settings\Marcia Gordon\370_gotomypc.exe
2005-11-15 05:00 . 2005-11-15 05:00 483401 —-a-w c:\documents and settings\Marcia Gordon\314_gotomypc.exe
2005-11-15 04:55 . 2005-11-15 04:55 136 —-a-w c:\documents and settings\Marcia Gordon\Local Settings\Application Data\fusioncache.dat
2003-04-22 22:21 . 2003-04-22 22:21 38737 —-a-w c:\program files\mccm.exe
2003-01-18 11:33 . 2003-01-18 11:33 38912 —-a-w c:\program files\foxtools.fll
2002-10-03 21:23 . 2002-10-03 21:23 47 —-a-w c:\program files\Dydacomp.url
2002-08-21 20:57 . 2002-08-21 20:57 412029 —-a-w c:\program files\UPSMAXI.zip
2002-07-31 16:51 . 2002-07-31 16:51 2596 —-a-w c:\program files\UPSMAXI.lib
2002-07-31 16:51 . 2002-07-31 16:51 24576 —-a-w c:\program files\UPSMAXI.dll
2002-07-31 16:51 . 2002-07-31 16:51 1012 —-a-w c:\program files\UPSMAXI.exp
2002-01-11 17:43 . 2002-01-11 17:43 128 —-a-w c:\program files\decompress.dat
2002-01-11 17:42 . 2002-01-11 17:42 101 —-a-w c:\program files\compress.dat
2000-12-15 00:50 . 2000-12-15 00:50 57344 —-a-w c:\program files\decompress.dll
2000-12-15 00:50 . 2000-12-15 00:50 5360 —-a-w c:\program files\decompress.lib
2000-12-15 00:48 . 2000-12-15 00:48 65536 —-a-w c:\program files\compress.dll
2000-12-15 00:48 . 2000-12-15 00:48 5844 —-a-w c:\program files\compress.lib
2000-12-12 01:17 . 2000-12-12 01:17 163912 —-a-w c:\program files\DecompressTest.exe
2000-12-11 18:43 . 2000-12-11 18:43 50049 —-a-w c:\program files\COMPIFC.H
2000-08-31 20:12 . 2000-08-31 20:12 6570 —-a-w c:\program files\COMPRESS.H
2000-08-31 20:12 . 2000-08-31 20:12 821328 —-a-w c:\program files\POSTAL.DAT
2000-08-31 20:12 . 2000-08-31 20:12 28672 —-a-w c:\program files\ETBL.BIN
2000-08-31 20:12 . 2000-08-31 20:12 28672 —-a-w c:\program files\DTBL.BIN
2008-09-07 08:2006-10-20 17:04 26:10 . c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"PRONoMgrWired"="c:\program files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2004-12-09 86016]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"monitr32"="c:\program files\Canon\MultiPASS4\monitr32.exe" [2001-08-22 311296]
"MPTBox"="c:\progra~1\Canon\MULTIP~1\MPTBOX.EXE" [2001-08-22 151552]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-03-17 124656]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-05 630784]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-11-08 65536]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-26 2178832]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-13 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-14 536576]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-30 30248]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-26 563984]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"fxredir"="c:\windows\system32\fxredir.exe" [2001-08-22 65536]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-01-23 101136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Marcia Gordon\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2006-1-14 233472]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk
backup=c:\windows\pss\officejet 6100.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Marcia Gordon^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\Marcia Gordon\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-09-07 08:26 29744 —-a-w c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-01-30 05:10 46632 —-a-w c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 13:50 53248 —-a-w c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-09-14 13:50 131072 —-a-w c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-03-29 06:37 413696 —-a-w c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07 2260480 –sha-r c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03 210472 —-a-w c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinVNC4"=2 (0x2)
"AOL ACS"=2 (0x2)
"GoogleDesktopManager-061008-081103"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R2 DP1112;DP1112; [x]
R3 EraserUtilDrv10630;EraserUtilDrv10630; [x]
R3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
R3 MmedFilter;MmedFilter; [x]
R3 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-03-17 115952]
R4 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-07 29744]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-04 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-06 101936]


— Other Services/Drivers In Memory —

*Deregistered* - ALG
*Deregistered* - Apple Mobile Device
*Deregistered* - AudioSrv
*Deregistered* - AVG Anti-Spyware Guard
*Deregistered* - BITS
*Deregistered* - Bonjour Service
*Deregistered* - Browser
*Deregistered* - ccEvtMgr
*Deregistered* - ccSetMgr
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - DefWatch
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTPFilter
*Deregistered* - IISADMIN
*Deregistered* - ImapiService
*Deregistered* - iPod Service
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - LVCOMSer
*Deregistered* - LVPrcSrv
*Deregistered* - LVSrvLauncher
*Deregistered* - MpService
*Deregistered* - Netman
*Deregistered* - NICCONFIGSVC
*Deregistered* - Nla
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - QBCFMonitorService
*Deregistered* - RasAuto
*Deregistered* - RasMan
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - SAVRTPEL
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SMTPSVC
*Deregistered* - SPBBCDrv
*Deregistered* - SPBBCSvc
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - ssrtln
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - Symantec AntiVirus
*Deregistered* - SymEvent
*Deregistered* - SYMREDRV
*Deregistered* - SYMTDI
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - tfsnboio
*Deregistered* - tfsncofs
*Deregistered* - tfsndrct
*Deregistered* - tfsndres
*Deregistered* - tfsnifs
*Deregistered* - tfsnopio
*Deregistered* - tfsnpool
*Deregistered* - tfsnudf
*Deregistered* - tfsnudfa
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - UMWdf
*Deregistered* - Update
*Deregistered* - upnphost
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - w32time
*Deregistered* - W3SVC
*Deregistered* - Wanarp
*Deregistered* - wanatw
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - WinDefend
*Deregistered* - winmgmt
*Deregistered* - wltrysvc
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7636b814-ff94-11dc-8a91-00038a000015}]
\Shell\AutoRun\command - E:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder

2009-03-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:34]

2009-04-03 c:\windows\Tasks\BACKUP NOW FRIDAY MESSAGE.job
- C:\BACKUPNOWFRIDAYMESSAGE.doc [2005-10-29 21:25]

2006-03-02 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p officejet 6100 series5E771253C1676EBED677BF361FDFC537825E15B8133157349.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 08:52]

2009-04-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20]

2009-04-03 c:\windows\Tasks\My Documents Changed Files MG.job
- c:\program files\Stomp\Backup MyPC\System\bestart.exe [2002-11-04 11:09]

2009-04-13 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2004-05-12 21:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://dsl.sbc.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Marcia Gordon\Application Data\Mozilla\Firefox\Profiles\r4mp8c96.default\
FF - prefs.js: browser.startup.homepage - hxxp://dsl.sbc.yahoo.com/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-15 13:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(8432)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Spyware Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Canon\MultiPASS4\mpservic.exe
c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\WLTRAY.EXE
c:\program files\Brother\ControlCenter3\BrccMCtl.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Digital Line Detect\DLG.exe
c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe
c:\program files\Logitech\SetPoint\SetPoint.exe
c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
c:\program files\Symantec AntiVirus\DoScan.exe
c:\program files\Common Files\Logitech\khalshared\KHALMNPR.exe
c:\program files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
c:\program files\Java\jre1.6.0_07\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-04-15 13:48 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-15 20:48

Pre-Run: 37,344,718,848 bytes free
Post-Run: 37,529,051,136 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

353 — E O F — 2009-04-15 19:50

Hi:

Here is the next log. Malware is presently running, but I didn't know if you needed it to finish before sending this along.

ComboFix 09-04-15.08 - Marcia Gordon 04/15/2009 14:57.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.178 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Marcia Gordon\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_DP1112
——-\Legacy_ERASERUTILDRV10630
——-\Legacy_MMEDFILTER
——-\Service_DP1112
——-\Service_EraserUtilDrv10630
——-\Service_MmedFilter


((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 )))))))))))))))))))))))))))))))
.

