[Resolved] Work computer troubles

Jotti scans, then report.txt from SDfix, then HJT log:

Down(1).exe

Scanner results
Scan taken on 05 May 2009 17:54:29 (GMT) A-Squared
Found Backdoor.Win32.Venik!IK
AntiVir
Found HEUR/Malware
ArcaVir
Found Variant:Trojan.Dropper.Agent.Acfe
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Ikarus
Found Backdoor.Win32.Venik
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Quick Heal
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

hihmt.sys:

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

Hide.exe:

Scanner results
Scan taken on 05 May 2009 18:01:47 (GMT) A-Squared
Found nothing
AntiVir
Found TR/Crypt.CFI.Gen
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found Gen:Trojan.Heur.0034CBEE6F
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found W32/Smalltroj.NIQG
Panda Antivirus
Found nothing
Quick Heal
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing



0005ca37.sys

Scanner results
Scan taken on 05 May 2009 18:04:28 (GMT) A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Quick Heal
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing



SDFix: Version 1.240
Run by [removed] on Tue 05/05/2009 at 01:34 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-05 14:03:27
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"OfflineDetectionPending"=dword:00000001

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"="C:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe:*:Enabled:javaw"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :



Files with Hidden Attributes :

Thu 16 Apr 2009 833,024 ..SH. — "C:\Program Files\Domain.exe"
Thu 16 Apr 2009 833,024 ..SH. — "C:\Program Files\_Domain.exe"
Mon 26 Nov 2001 102,467 A..H. — "C:\Program Files\America Online 7.0\aolphx.exe"
Tue 27 Nov 2001 32,839 A..H. — "C:\Program Files\America Online 7.0\aoltray.exe"
Mon 26 Nov 2001 40,960 A..H. — "C:\Program Files\America Online 7.0\RBM.exe"
Mon 26 Nov 2001 180,287 A..H. — "C:\Program Files\America Online 7.0\waol.exe"
Tue 15 Oct 2002 49,223 