2009-04-15 21:45 . 2009-04-15 21:43 73728 —-a-w c:\windows\system32\javacpl.cpl
2009-04-15 21:45 . 2009-04-15 21:43 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-15 21:30 . 2009-04-15 21:30 0 —-a-w c:\windows\system32\REN3C.tmp
2009-04-15 21:30 . 2009-04-15 21:30 0 —-a-w c:\windows\system32\REN3B.tmp
2009-04-09 05:42 . 2009-04-09 05:42 54584 —-a-w c:\documents and settings\harold\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-08 04:16 . 2009-04-08 20:29 ——– d—–w c:\documents and settings\All Users\Application Data\Adobe(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-15 22:08 . 2006-11-08 00:59 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-15 21:43 . 2005-10-21 01:47 ——– d—–w c:\program files\Java
2009-04-15 17:20 . 2009-02-02 05:07 ——– d—–w c:\documents and settings\Marcia Gordon\Application Data\gSyncit
2009-04-14 03:14 . 2008-09-14 16:22 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 04:14 . 2005-11-13 04:43 ——– d—–w c:\program files\Common Files\Adobe
2009-04-08 03:54 . 2009-04-08 20:23 259340 —-a-w c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-04-08 02:14 . 2009-03-04 05:11 ——– d—–w c:\documents and settings\All Users\Application Data\NOS
2009-04-06 22:32 . 2008-09-14 16:22 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 22:32 . 2008-09-14 16:22 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-01 11:21 . 2005-12-06 17:08 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-16 15:20 . 2008-05-02 22:21 ——– d—–w c:\program files\Apple Software Update
2009-03-04 05:20 . 2009-03-04 05:20 ——– d—–w c:\program files\Common Files\Adobe AIR
2009-03-04 05:11 . 2009-03-04 05:11 ——– d—–w c:\program files\NOS
2009-02-19 01:34 . 2008-04-01 02:37 ——– d—–w c:\documents and settings\Marcia Gordon\Application Data\U3
2009-02-09 10:19 . 2007-03-08 13:47 1846272 ——w c:\windows\system32\dllcache\win32k.sys
2009-02-09 10:19 . 2004-08-11 22:00 1846272 —-a-w c:\windows\system32\win32k.sys
2009-01-17 05:35 . 2006-05-19 15:08 3594752 ——w c:\windows\system32\dllcache\mshtml.dll
2008-12-30 01:27 . 2005-11-17 04:59 54584 —-a-w c:\documents and settings\Marcia Gordon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-01-14 00:33 . 2008-01-14 00:33 32 —-a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2006-12-12 01:38 . 2006-12-12 01:38 56912 —-a-w c:\documents and settings\Marcia Gordon\g2mdlhlpx.exe
2006-01-04 20:01 . 2006-01-04 20:01 563712 —-a-w c:\documents and settings\Marcia Gordon\370_gotomypc.exe
2005-11-15 05:00 . 2005-11-15 05:00 483401 —-a-w c:\documents and settings\Marcia Gordon\314_gotomypc.exe
2005-11-15 04:55 . 2005-11-15 04:55 136 —-a-w c:\documents and settings\Marcia Gordon\Local Settings\Application Data\fusioncache.dat
2003-04-22 22:21 . 2003-04-22 22:21 38737 —-a-w c:\program files\mccm.exe
2003-01-18 11:33 . 2003-01-18 11:33 38912 —-a-w c:\program files\foxtools.fll
2002-10-03 21:23 . 2002-10-03 21:23 47 —-a-w c:\program files\Dydacomp.url
2002-08-21 20:57 . 2002-08-21 20:57 412029 —-a-w c:\program files\UPSMAXI.zip
2002-07-31 16:51 . 2002-07-31 16:51 2596 —-a-w c:\program files\UPSMAXI.lib
2002-07-31 16:51 . 2002-07-31 16:51 24576 —-a-w c:\program files\UPSMAXI.dll
2002-07-31 16:51 . 2002-07-31 16:51 1012 —-a-w c:\program files\UPSMAXI.exp
2002-01-11 17:43 . 2002-01-11 17:43 128 —-a-w c:\program files\decompress.dat
2002-01-11 17:42 . 2002-01-11 17:42 101 —-a-w c:\program files\compress.dat
2000-12-15 00:50 . 2000-12-15 00:50 57344 —-a-w c:\program files\decompress.dll
2000-12-15 00:50 . 2000-12-15 00:50 5360 —-a-w c:\program files\decompress.lib
2000-12-15 00:48 . 2000-12-15 00:48 65536 —-a-w c:\program files\compress.dll
2000-12-15 00:48 . 2000-12-15 00:48 5844 —-a-w c:\program files\compress.lib
2000-12-12 01:17 . 2000-12-12 01:17 163912 —-a-w c:\program files\DecompressTest.exe
2000-12-11 18:43 . 2000-12-11 18:43 50049 —-a-w c:\program files\COMPIFC.H
2000-08-31 20:12 . 2000-08-31 20:12 6570 —-a-w c:\program files\COMPRESS.H
2000-08-31 20:12 . 2000-08-31 20:12 821328 —-a-w c:\program files\POSTAL.DAT
2000-08-31 20:12 . 2000-08-31 20:12 28672 —-a-w c:\program files\ETBL.BIN
2000-08-31 20:12 . 2000-08-31 20:12 28672 —-a-w c:\program files\DTBL.BIN
2008-09-07 08:2006-10-20 17:04 26:10 . c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-15_20.34.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-15 22:05 . 2009-04-15 22:05 16384 c:\windows\temp\Perflib_Perfdata_84.dat
+ 2009-04-15 21:45 . 2009-04-15 21:43 148888 c:\windows\system32\javaws.exe
+ 2009-04-15 21:45 . 2009-04-15 21:43 144792 c:\windows\system32\javaw.exe
+ 2009-04-15 21:45 . 2009-04-15 21:43 144792 c:\windows\system32\java.exe
- 2009-04-08 03:53 . 2009-04-15 20:32 223917 c:\windows\system32\inetsrv\MetaBase.bin
+ 2009-04-08 03:53 . 2009-04-15 22:06 223917 c:\windows\system32\inetsrv\MetaBase.bin
+ 2009-04-15 21:45 . 2009-04-15 21:43 410984 c:\windows\system32\deploytk.dll
+ 2009-04-15 22:02 . 2005-10-21 03:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE
- 2009-04-15 20:27 . 2005-10-21 03:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"PRONoMgrWired"="c:\program files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2004-12-09 86016]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"monitr32"="c:\program files\Canon\MultiPASS4\monitr32.exe" [2001-08-22 311296]
"MPTBox"="c:\progra~1\Canon\MULTIP~1\MPTBOX.EXE" [2001-08-22 151552]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-03-17 124656]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-05 630784]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-11-08 65536]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-26 2178832]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-13 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-14 536576]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-30 30248]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-26 563984]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"fxredir"="c:\windows\system32\fxredir.exe" [2001-08-22 65536]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-15 148888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-01-23 101136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Marcia Gordon\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2006-1-14 233472]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-10-20 24576]
Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-2 546288]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-12-25 688128]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-22 972064]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk
backup=c:\windows\pss\officejet 6100.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Marcia Gordon^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\Marcia Gordon\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-09-07 08:26 29744 —-a-w c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-01-30 05:10 46632 —-a-w c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 13:50 53248 —-a-w c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-09-14 13:50 131072 —-a-w c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-03-29 06:37 413696 —-a-w c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07 2260480 –sha-r c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03 210472 —-a-w c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinVNC4"=2 (0x2)
"AOL ACS"=2 (0x2)
"GoogleDesktopManager-061008-081103"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
R3 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-03-17 115952]
R4 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-07 29744]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-04 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-06 101936]


— Other Services/Drivers In Memory —

*Deregistered* - MpService
*Deregistered* - Netman
*Deregistered* - NICCONFIGSVC
*Deregistered* - Nla
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - QBCFMonitorService
*Deregistered* - RasAuto
*Deregistered* - RasMan
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SMTPSVC
*Deregistered* - SPBBCSvc
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - Symantec AntiVirus
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - UMWdf
*Deregistered* - upnphost
*Deregistered* - w32time
*Deregistered* - W3SVC
*Deregistered* - WebClient
*Deregistered* - WinDefend
*Deregistered* - winmgmt
*Deregistered* - wltrysvc
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-03-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:34]

2009-04-03 c:\windows\Tasks\BACKUP NOW FRIDAY MESSAGE.job
- C:\BACKUPNOWFRIDAYMESSAGE.doc [2005-10-29 21:25]

2006-03-02 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p officejet 6100 series5E771253C1676EBED677BF361FDFC537825E15B8133157349.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 08:52]

2009-04-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20]

2009-04-03 c:\windows\Tasks\My Documents Changed Files MG.job
- c:\program files\Stomp\Backup MyPC\System\bestart.exe [2002-11-04 11:09]

2009-04-13 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2004-05-12 21:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://dsl.sbc.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Marcia Gordon\Application Data\Mozilla\Firefox\Profiles\r4mp8c96.default\
FF - prefs.js: browser.startup.homepage - hxxp://dsl.sbc.yahoo.com/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-15 15:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(8884)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Spyware Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\WLTRAY.EXE
c:\program files\Brother\ControlCenter3\BrccMCtl.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Logitech\khalshared\KHALMNPR.exe
c:\program files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-04-15 15:21 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-15 22:20
ComboFix2.txt 2009-04-15 20:48

Pre-Run: 37,415,698,432 bytes free
Post-Run: 37,394,587,648 bytes free

305 — E O F — 2009-04-15 19:50

You asked re: "Also, when I just started Firefox to write this, it started in Safe Mode."

This simply meant that when I restarted the computer and went to start Firefox again, it started in it's own safe mode. It ran fine, but I'd never seen that before.

Malware has finished. I have copied 2 logs below. The first was immediately upon completion of the scan. At which point I received the following messaged:

The MalwareBytes finished. Below is the log from it. It found 12 issues. When I told it to remove the identified items, I received the following message:

Certain items could not be removed. The first few are listed below. All items that could not be removed have been added to the delete on reboot list. Please restart now. A log file was created.

All of the listed files are in the folder c:\DocumentsandSettings\NetworkService\Cookies\
MM2048.dat
MM256.dat
bumo.reg
jababug.inf
uwux.exe

I will not do anything else until I hear back from you. Thanks Tom.


The log right before I clicked to remove the infected files read as follows:

Malwarebytes' Anti-Malware 1.36
Database version: 1987
Windows 5.1.2600 Service Pack 2

4/15/2009 4:24:58 PM
mbam-log-2009-04-15 (16-24-49).txt

Scan type: Full Scan (C:\|)
Objects scanned: 163000
Time elapsed: 56 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\compress.dll (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\decompress.dll (Spyware.OnlineGames) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\NetworkService\Cookies\MM2048.DAT (Trojan.Agent) -> No action taken.
C:\Documents and Settings\NetworkService\Cookies\MM256.DAT (Trojan.Agent) -> No action taken.
C:\Documents and Settings\NetworkService\Cookies\bumo.reg (Fake.Dropped.Malware) -> No action taken.
C:\Documents and Settings\NetworkService\Cookies\jababug.inf (Fake.Dropped.Malware) -> No action taken.
C:\Program Files\compress.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files\decompress.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\NetworkService\Cookies\uwux.exe (Fake.Dropped.Malware) -> No action taken.
C:\Documents and Settings\NetworkService\Cookies\jiceji._sy (Fake.Dropped.Malware) -> No action taken.
C:\Documents and Settings\NetworkService\Cookies\esycire._dl (Fake.Dropped.Malware) -> No action taken.
C:\Documents and Settings\NetworkService\Cookies\syssp.exe (Fake.Dropped.Malware) -> No action taken.

LOG AFTER I SAW ABOVE MESSAGE:

Malwarebytes' Anti-Malware 1.36
Database version: 1987
Windows 5.1.2600 Service Pack 2

4/15/2009 4:25:11 PM
mbam-log-2009-04-15 (16-25-11).txt

Scan type: Full Scan (C:\|)
Objects scanned: 163000
Time elapsed: 56 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\compress.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\decompress.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\NetworkService\Cookies\MM2048.DAT (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\MM256.DAT (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\bumo.reg (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\jababug.inf (Fake.Dropped.Malware) -> Delete on reboot.
C:\Program Files\compress.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\decompress.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Cookies\uwux.exe (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\jiceji._sy (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\esycire._dl (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\syssp.exe (Fake.Dropped.Malware) -> Delete on reboot.

You work long hours! Thank you.

Below is the Combofix Log. A couple of things that may be important.

Upon start up the system said that it had downloaded windows updates and wanted to restart. I said no on the assumption that we didn't want anything to change. I then dropped the file on ComboFix and it started to run. When it did, it asked if I wanted a new version. I said no - same reason - didn't want to change anything.

At the end of the combofix run, I received a message before the system re-booted. I was only able to copy part of it. It read as follows:

"Almost done…This window will close in a short while
Please wait a few secods for the report log to pop up

Combofix's log…… (missed this)
Couldn't write 72…. (missed this)

The system then re-booted. It took a long time to shut down and I am assuming that upon restart it automatically did something with the windows updates.

Here is the ComboFix Log, the HJT log is below.

ComboFix 09-04-15.08 - Marcia Gordon 04/16/2009 8:23:26.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.59 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Marcia Gordon\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
C:\WINDOWS\system32\cbeeg.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000021_.tmp.dll
C:\WINDOWS\system32\_000022_.tmp.dll
C:\WINDOWS\system32\_000023_.tmp.dll
C:\WINDOWS\system32\_000024_.tmp.dll
C:\WINDOWS\system32\cbeeg.tmp

.
((((((((((((((((((((((((( Files Created from 2009-03-16 to 2009-04-16 )))))))))))))))))))))))))))))))
.

2009-04-16 15:05:46 . 2009-04-16 15:05:46 150 —-a-w C:\WINDOWS\system32\spupdsvc.inf
2009-04-16 14:49:16 . 2009-04-16 14:49:17 0 d—–w C:\WINDOWS\LastGood
2009-04-15 21:45:26 . 2009-04-15 21:43:30 73728 —-a-w C:\WINDOWS\system32\javacpl.cpl
2009-04-15 21:45:25 . 2009-04-15 21:43:29 410984 —-a-w C:\WINDOWS\system32\deploytk.dll
2009-04-15 21:30:37 . 2009-04-15 21:30:37 0 —-a-w C:\WINDOWS\system32\REN3C.tmp
2009-04-15 21:30:37 . 2009-04-15 21:30:37 0 —-a-w C:\WINDOWS\system32\REN3B.tmp
2009-04-15 20:33:55 . 2009-03-06 14:44:35 283648 —-a-w C:\WINDOWS\system32\SET60.tmp
2009-04-15 20:33:55 . 2009-03-06 14:44:35 283648 ——w C:\WINDOWS\system32\dllcache\pdh.dll
2009-04-15 20:33:55 . 2009-02-06 16:54:36 35328 ——w C:\WINDOWS\system32\dllcache\sc.exe
2009-04-15 20:33:55 . 2005-07-26 04:39:43 60416 ——w C:\WINDOWS\system32\dllcache\colbact.dll
2009-04-15 20:33:53 . 2009-02-09 10:20:34 399360 —-a-w C:\WINDOWS\system32\SET5F.tmp
2009-04-15 20:33:53 . 2009-02-09 10:20:34 399360 ——w C:\WINDOWS\system32\dllcache\rpcss.dll
2009-04-15 20:33:53 . 2009-02-06 17:14:03 110592 ——w C:\WINDOWS\system32\dllcache\services.exe
2009-04-15 20:33:52 . 2009-02-09 10:20:33 473088 ——w C:\WINDOWS\system32\dllcache\fastprox.dll
2009-04-15 20:33:51 . 2009-02-09 10:20:32 453120 ——w C:\WINDOWS\system32\dllcache\wmiprvsd.dll
2009-04-15 20:33:51 . 2009-02-06 16:39:29 227840 ——w C:\WINDOWS\system32\dllcache\wmiprvse.exe
2009-04-15 20:33:49 . 2009-02-09 10:20:33 616960 ——w C:\WINDOWS\system32\dllcache\advapi32.dll
2009-04-15 20:33:47 . 2009-02-09 10:20:33 714752 ——w C:\WINDOWS\system32\dllcache\ntdll.dll
2009-04-09 05:42:55 . 2009-04-09 05:42:55 54584 —-a-w C:\Documents and Settings\harold\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-08 04:16:48 . 2009-04-08 20:29:15 0 d—–w C:\Documents and Settings\All Users\Application Data\Adobe(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-16 15:01:25 . 2006-11-08 00:59:12 0 d—–w C:\Program Files\Symantec AntiVirus
2009-04-16 05:04:09 . 2009-04-16 03:13:24 0 d—–w C:\Program Files\EsetOnlineScanner
2009-04-16 04:07:47 . 2009-02-02 05:07:05 0 d—–w C:\Documents and Settings\Marcia Gordon\Application Data\gSyncit
2009-04-15 21:43:06 . 2005-10-21 01:47:26 0 d—–w C:\Program Files\Java
2009-04-14 03:14:05 . 2008-09-14 16:22:04 0 d—–w C:\Program Files\Malwarebytes' Anti-Malware
2009-04-08 04:14:31 . 2005-11-13 04:43:46 0 d—–w C:\Program Files\Common Files\Adobe
2009-04-08 03:54:51 . 2009-04-08 20:23:30 259340 —-a-w C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-04-08 02:14:14 . 2009-03-04 05:11:40 0 d—–w C:\Documents and Settings\All Users\Application Data\NOS
2009-04-06 22:32:54 . 2008-09-14 16:22:07 38496 —-a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-04-06 22:32:46 . 2008-09-14 16:22:08 15504 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2009-04-01 11:21:46 . 2005-12-06 17:08:01 0 d—–w C:\Program Files\Spybot - Search & Destroy
2009-03-21 14:18:57 . 2006-07-05 10:55:01 986112 ——w C:\WINDOWS\system32\dllcache\kernel32.dll
2009-03-16 15:20:31 . 2008-05-02 22:21:33 0 d—–w C:\Program Files\Apple Software Update
2009-03-04 05:20:04 . 2009-03-04 05:20:04 0 d—–w C:\Program Files\Common Files\Adobe AIR
2009-03-04 05:11:40 . 2009-03-04 05:11:40 0 d—–w C:\Program Files\NOS
2009-03-03 00:18:25 . 2009-03-03 00:18:25 826368 —-a-w C:\WINDOWS\system32\SETA4.tmp
2009-03-03 00:18:25 . 2006-05-10 05:23:03 826368 ——w C:\WINDOWS\system32\dllcache\wininet.dll
2009-02-28 04:54:41 . 2004-08-11 22:12:49 636072 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2009-02-20 10:20:49 . 2008-09-10 13:40:19 13824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2009-02-20 10:20:49 . 2007-08-14 01:39:06 70656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2009-02-20 05:14:12 . 2007-08-14 00:56:54 161792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
2009-02-19 01:34:49 . 2008-04-01 02:37:19 0 d—–w C:\Documents and Settings\Marcia Gordon\Application Data\U3
2009-02-09 10:20:34 . 2006-08-17 12:28:27 723456 ——w C:\WINDOWS\system32\dllcache\lsasrv.dll
2009-02-09 10:20:34 . 2004-08-11 22:00:18 723456 —-a-w C:\WINDOWS\system32\lsasrv.dll
2009-02-09 10:20:33 . 2004-08-11 22:00:25 714752 —-a-w C:\WINDOWS\system32\ntdll.dll
2009-02-09 10:20:33 . 2004-08-11 22:00:00 616960 —-a-w C:\WINDOWS\system32\advapi32.dll
2009-02-09 10:19:34 . 2007-03-08 13:47:48 1846272 ——w C:\WINDOWS\system32\dllcache\win32k.sys
2009-02-09 10:19:34 . 2004-08-11 22:00:37 1846272 —-a-w C:\WINDOWS\system32\win32k.sys
2009-02-06 17:24:35 . 2006-12-19 14:17:19 2180480 ——w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2009-02-06 17:24:35 . 2004-08-11 22:00:25 2180480 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
2009-02-06 17:22:17 . 2006-12-19 14:15:09 2136064 ——w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2009-02-06 17:14:03 . 2004-08-11 22:00:30 110592 —-a-w C:\WINDOWS\system32\services.exe
2009-02-06 16:54:36 . 2004-08-11 22:00:30 35328 —-a-w C:\WINDOWS\system32\sc.exe
2009-02-06 16:49:02 . 2006-12-19 12:55:40 2015744 ——w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2009-02-06 16:49:02 . 2006-12-19 12:55:39 2057728 ——w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2009-02-06 16:49:02 . 2004-08-04 03:59:00 2057728 —-a-w C:\WINDOWS\system32\ntkrnlpa.exe
2009-02-03 20:08:52 . 2009-02-03 20:08:52 55808 —-a-w C:\WINDOWS\system32\SET114.tmp
2009-02-03 20:08:52 . 2009-02-03 20:08:52 55808 ——w C:\WINDOWS\system32\dllcache\secur32.dll
2008-12-30 01:27:11 . 2005-11-17 04:59:30 54584 —-a-w C:\Documents and Settings\Marcia Gordon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-01-14 00:33:43 . 2008-01-14 00:33:43 32 —-a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2006-12-12 01:38:26 . 2006-12-12 01:38:26 56912 —-a-w C:\Documents and Settings\Marcia Gordon\g2mdlhlpx.exe
2006-01-04 20:01:16 . 2006-01-04 20:01:12 563712 —-a-w C:\Documents and Settings\Marcia Gordon\370_gotomypc.exe
2005-11-15 05:00:30 . 2005-11-15 05:00:26 483401 —-a-w C:\Documents and Settings\Marcia Gordon\314_gotomypc.exe
2005-11-15 04:55:13 . 2005-11-15 04:55:13 136 —-a-w C:\Documents and Settings\Marcia Gordon\Local Settings\Application Data\fusioncache.dat
2003-04-22 22:21:24 . 2003-04-22 22:21:24 38737 —-a-w C:\Program Files\mccm.exe
2003-01-18 11:33:52 . 2003-01-18 11:33:52 38912 —-a-w C:\Program Files\foxtools.fll
2002-10-03 21:23:30 . 2002-10-03 21:23:30 47 —-a-w C:\Program Files\Dydacomp.url
2002-08-21 20:57:06 . 2002-08-21 20:57:06 412029 —-a-w C:\Program Files\UPSMAXI.zip
2002-07-31 16:51:28 . 2002-07-31 16:51:28 2596 —-a-w C:\Program Files\UPSMAXI.lib
2002-07-31 16:51:28 . 2002-07-31 16:51:28 24576 —-a-w C:\Program Files\UPSMAXI.dll
2002-07-31 16:51:28 . 2002-07-31 16:51:28 1012 —-a-w C:\Program Files\UPSMAXI.exp
2002-01-11 17:43:34 . 2002-01-11 17:43:34 128 —-a-w C:\Program Files\decompress.dat
2002-01-11 17:42:58 . 2002-01-11 17:42:58 101 —-a-w C:\Program Files\compress.dat
2000-12-15 00:50:14 . 2000-12-15 00:50:14 5360 —-a-w C:\Program Files\decompress.lib
2000-12-15 00:48:02 . 2000-12-15 00:48:02 5844 —-a-w C:\Program Files\compress.lib
2000-12-12 01:17:18 . 2000-12-12 01:17:18 163912 —-a-w C:\Program Files\DecompressTest.exe
2000-12-11 18:43:54 . 2000-12-11 18:43:54 50049 —-a-w C:\Program Files\COMPIFC.H
2000-08-31 20:12:54 . 2000-08-31 20:12:54 6570 —-a-w C:\Program Files\COMPRESS.H
2000-08-31 20:12:52 . 2000-08-31 20:12:52 821328 —-a-w C:\Program Files\POSTAL.DAT
2000-08-31 20:12:52 . 2000-08-31 20:12:52 28672 —-a-w C:\Program Files\ETBL.BIN
2000-08-31 20:12:52 . 2000-08-31 20:12:52 28672 —-a-w C:\Program Files\DTBL.BIN
2008-09-07 08:2006-10-20 17:04 26:10 . C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-15_20.34.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-16 14:41:57 . 2009-04-16 14:41:57 16384 C:\WINDOWS\temp\Perflib_Perfdata_e0.dat
+ 2005-10-27 03:26:14 . 2008-07-09 07:38:27 26488 C:\WINDOWS\system32\spupdsvc.exe
+ 2005-10-21 01:45:46 . 2007-11-30 12:39:22 17272 C:\WINDOWS\system32\spmsg.dll
- 2005-10-21 01:45:46 . 2007-11-30 11:18:51 17272 C:\WINDOWS\system32\spmsg.dll
+ 2004-08-11 22:00:30 . 2009-02-06 16:54:36 35328 C:\WINDOWS\system32\sc.exe
+ 2004-08-11 22:00:28 . 2009-02-20 18:09:38 44544 C:\WINDOWS\system32\pngfilt.dll
- 2004-08-11 22:00:28 . 2008-12-20 23:15:38 44544 C:\WINDOWS\system32\pngfilt.dll
+ 2008-02-05 15:48:04 . 2008-02-05 15:48:04 77824 C:\WINDOWS\system32\OnlineScannerUninstaller.exe
+ 2004-08-11 22:11:26 . 2008-06-12 14:16:46 91648 C:\WINDOWS\system32\mtxoci.dll
+ 2004-08-11 22:11:26 . 2008-06-12 14:16:46 58880 C:\WINDOWS\system32\msdtclog.dll
- 2004-08-11 22:11:26 . 2004-08-04 10:00:00 58880 C:\WINDOWS\system32\msdtclog.dll
- 2004-08-11 22:00:17 . 2008-12-20 23:15:23 27648 C:\WINDOWS\system32\jsproxy.dll
+ 2004-08-11 22:00:17 . 2009-02-20 18:09:37 27648 C:\WINDOWS\system32\jsproxy.dll
+ 2007-08-14 01:39:10 . 2009-02-20 10:20:49 13824 C:\WINDOWS\system32\ieudinit.exe
- 2007-08-14 01:39:10 . 2008-12-19 09:10:15 13824 C:\WINDOWS\system32\ieudinit.exe
- 2004-08-11 22:00:16 . 2008-12-20 23:15:21 44544 C:\WINDOWS\system32\iernonce.dll
+ 2004-08-11 22:00:16 . 2009-02-20 18:09:37 44544 C:\WINDOWS\system32\iernonce.dll
- 2004-08-11 22:00:16 . 2007-08-14 01:45:18 78336 C:\WINDOWS\system32\ieencode.dll
+ 2004-08-11 22:00:16 . 2009-02-20 18:09:38 78336 C:\WINDOWS\system32\ieencode.dll
- 2004-08-11 22:00:16 . 2008-12-19 09:10:15 70656 C:\WINDOWS\system32\ie4uinit.exe
+ 2004-08-11 22:00:16 . 2009-02-20 10:20:49 70656 C:\WINDOWS\system32\ie4uinit.exe
+ 2009-02-03 20:08:52 . 2009-02-03 20:08:52 55808 C:\WINDOWS\system32\dllcache\secur32.dll
+ 2009-04-15 20:33:55 . 2009-02-06 16:54:36 35328 C:\WINDOWS\system32\dllcache\sc.exe
+ 2006-05-10 05:23:01 . 2009-02-20 18:09:38 44544 C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2006-05-10 05:23:01 . 2008-12-20 23:15:38 44544 C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-06-12 14:16:46 . 2008-06-12 14:16:46 91648 C:\WINDOWS\system32\dllcache\mtxoci.dll
+ 2008-06-12 14:16:46 . 2008-06-12 14:16:46 66560 C:\WINDOWS\system32\dllcache\mtxclu.dll
+ 2008-09-10 13:40:22 . 2009-02-20 18:09:37 52224 C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2008-09-10 13:40:22 . 2008-12-20 23:15:24 52224 C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-06-12 14:16:46 . 2008-06-12 14:16:46 58880 C:\WINDOWS\system32\dllcache\msdtclog.dll
+ 2006-05-10 05:22:59 . 2009-02-20 18:09:37 27648 C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2006-05-10 05:22:59 . 2008-12-20 23:15:23 27648 C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2008-09-10 13:40:19 . 2008-12-19 09:10:15 13824 C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-09-10 13:40:19 . 2009-02-20 10:20:49 13824 C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2007-08-14 01:39:10 . 2008-12-20 23:15:21 44544 C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2007-08-14 01:39:10 . 2009-02-20 18:09:37 44544 C:\WINDOWS\system32\dllcache\iernonce.dll
- 2007-08-14 01:45:18 . 2007-08-14 01:45:18 78336 C:\WINDOWS\system32\dllcache\ieencode.dll
+ 2007-08-14 01:45:18 . 2009-02-20 18:09:38 78336 C:\WINDOWS\system32\dllcache\ieencode.dll
- 2007-08-14 01:39:06 . 2008-12-19 09:10:15 70656 C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2007-08-14 01:39:06 . 2009-02-20 10:20:49 70656 C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2008-09-10 13:40:19 . 2008-12-20 23:15:13 63488 C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-09-10 13:40:19 . 2009-02-20 18:09:36 63488 C:\WINDOWS\system32\dllcache\icardie.dll
+ 2009-04-15 20:33:55 . 2005-07-26 04:39:43 60416 C:\WINDOWS\system32\dllcache\colbact.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:38 44544 C:\WINDOWS\ie7updates\KB963027-IE7\pngfilt.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:24 52224 C:\WINDOWS\ie7updates\KB963027-IE7\msfeedsbs.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:23 27648 C:\WINDOWS\ie7updates\KB963027-IE7\jsproxy.dll
+ 2009-04-16 15:11:27 . 2008-12-19 09:10:15 13824 C:\WINDOWS\ie7updates\KB963027-IE7\ieudinit.exe
+ 2009-04-16 15:11:27 . 2008-12-20 23:15:21 44544 C:\WINDOWS\ie7updates\KB963027-IE7\iernonce.dll
+ 2009-04-16 15:11:28 . 2007-08-14 01:45:18 78336 C:\WINDOWS\ie7updates\KB963027-IE7\ieencode.dll
+ 2009-04-16 15:11:28 . 2008-12-19 09:10:15 70656 C:\WINDOWS\ie7updates\KB963027-IE7\ie4uinit.exe
+ 2009-04-16 15:11:28 . 2008-12-20 23:15:13 63488 C:\WINDOWS\ie7updates\KB963027-IE7\icardie.dll
+ 2004-12-07 17:11:34 . 2004-12-07 17:11:34 258352 C:\WINDOWS\system32\unicows.dll
+ 2004-08-11 22:00:30 . 2009-02-06 17:14:03 110592 C:\WINDOWS\system32\services.exe
+ 2008-02-08 20:53:46 . 2008-02-08 20:53:46 110592 C:\WINDOWS\system32\OnlineScannerLang.dll
+ 2008-02-11 16:39:18 . 2008-02-11 16:39:18 237568 C:\WINDOWS\system32\OnlineScannerDLLW.dll
+ 2008-02-11 16:39:26 . 2008-02-11 16:39:26 253952 C:\WINDOWS\system32\OnlineScannerDLLA.dll
+ 2004-08-11 22:00:25 . 2009-02-20 18:09:38 102912 C:\WINDOWS\system32\occache.dll
- 2004-08-11 22:00:25 . 2008-12-20 23:15:38 102912 C:\WINDOWS\system32\occache.dll
+ 2004-08-11 22:00:25 . 2009-02-09 10:20:33 714752 C:\WINDOWS\system32\ntdll.dll
- 2004-08-11 22:00:23 . 2008-12-20 23:15:32 671232 C:\WINDOWS\system32\mstime.dll
+ 2004-08-11 22:00:23 . 2009-02-20 18:09:38 671232 C:\WINDOWS\system32\mstime.dll
- 2004-08-11 22:00:23 . 2008-12-20 23:15:31 193024 C:\WINDOWS\system32\msrating.dll
+ 2004-08-11 22:00:23 . 2009-02-20 18:09:38 193024 C:\WINDOWS\system32\msrating.dll
+ 2004-08-11 22:00:21 . 2009-02-20 18:09:38 477696 C:\WINDOWS\system32\mshtmled.dll
- 2004-08-11 22:00:21 . 2008-12-20 23:15:30 477696 C:\WINDOWS\system32\mshtmled.dll
+ 2004-08-11 22:11:26 . 2008-06-12 14:16:46 161792 C:\WINDOWS\system32\msdtcuiu.dll
+ 2004-08-11 22:11:26 . 2008-06-12 14:16:46 956928 C:\WINDOWS\system32\msdtctm.dll
+ 2004-08-11 22:11:26 . 2008-06-12 14:16:46 428032 C:\WINDOWS\system32\msdtcprx.dll
+ 2004-08-11 22:00:18 . 2009-02-09 10:20:34 723456 C:\WINDOWS\system32\lsasrv.dll
+ 2005-12-05 19:37:10 . 2005-12-05 19:37:10 106496 C:\WINDOWS\system32\lnod32upd.dll
+ 2005-12-06 02:25:22 . 2005-12-06 02:25:22 139264 C:\WINDOWS\system32\lnod32umc.dll
+ 2007-07-27 21:49:02 . 2007-07-27 21:49:02 225355 C:\WINDOWS\system32\lnod32apiW.dll
+ 2007-07-27 21:49:02 . 2007-07-27 21:49:02 196683 C:\WINDOWS\system32\lnod32apiA.dll
+ 2004-08-11 22:00:18 . 2009-03-21 14:18:57 986112 C:\WINDOWS\system32\kernel32.dll
+ 2009-04-15 21:45:25 . 2009-04-15 21:43:30 148888 C:\WINDOWS\system32\javaws.exe
+ 2009-04-15 21:45:24 . 2009-04-15 21:43:30 144792 C:\WINDOWS\system32\javaw.exe
+ 2009-04-15 21:45:24 . 2009-04-15 21:43:30 144792 C:\WINDOWS\system32\java.exe
+ 2009-04-08 03:53:35 . 2009-04-16 14:43:02 223919 C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2004-08-11 22:00:16 . 2009-02-20 18:09:36 385024 C:\WINDOWS\system32\iedkcs32.dll
+ 2004-08-11 22:00:16 . 2009-02-20 05:14:12 161792 C:\WINDOWS\system32\ieakui.dll
- 2004-08-11 22:00:16 . 2008-12-19 05:23:56 161792 C:\WINDOWS\system32\ieakui.dll
+ 2004-08-11 22:00:16 . 2009-02-20 18:09:36 230400 C:\WINDOWS\system32\ieaksie.dll
- 2004-08-11 22:00:16 . 2008-12-20 23:15:14 230400 C:\WINDOWS\system32\ieaksie.dll
+ 2004-08-11 22:00:16 . 2009-02-20 18:09:36 153088 C:\WINDOWS\system32\ieakeng.dll
- 2004-08-11 22:00:16 . 2008-12-20 23:15:14 153088 C:\WINDOWS\system32\ieakeng.dll
+ 2004-08-11 22:00:14 . 2009-02-20 18:09:36 133120 C:\WINDOWS\system32\extmgr.dll
- 2004-08-11 22:00:14 . 2008-12-20 23:15:13 133120 C:\WINDOWS\system32\extmgr.dll
+ 2004-08-11 22:00:12 . 2009-02-20 18:09:36 214528 C:\WINDOWS\system32\dxtrans.dll
- 2004-08-11 22:00:12 . 2008-12-20 23:15:13 214528 C:\WINDOWS\system32\dxtrans.dll
+ 2004-08-11 22:00:12 . 2009-02-20 18:09:35 347136 C:\WINDOWS\system32\dxtmsft.dll
- 2004-08-11 22:00:12 . 2008-12-20 23:15:12 347136 C:\WINDOWS\system32\dxtmsft.dll
+ 2009-04-15 20:33:51 . 2009-02-06 16:39:29 227840 C:\WINDOWS\system32\dllcache\wmiprvse.exe
+ 2009-04-15 20:33:51 . 2009-02-09 10:20:32 453120 C:\WINDOWS\system32\dllcache\wmiprvsd.dll
- 2006-05-10 05:23:03 . 2008-12-20 23:15:41 826368 C:\WINDOWS\system32\dllcache\wininet.dll
+ 2006-05-10 05:23:03 . 2009-03-03 00:18:25 826368 C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-12-16 12:47:51 . 2008-12-16 12:47:51 351232 C:\WINDOWS\system32\dllcache\winhttp.dll
- 2007-08-14 01:54:10 . 2008-12-20 23:15:40 233472 C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2007-08-14 01:54:10 . 2009-02-20 18:09:38 233472 C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2007-08-14 01:44:30 . 2009-02-20 18:09:38 105984 C:\WINDOWS\system32\dllcache\url.dll
- 2007-08-14 01:44:30 . 2008-12-20 23:15:39 105984 C:\WINDOWS\system32\dllcache\url.dll
+ 2009-04-15 20:33:53 . 2009-02-06 17:14:03 110592 C:\WINDOWS\system32\dllcache\services.exe
+ 2009-04-15 20:33:53 . 2009-02-09 10:20:34 399360 C:\WINDOWS\system32\dllcache\rpcss.dll
+ 2009-04-15 20:33:55 . 2009-03-06 14:44:35 283648 C:\WINDOWS\system32\dllcache\pdh.dll
- 2007-08-14 01:44:06 . 2008-12-20 23:15:38 102912 C:\WINDOWS\system32\dllcache\occache.dll
+ 2007-08-14 01:44:06 . 2009-02-20 18:09:38 102912 C:\WINDOWS\system32\dllcache\occache.dll
+ 2009-04-15 20:33:47 . 2009-02-09 10:20:33 714752 C:\WINDOWS\system32\dllcache\ntdll.dll
- 2006-05-10 05:23:01 . 2008-12-20 23:15:32 671232 C:\WINDOWS\system32\dllcache\mstime.dll
+ 2006-05-10 05:23:01 . 2009-02-20 18:09:38 671232 C:\WINDOWS\system32\dllcache\mstime.dll
+ 2006-05-10 05:23:01 . 2009-02-20 18:09:38 193024 C:\WINDOWS\system32\dllcache\msrating.dll
- 2006-05-10 05:23:01 . 2008-12-20 23:15:31 193024 C:\WINDOWS\system32\dllcache\msrating.dll
- 2006-05-10 05:23:01 . 2008-12-20 23:15:30 477696 C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2006-05-10 05:23:01 . 2009-02-20 18:09:38 477696 C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-09-10 13:40:22 . 2008-12-20 23:15:23 459264 C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-09-10 13:40:22 . 2009-02-20 18:09:37 459264 C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-06-12 14:16:46 . 2008-06-12 14:16:46 161792 C:\WINDOWS\system32\dllcache\msdtcuiu.dll
+ 2008-06-12 14:16:46 . 2008-06-12 14:16:46 956928 C:\WINDOWS\system32\dllcache\msdtctm.dll
+ 2008-06-12 14:16:46 . 2008-06-12 14:16:46 428032 C:\WINDOWS\system32\dllcache\msdtcprx.dll
+ 2006-08-17 12:28:27 . 2009-02-09 10:20:34 723456 C:\WINDOWS\system32\dllcache\lsasrv.dll
+ 2006-07-05 10:55:01 . 2009-03-21 14:18:57 986112 C:\WINDOWS\system32\dllcache\kernel32.dll
+ 2004-08-11 22:12:49 . 2009-02-28 04:54:41 636072 C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-09-10 13:40:21 . 2009-02-20 18:09:37 268288 C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2007-08-14 01:39:50 . 2009-02-20 18:09:36 385024 C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-09-10 13:40:18 . 2009-02-20 18:09:36 383488 C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2008-09-10 13:40:18 . 2008-12-20 23:15:15 383488 C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2007-08-14 00:56:54 . 2008-12-19 05:23:56 161792 C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2007-08-14 00:56:54 . 2009-02-20 05:14:12 161792 C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2007-08-14 01:39:54 . 2009-02-20 18:09:36 230400 C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-08-14 01:39:54 . 2008-12-20 23:15:14 230400 C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-08-14 01:39:26 . 2008-12-20 23:15:14 153088 C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2007-08-14 01:39:26 . 2009-02-20 18:09:36 153088 C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2009-04-15 20:33:52 . 2009-02-09 10:20:33 473088 C:\WINDOWS\system32\dllcache\fastprox.dll
+ 2006-05-10 05:22:59 . 2009-02-20 18:09:36 133120 C:\WINDOWS\system32\dllcache\extmgr.dll
- 2006-05-10 05:22:59 . 2008-12-20 23:15:13 133120 C:\WINDOWS\system32\dllcache\extmgr.dll
- 2006-05-10 05:22:59 . 2008-12-20 23:15:13 214528 C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2006-05-10 05:22:59 . 2009-02-20 18:09:36 214528 C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2006-05-10 05:22:59 . 2009-02-20 18:09:35 347136 C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2006-05-10 05:22:59 . 2008-12-20 23:15:12 347136 C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2007-08-14 01:39:00 . 2009-02-20 18:09:35 124928 C:\WINDOWS\system32\dllcache\advpack.dll
- 2007-08-14 01:39:00 . 2008-12-20 23:15:11 124928 C:\WINDOWS\system32\dllcache\advpack.dll
+ 2009-04-15 20:33:49 . 2009-02-09 10:20:33 616960 C:\WINDOWS\system32\dllcache\advapi32.dll
+ 2009-04-15 21:45:25 . 2009-04-15 21:43:29 410984 C:\WINDOWS\system32\deploytk.dll
- 2004-08-11 22:00:00 . 2004-08-04 10:00:00 616960 C:\WINDOWS\system32\advapi32.dll
+ 2004-08-11 22:00:00 . 2009-02-09 10:20:33 616960 C:\WINDOWS\system32\advapi32.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:41 826368 C:\WINDOWS\ie7updates\KB963027-IE7\wininet.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:40 233472 C:\WINDOWS\ie7updates\KB963027-IE7\webcheck.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:39 105984 C:\WINDOWS\ie7updates\KB963027-IE7\url.dll
+ 2009-04-16 15:11:32 . 2008-07-09 07:38:37 382840 C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\updspapi.dll
+ 2009-04-16 15:11:33 . 2008-07-08 13:02:02 231288 C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:38 102912 C:\WINDOWS\ie7updates\KB963027-IE7\occache.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:32 671232 C:\WINDOWS\ie7updates\KB963027-IE7\mstime.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:31 193024 C:\WINDOWS\ie7updates\KB963027-IE7\msrating.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:30 477696 C:\WINDOWS\ie7updates\KB963027-IE7\mshtmled.dll
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:23 459264 C:\WINDOWS\ie7updates\KB963027-IE7\msfeeds.dll
+ 2009-04-16 15:11:28 . 2008-12-19 05:25:25 634024 C:\WINDOWS\ie7updates\KB963027-IE7\iexplore.exe
+ 2009-04-16 15:11:27 . 2008-12-20 23:15:22 267776 C:\WINDOWS\ie7updates\KB963027-IE7\iertutil.dll
+ 2009-04-16 15:11:27 . 2008-12-20 23:15:16 384512 C:\WINDOWS\ie7updates\KB963027-IE7\iedkcs32.dll
+ 2009-04-16 15:11:27 . 2008-12-20 23:15:15 383488 C:\WINDOWS\ie7updates\KB963027-IE7\ieapfltr.dll
+ 2009-04-16 15:11:28 . 2008-12-19 05:23:56 161792 C:\WINDOWS\ie7updates\KB963027-IE7\ieakui.dll
+ 2009-04-16 15:11:28 . 2008-12-20 23:15:14 230400 C:\WINDOWS\ie7updates\KB963027-IE7\ieaksie.dll
+ 2009-04-16 15:11:28 . 2008-12-20 23:15:14 153088 C:\WINDOWS\ie7updates\KB963027-IE7\ieakeng.dll
+ 2009-04-16 15:11:28 . 2008-12-20 23:15:13 133120 C:\WINDOWS\ie7updates\KB963027-IE7\extmgr.dll
+ 2009-04-16 15:11:28 . 2008-12-20 23:15:13 214528 C:\WINDOWS\ie7updates\KB963027-IE7\dxtrans.dll
+ 2009-04-16 15:11:28 . 2008-12-20 23:15:12 347136 C:\WINDOWS\ie7updates\KB963027-IE7\dxtmsft.dll
+ 2009-04-16 15:11:28 . 2008-12-20 23:15:11 124928 C:\WINDOWS\ie7updates\KB963027-IE7\advpack.dll
+ 2009-04-15 22:02:55 . 2005-10-21 03:02:28 163328 C:\WINDOWS\ERDNT\subs\ERDNT.EXE
- 2009-04-15 20:27:43 . 2005-10-21 03:02:28 163328 C:\WINDOWS\ERDNT\subs\ERDNT.EXE
- 2004-08-11 22:00:29 . 2008-05-07 05:18:48 1287680 C:\WINDOWS\system32\quartz.dll
+ 2004-08-11 22:00:29 . 2008-12-20 22:43:25 1287680 C:\WINDOWS\system32\quartz.dll
+ 2004-08-11 22:00:25 . 2009-02-06 17:24:35 2180480 C:\WINDOWS\system32\ntoskrnl.exe
- 2004-08-04 03:59:00 . 2008-08-14 09:22:13 2057728 C:\WINDOWS\system32\ntkrnlpa.exe
+ 2004-08-04 03:59:00 . 2009-02-06 16:49:02 2057728 C:\WINDOWS\system32\ntkrnlpa.exe
- 2006-05-10 05:23:02 . 2008-12-20 23:15:40 1160192 C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2006-05-10 05:23:02 . 2009-02-20 18:09:38 1160192 C:\WINDOWS\system32\dllcache\urlmon.dll
- 2007-10-29 22:43:03 . 2008-05-07 05:18:48 1287680 C:\WINDOWS\system32\dllcache\quartz.dll
+ 2007-10-29 22:43:03 . 2008-12-20 22:43:25 1287680 C:\WINDOWS\system32\dllcache\quartz.dll
+ 2006-12-19 14:17:19 . 2009-02-06 17:24:35 2180480 C:\WINDOWS\system32\dllcache\ntoskrnl.exe
- 2006-12-19 12:55:40 . 2008-08-14 09:22:14 2015744 C:\WINDOWS\system32\dllcache\ntkrpamp.exe
+ 2006-12-19 12:55:40 . 2009-02-06 16:49:02 2015744 C:\WINDOWS\system32\dllcache\ntkrpamp.exe
+ 2006-12-19 12:55:39 . 2009-02-06 16:49:02 2057728 C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
- 2006-12-19 12:55:39 . 2008-08-14 09:22:13 2057728 C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
- 2006-12-19 14:15:09 . 2008-08-14 09:58:27 2136064 C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
+ 2006-12-19 14:15:09 . 2009-02-06 17:22:17 2136064 C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
+ 2006-05-19 15:08:32 . 2009-02-20 18:09:37 3595264 C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-09-10 13:40:08 . 2009-02-20 18:09:36 6066176 C:\WINDOWS\system32\dllcache\ieframe.dll
- 2008-09-10 13:40:15 . 2007-04-17 09:32:38 2455488 C:\WINDOWS\system32\dllcache\ieapfltr.dat
+ 2008-09-10 13:40:15 . 2008-07-09 14:25:57 2455488 C:\WINDOWS\system32\dllcache\ieapfltr.dat
+ 2009-04-16 15:11:26 . 2008-12-20 23:15:40 1160192 C:\WINDOWS\ie7updates\KB963027-IE7\urlmon.dll
+ 2009-04-16 15:11:26 . 2009-01-17 05:35:14 3594752 C:\WINDOWS\ie7updates\KB963027-IE7\mshtml.dll
+ 2009-04-16 15:11:27 . 2008-12-20 23:15:21 6066688 C:\WINDOWS\ie7updates\KB963027-IE7\ieframe.dll
+ 2009-04-16 15:11:27 . 2007-04-17 09:32:38 2455488 C:\WINDOWS\ie7updates\KB963027-IE7\ieapfltr.dat
+ 2005-03-02 00:59:53 . 2009-02-06 17:24:35 2180480 C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
- 2005-03-02 00:34:42 . 2008-08-14 09:22:14 2015744 C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
+ 2005-03-02 00:34:42 . 2009-02-06 16:49:02 2015744 C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
- 2005-03-02 00:34:40 . 2008-08-14 09:22:13 2057728 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
+ 2005-03-02 00:34:40 . 2009-02-06 16:49:02 2057728 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
- 2005-03-02 00:57:44 . 2008-08-14 09:58:27 2136064 C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
+ 2005-03-02 00:57:44 . 2009-02-06 17:22:17 2136064 C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
+ 2005-12-06 01:33:20 . 2009-04-06 14:57:24 24921544 C:\WINDOWS\system32\MRT.exe
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:00:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [X]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X]
"PRONoMgrWired"="C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2004-12-09 18:58:46 86016]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 16:26:08 606208]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 06:05:00 127035]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 21:50:42 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 00:15:20 81920]
"monitr32"="C:\Program Files\Canon\MultiPASS4\monitr32.exe" [2001-08-22 01:52:34 311296]
"MPTBox"="C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE" [2001-08-22 01:52:12 151552]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 21:02:14 53408]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-03-17 14:34:30 124656]
"PPort11reminder"="C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 21:46:58 255528]
"BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-05 20:00:08 630784]
"ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [2006-11-08 03:03:24 65536]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-26 00:37:32 2178832]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 17:36:40 267048]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-13 15:23:56 98304]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-14 05:35:50 536576]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-30 05:12:14 30248]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-26 00:33:22 563984]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49:46 94208]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50:30 114688]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46:34 77824]
"fxredir"="C:\WINDOWS\system32\fxredir.exe" [2001-08-22 01:49:14 65536]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 21:19:56 53248]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-04-15 21:43:37 148888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - C:\WINDOWS\KHALMNPR.Exe [2007-01-23 23:44:00 101136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 23:38:52 39264]

C:\Documents and Settings\Marcia Gordon\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2006-1-14 233472]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-20 24576]
Google Calendar Sync.lnk - C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-2 546288]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-25 688128]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-22 972064]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk
backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Marcia Gordon^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\Marcia Gordon\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-09-07 08:26:09 29744 —-a-w C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-01-30 05:10:12 46632 —-a-w C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 13:50:48 53248 —-a-w C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-09-14 13:50:48 131072 —-a-w C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-03-29 06:37:20 413696 —-a-w C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07:20 2260480 –sha-r C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03:38 210472 —-a-w C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinVNC4"=2 (0x2)
"AOL ACS"=2 (0x2)
"GoogleDesktopManager-061008-081103"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R2 spupdsvc;Windows Service Pack Installer update service;C:\WINDOWS\system32\spupdsvc.exe [2008-07-09 07:38:27 26488]
R3 getPlus® Helper;getPlus® Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 19:01:02 33752]
R3 SavRoam;SavRoam;C:\Program Files\Symantec AntiVirus\SavRoam.exe [2006-03-17 14:34:24 115952]
R4 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-07 08:26:09 29744]
S2 WinDefend;Windows Defender;C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-04 02:19:58 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-06 09:00:00 101936]

.
Contents of the 'Scheduled Tasks' folder

2009-03-31 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 21:57:52 . 2008-07-30 19:34:12]

2009-04-03 C:\WINDOWS\Tasks\BACKUP NOW FRIDAY MESSAGE.job
- C:\BACKUPNOWFRIDAYMESSAGE.doc [2005-10-29 21:25:22 . 2005-10-29 21:25:22]

2006-03-02 C:\WINDOWS\Tasks\FRU Task 2003-04-06 08:52:06ewlett-Packard2003-04-06 08:52:06p officejet 6100 series5E771253C1676EBED677BF361FDFC537825E15B8133157349.job
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 08:52:08 . 2003-04-06 08:52:08]

2009-04-16 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20:06 . 2006-11-04 02:20:06]

2009-04-03 C:\WINDOWS\Tasks\My Documents Changed Files MG.job
- C:\Program Files\Stomp\Backup MyPC\System\bestart.exe [2002-11-04 11:09:00 . 2002-11-04 11:09:00]

2009-04-13 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe [2004-05-12 09:03:00 . 2008-07-30 21:45:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://dsl.sbc.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport; to Microsoft Excel - C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - C:\Documents and Settings\Marcia Gordon\Application Data\Mozilla\Firefox\Profiles\r4mp8c96.default\
FF - prefs.js: browser.startup.homepage - hxxp://dsl.sbc.yahoo.com/
FF - component: C:\Program Files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-16 08:28:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-16 8:31:43

Sets=
451

HJT —————————————————————————————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:08:31 AM, on 4/16/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Spyware Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Canon\MultiPASS4\monitr32.exe
C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\fxredir.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://v4.windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [monitr32] C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - HKLM\..\Run: [MPTBox] C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [fxredir] C:\WINDOWS\system32\fxredir.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2005\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Spyware Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MpService - Canon Inc - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

–
End of file - 12067 bytes

Sorry for the delay. I have been trying to take the steps you requested but ran into some issues and have documented them here.

I ran GMER and the log is below. A couple of other things to know.

1. I received no message to say Gmer was done running. It just stopped scrolling through files/paths.
2. At the end, though the program still seemed to be operational (can select menu options etc.), on the task bar, windows has (Not Responding) next to it.
3. When I typed "net stop gmer" at the command prompt, I received the following message:
System error 1060 has occurred.
The specified service does not exist as an installed service.
4. Randomly I have gotten a windows message pop up that reads as follows.
The blue bar at the top just says "Error" but doesn't indicate any program that this is associated with.
The email address you'll see below is my wife's this is her machine.
"Username and password do not match. You provided [removed]. Please enter your full email address (including @domain.com)"

5. When I dropped the CFScript file onto the ComboFix I received the following error
The blue bar read: Error - Win32 only
Incompatible OS. ComboFix only works for workstations with Windows 2000 or XP.

It had a button to click OK. Before I clicked it, ComboFix started and asked if I wanted to update. I closed the error box, then said yes to update.

6. Combofix then appeared to successfully download and start running.

7. As Combofix displayed "Attempting to create a new system restore point, I received the windows error "PV.cfexe has encountered a problem and needs to close."
8. I clicked the "Don't Send" box and the error disappeared.
9. Combofix then appeared to run through the check as it had before; however, after 1 minute the same error appeared. In the Combofix window the last thing on the screen read "Scanning for infected files."
I again clicked "Don't send"
10. Combofix appeared to finish running and closed on it's own. Notepad opened on its own but gave an error that it could not find "C:\docume~1….temp\log.txt file
and asked if I wanted to create one. I said yes. Notepad then opened.
11. At that point there was a Notepad window open and my desktop background was present, but I had no desktop icons andthe taskbar/start bar was gone.
12. Ctrl-Alt-Del brought up task manager.
13. CPU usage = 100%. TeaTimer.exe was using 90-99% of it.
14. After about 2 minutes, TeaTimer.exe dropped to 0% but nothing changed on the desktop. I was forced to re-boot from the task manager drop down.
15. I have just rebooted and have now copied the most recent ComboFix.txt at the bottom.

Oh my goodness!

GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-04-16 13:07:50
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.15 —-

SSDT 83215008 ZwAlertResumeThread
SSDT 8312ED00 ZwAlertThread
SSDT 830560A8 ZwAllocateVirtualMemory
SSDT 830CA9C0 ZwConnectPort
SSDT 831A3008 ZwCreateMutant
SSDT 832166B8 ZwCreateThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xAA759CB0]
SSDT 83118CE0 ZwFreeVirtualMemory
SSDT 832AFEA0 ZwImpersonateAnonymousToken
SSDT 832B62C8 ZwImpersonateThread
SSDT 83126480 ZwMapViewOfSection
SSDT 830C74E8 ZwOpenEvent
SSDT \??\C:\Program Files\Spyware Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess [0xF8F908AC]
SSDT 83118E58 ZwOpenProcessToken
SSDT 831184A8 ZwOpenThreadToken
SSDT 83113CA0 ZwQueryValueKey
SSDT 831197D8 ZwResumeThread
SSDT 82FDC438 ZwSetContextThread
SSDT 83118628 ZwSetInformationProcess
SSDT 8311E820 ZwSetInformationThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xAA759F10]
SSDT 830988A8 ZwSuspendProcess
SSDT 832C0E58 ZwSuspendThread
SSDT \??\C:\Program Files\Spyware Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess [0xF8F90812]
SSDT 83388DE8 ZwTerminateThread
SSDT 83118938 ZwUnmapViewOfSection
SSDT 83255008 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!_abnormal_termination + 214 804E2870 4 Bytes CALL 83D134E9
.text ntoskrnl.exe!_abnormal_termination + 3A0 804E29FC 1 Byte [38]

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Program Files\iTunes\iTunesHelper.exe[1076] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003C2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\iTunes\iTunesHelper.exe[1076] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003C2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\iTunes\iTunesHelper.exe[1076] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003C2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\iTunes\iTunesHelper.exe[1076] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003C2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE[1360] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00B92F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE[1360] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00B92CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE[1360] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00B92D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\PROGRA~1\Canon\MULTIP~1\MPTBOX.EXE[1360] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00B92CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Brother\ControlCenter3\brccMCtl.exe[1616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00A82F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Brother\ControlCenter3\brccMCtl.exe[1616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00A82CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Brother\ControlCenter3\brccMCtl.exe[1616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00A82D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Brother\ControlCenter3\brccMCtl.exe[1616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00A82CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1932] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00922F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1932] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00922CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1932] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00922D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1932] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00922CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[2008] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [005A2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[2008] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [005A2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[2008] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [005A2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[2008] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [005A2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00BE2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00BE2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00BE2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00BE2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2396] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00972F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2396] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00972CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2396] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00972D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2396] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00972CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\igfxpers.exe[2708] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00E02F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\igfxpers.exe[2708] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00E02CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\igfxpers.exe[2708] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00E02D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\igfxpers.exe[2708] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00E02CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\hkcmd.exe[2816] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00992F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\hkcmd.exe[2816] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00992CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\hkcmd.exe[2816] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00992D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\hkcmd.exe[2816] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00992CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\fxredir.exe[2896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01262F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\fxredir.exe[2896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01262CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\fxredir.exe[2896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [01262D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\fxredir.exe[2896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01262CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2916] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00A12F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2916] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00A12CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2916] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00A12D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2916] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00A12CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe[3076] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003D2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe[3076] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003D2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe[3076] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003D2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe[3076] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003D2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Digital Line Detect\DLG.exe[3120] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00A72F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Digital Line Detect\DLG.exe[3120] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00A72CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Digital Line Detect\DLG.exe[3120] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00A72D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Digital Line Detect\DLG.exe[3120] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00A72CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\igfxsrvc.exe[3136] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00F12F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\igfxsrvc.exe[3136] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00F12CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\igfxsrvc.exe[3136] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00F12D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\igfxsrvc.exe[3136] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00F12CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\ctfmon.exe[3240] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [009C2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\ctfmon.exe[3240] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [009C2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\ctfmon.exe[3240] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [009C2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\ctfmon.exe[3240] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [009C2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe[3336] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00892F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe[3336] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00892CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe[3336] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00892D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe[3336] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00892CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\WLTRAY.exe[3340] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00AB2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\WLTRAY.exe[3340] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00AB2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\WLTRAY.exe[3340] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00AB2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\WLTRAY.exe[3340] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00AB2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Dell\QuickSet\quickset.exe[3356] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00D02F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Dell\QuickSet\quickset.exe[3356] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00D02CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Dell\QuickSet\quickset.exe[3356] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00D02D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Dell\QuickSet\quickset.exe[3356] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00D02CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\dla\tfswctrl.exe[3472] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00A22F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\dla\tfswctrl.exe[3472] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00A22CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\dla\tfswctrl.exe[3472] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00A22D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\dla\tfswctrl.exe[3472] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00A22CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[3528] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [009B2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[3528] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [009B2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[3528] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [009B2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[3528] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [009B2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\SetPoint\SetPoint.exe[3552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00B62F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\SetPoint\SetPoint.exe[3552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00B62CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\SetPoint\SetPoint.exe[3552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00B62D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\SetPoint\SetPoint.exe[3552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00B62CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[3612] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00E72F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[3612] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00E72CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[3612] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00E72D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[3612] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00E72CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Canon\MultiPASS4\monitr32.exe[3684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00E82F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Canon\MultiPASS4\monitr32.exe[3684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00E82CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Canon\MultiPASS4\monitr32.exe[3684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00E82D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Canon\MultiPASS4\monitr32.exe[3684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00E82CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe[3748] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [009B2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe[3748] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [009B2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe[3748] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [009B2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe[3748] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [009B2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3904] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00A82F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3904] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00A82CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3904] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00A82D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3904] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00A82CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3980] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00EA2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3980] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00EA2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3980] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00EA2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe[3980] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00EA2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[4648] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [004E2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[4648] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [004E2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[4648] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [004E2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[4648] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [004E2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[4792] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003C2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[4792] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003C2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[4792] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003C2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[4792] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003C2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE[4812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00F22F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE[4812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00F22CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE[4812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00F22D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE[4812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00F22CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Documents and Settings\Marcia Gordon\Desktop\gmer\gmer.exe[5432] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00802F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Documents and Settings\Marcia Gordon\Desktop\gmer\gmer.exe[5432] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00802CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Documents and Settings\Marcia Gordon\Desktop\gmer\gmer.exe[5432] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00802D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Documents and Settings\Marcia Gordon\Desktop\gmer\gmer.exe[5432] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00802CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \FileSystem\Fastfat \Fat A868EC8A

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000

—- EOF - GMER 1.0.15 —-



ComboFix 09-04-17.01 - Marcia Gordon 04/16/2009 13:50.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.150 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Marcia Gordon\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\REN3B.tmp
c:\windows\system32\REN3C.tmp
c:\windows\system32\SET114.tmp
c:\windows\system32\SET5F.tmp
c:\windows\system32\SETA4.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\REN3B.tmp
c:\windows\system32\REN3C.tmp

.
((((((((((((((((((((((((( Files Created from 2009-03-17 to 2009-04-17 )))))))))))))))))))))))))))))))
.

2009-04-15 21:45 . 2009-04-15 21:43 73728 —-a-w c:\windows\system32\javacpl.cpl
2009-04-15 21:45 . 2009-04-15 21:43 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-15 20:33 . 2009-03-06 14:44 283648 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 20:33 . 2009-02-06 16:54 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 20:33 . 2005-07-26 04:39 60416 ——w c:\windows\system32\dllcache\colbact.dll
2009-04-15 20:33 . 2009-02-09 10:20 399360 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 20:33 . 2009-02-06 17:14 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 20:33 . 2009-02-09 10:20 473088 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 20:33 . 2009-02-09 10:20 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 20:33 . 2009-02-06 16:39 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 20:33 . 2009-02-09 10:20 616960 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 20:33 . 2009-02-09 10:20 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-09 05:42 . 2009-04-09 05:42 54584 —-a-w c:\documents and settings\harold\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-08 04:16 . 2009-04-08 20:29 ——– d—–w c:\documents and settings\All Users\Application Data\Adobe(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-16 20:38 . 2006-11-08 00:59 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-16 20:09 . 2009-02-02 05:07 ——– d—–w c:\documents and settings\Marcia Gordon\Application Data\gSyncit
2009-04-16 05:04 . 2009-04-16 03:13 ——– d—–w c:\program files\EsetOnlineScanner
2009-04-15 21:43 . 2005-10-21 01:47 ——– d—–w c:\program files\Java
2009-04-14 03:14 . 2008-09-14 16:22 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 04:14 . 2005-11-13 04:43 ——– d—–w c:\program files\Common Files\Adobe
2009-04-08 03:54 . 2009-04-08 20:23 259340 —-a-w c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-04-08 02:14 . 2009-03-04 05:11 ——– d—–w c:\documents and settings\All Users\Application Data\NOS
2009-04-06 22:32 . 2008-09-14 16:22 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 22:32 . 2008-09-14 16:22 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-01 11:21 . 2005-12-06 17:08 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-21 14:18 . 2006-07-05 10:55 986112 ——w c:\windows\system32\dllcache\kernel32.dll
2009-03-16 15:20 . 2008-05-02 22:21 ——– d—–w c:\program files\Apple Software Update
2009-03-06 14:44 . 2004-08-11 22:00 283648 —-a-w c:\windows\system32\pdh.dll
2009-03-04 05:20 . 2009-03-04 05:20 ——– d—–w c:\program files\Common Files\Adobe AIR
2009-03-04 05:11 . 2009-03-04 05:11 ——– d—–w c:\program files\NOS
2009-03-03 00:18 . 2006-05-10 05:23 826368 ——w c:\windows\system32\dllcache\wininet.dll
2009-03-03 00:18 . 2004-08-11 22:00 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-28 04:54 . 2004-08-11 22:12 636072 ——w c:\windows\system32\dllcache\iexplore.exe
2009-02-20 10:20 . 2008-09-10 13:40 13824 ——w c:\windows\system32\dllcache\ieudinit.exe
2009-02-20 10:20 . 2007-08-14 01:39 70656 ——w c:\windows\system32\dllcache\ie4uinit.exe
2009-02-20 05:14 . 2007-08-14 00:56 161792 ——w c:\windows\system32\dllcache\ieakui.dll
2009-02-19 01:34 . 2008-04-01 02:37 ——– d—–w c:\documents and settings\Marcia Gordon\Application Data\U3
2009-02-09 10:20 . 2006-08-17 12:28 723456 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-02-09 10:20 . 2004-08-11 22:00 399360 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 10:20 . 2004-08-11 22:00 723456 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:20 . 2004-08-11 22:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 10:20 . 2004-08-11 22:00 616960 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 10:19 . 2007-03-08 13:47 1846272 ——w c:\windows\system32\dllcache\win32k.sys
2009-02-09 10:19 . 2004-08-11 22:00 1846272 —-a-w c:\windows\system32\win32k.sys
2009-02-06 17:24 . 2006-12-19 14:17 2180480 ——w c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-06 17:24 . 2004-08-11 22:00 2180480 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 17:22 . 2006-12-19 14:15 2136064 ——w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-06 17:14 . 2004-08-11 22:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 16:54 . 2004-08-11 22:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 16:49 . 2006-12-19 12:55 2015744 ——w c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-06 16:49 . 2006-12-19 12:55 2057728 ——w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-06 16:49 . 2004-08-04 03:59 2057728 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 20:08 . 2009-02-03 20:08 55808 ——w c:\windows\system32\dllcache\secur32.dll
2009-02-03 20:08 . 2004-08-11 22:00 55808 —-a-w c:\windows\system32\secur32.dll
2008-12-30 01:27 . 2005-11-17 04:59 54584 —-a-w c:\documents and settings\Marcia Gordon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-01-14 00:33 . 2008-01-14 00:33 32 —-a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2006-12-12 01:38 . 2006-12-12 01:38 56912 —-a-w c:\documents and settings\Marcia Gordon\g2mdlhlpx.exe
2006-01-04 20:01 . 2006-01-04 20:01 563712 —-a-w c:\documents and settings\Marcia Gordon\370_gotomypc.exe
2005-11-15 05:00 . 2005-11-15 05:00 483401 —-a-w c:\documents and settings\Marcia Gordon\314_gotomypc.exe
2005-11-15 04:55 . 2005-11-15 04:55 136 —-a-w c:\documents and settings\Marcia Gordon\Local Settings\Application Data\fusioncache.dat
2003-04-22 22:21 . 2003-04-22 22:21 38737 —-a-w c:\program files\mccm.exe
2003-01-18 11:33 . 2003-01-18 11:33 38912 —-a-w c:\program files\foxtools.fll
2002-10-03 21:23 . 2002-10-03 21:23 47 —-a-w c:\program files\Dydacomp.url
2002-08-21 20:57 . 2002-08-21 20:57 412029 —-a-w c:\program files\UPSMAXI.zip
2002-07-31 16:51 . 2002-07-31 16:51 2596 —-a-w c:\program files\UPSMAXI.lib
2002-07-31 16:51 . 2002-07-31 16:51 24576 —-a-w c:\program files\UPSMAXI.dll
2002-07-31 16:51 . 2002-07-31 16:51 1012 —-a-w c:\program files\UPSMAXI.exp
2002-01-11 17:43 . 2002-01-11 17:43 128 —-a-w c:\program files\decompress.dat
2002-01-11 17:42 . 2002-01-11 17:42 101 —-a-w c:\program files\compress.dat
2000-12-15 00:50 . 2000-12-15 00:50 5360 —-a-w c:\program files\decompress.lib
2000-12-15 00:48 . 2000-12-15 00:48 5844 —-a-w c:\program files\compress.lib
2000-12-12 01:17 . 2000-12-12 01:17 163912 —-a-w c:\program files\DecompressTest.exe
2000-12-11 18:43 . 2000-12-11 18:43 50049 —-a-w c:\program files\COMPIFC.H
2000-08-31 20:12 . 2000-08-31 20:12 6570 —-a-w c:\program files\COMPRESS.H
2000-08-31 20:12 . 2000-08-31 20:12 821328 —-a-w c:\program files\POSTAL.DAT
2000-08-31 20:12 . 2000-08-31 20:12 28672 —-a-w c:\program files\ETBL.BIN
2000-08-31 20:12 . 2000-08-31 20:12 28672 —-a-w c:\program files\DTBL.BIN
2008-09-07 08:2006-10-20 17:04 26:10 . c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-04-16_15.28.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-16 15:45 . 2009-04-16 15:45 16384 c:\windows\temp\Perflib_Perfdata_10c.dat
- 2004-08-11 22:00 . 2009-03-09 19:10 81088 c:\windows\system32\perfc009.dat
+ 2004-08-11 22:00 . 2009-04-16 15:50 81088 c:\windows\system32\perfc009.dat
+ 2004-08-11 22:00 . 2008-06-12 14:16 66560 c:\windows\system32\mtxclu.dll
- 2004-08-11 22:00 . 2006-03-01 19:42 66560 c:\windows\system32\mtxclu.dll
- 2007-08-14 01:54 . 2008-12-20 23:15 52224 c:\windows\system32\msfeedsbs.dll
+ 2007-08-14 01:54 . 2009-02-20 18:09 52224 c:\windows\system32\msfeedsbs.dll
- 2007-08-14 01:36 . 2008-12-20 23:15 63488 c:\windows\system32\icardie.dll
+ 2007-08-14 01:36 . 2009-02-20 18:09 63488 c:\windows\system32\icardie.dll
- 2004-08-11 22:00 . 2004-08-04 10:00 351232 c:\windows\system32\winhttp.dll
+ 2004-08-11 22:00 . 2008-12-16 12:47 351232 c:\windows\system32\winhttp.dll
+ 2004-08-11 22:00 . 2009-02-20 18:09 233472 c:\windows\system32\webcheck.dll
- 2004-08-11 22:00 . 2008-12-20 23:15 233472 c:\windows\system32\webcheck.dll
+ 2004-08-11 22:11 . 2009-02-06 16:39 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2004-08-11 22:11 . 2009-02-09 10:20 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2004-08-11 22:11 . 2009-02-09 10:20 473088 c:\windows\system32\wbem\fastprox.dll
+ 2004-08-11 22:00 . 2009-02-20 18:09 105984 c:\windows\system32\url.dll
- 2004-08-11 22:00 . 2008-12-20 23:15 105984 c:\windows\system32\url.dll
+ 2004-08-11 22:00 . 2009-04-16 15:50 454594 c:\windows\system32\perfh009.dat
- 2004-08-11 22:00 . 2009-03-09 19:10 454594 c:\windows\system32\perfh009.dat
+ 2007-08-14 01:54 . 2009-02-20 18:09 459264 c:\windows\system32\msfeeds.dll
- 2007-08-14 01:54 . 2008-12-20 23:15 459264 c:\windows\system32\msfeeds.dll
+ 2009-04-08 03:53 . 2009-04-16 15:47 223918 c:\windows\system32\inetsrv\MetaBase.bin
+ 2007-08-14 01:34 . 2009-02-20 18:09 268288 c:\windows\system32\iertutil.dll
- 2007-07-11 19:27 . 2008-12-20 23:15 383488 c:\windows\system32\ieapfltr.dll
+ 2007-07-11 19:27 . 2009-02-20 18:09 383488 c:\windows\system32\ieapfltr.dll
+ 2004-08-11 22:00 . 2009-02-20 18:09 124928 c:\windows\system32\advpack.dll
- 2004-08-11 22:00 . 2008-12-20 23:15 124928 c:\windows\system32\advpack.dll
- 2004-08-11 22:00 . 2008-12-20 23:15 1160192 c:\windows\system32\urlmon.dll
+ 2004-08-11 22:00 . 2009-02-20 18:09 1160192 c:\windows\system32\urlmon.dll
+ 2004-08-11 22:00 . 2009-02-20 18:09 3595264 c:\windows\system32\mshtml.dll
+ 2007-08-14 01:54 . 2009-02-20 18:09 6066176 c:\windows\system32\ieframe.dll
+ 2007-02-12 23:10 . 2008-07-09 14:25 2455488 c:\windows\system32\ieapfltr.dat
- 2007-02-12 23:10 . 2007-04-17 09:32 2455488 c:\windows\system32\ieapfltr.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"PRONoMgrWired"="c:\program files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2004-12-09 86016]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"monitr32"="c:\program files\Canon\MultiPASS4\monitr32.exe" [2001-08-22 311296]
"MPTBox"="c:\progra~1\Canon\MULTIP~1\MPTBOX.EXE" [2001-08-22 151552]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-03-17 124656]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-05 630784]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-11-08 65536]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-26 2178832]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-13 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-14 536576]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-30 30248]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-26 563984]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"fxredir"="c:\windows\system32\fxredir.exe" [2001-08-22 65536]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-15 148888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-01-23 101136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Marcia Gordon\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2006-1-14 233472]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-10-20 24576]
Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-2 546288]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-12-25 688128]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-22 972064]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk
backup=c:\windows\pss\officejet 6100.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Marcia Gordon^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\Marcia Gordon\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-09-07 08:26 29744 —-a-w c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-01-30 05:10 46632 —-a-w c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 13:50 53248 —-a-w c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-09-14 13:50 131072 —-a-w c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-03-29 06:37 413696 —-a-w c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07 2260480 –sha-r c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03 210472 —-a-w c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinVNC4"=2 (0x2)
"AOL ACS"=2 (0x2)
"GoogleDesktopManager-061008-081103"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
R3 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-03-17 115952]
R4 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-07 29744]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-04 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-06 101936]


— Other Services/Drivers In Memory —

*NewlyCreated* - AUJASNKJ
*Deregistered* - aujasnkj
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - DefWatch
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTPFilter
*Deregistered* - IISADMIN
*Deregistered* - ImapiService
*Deregistered* - iPod Service
*Deregistered* - JavaQuickStarterService
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - LVCOMSer
*Deregistered* - LVPrcSrv
*Deregistered* - LVSrvLauncher
*Deregistered* - MpService
*Deregistered* - Netman
*Deregistered* - NICCONFIGSVC
*Deregistered* - Nla
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - QBCFMonitorService
*Deregistered* - RasAuto
*Deregistered* - RasMan
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SMTPSVC
*Deregistered* - SPBBCSvc
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - Symantec AntiVirus
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - UMWdf
*Deregistered* - upnphost
*Deregistered* - w32time
*Deregistered* - W3SVC
*Deregistered* - WebClient
*Deregistered* - WinDefend
*Deregistered* - winmgmt
*Deregistered* - wltrysvc
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-03-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:34]

2009-04-03 c:\windows\Tasks\BACKUP NOW FRIDAY MESSAGE.job
- C:\BACKUPNOWFRIDAYMESSAGE.doc [2005-10-29 21:25]

2006-03-02 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p officejet 6100 series5E771253C1676EBED677BF361FDFC537825E15B8133157349.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 08:52]

2009-04-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20]

2009-04-03 c:\windows\Tasks\My Documents Changed Files MG.job
- c:\program files\Stomp\Backup MyPC\System\bestart.exe [2002-11-04 11:09]

2009-04-16 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2004-05-12 21:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://dsl.sbc.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Marcia Gordon\Application Data\Mozilla\Firefox\Profiles\r4mp8c96.default\
FF - prefs.js: browser.startup.homepage - hxxp://dsl.sbc.yahoo.com/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-16 13:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-16 14:00
ComboFix-quarantined-files.txt 2009-04-16 21:00
ComboFix2.txt 2009-04-15 22:21
ComboFix3.txt 2009-04-15 20:48

Pre-Run: 37,111,795,712 bytes free
Post-Run: 37,090,729,984 bytes free

349 — E O F — 2009-04-16 15:13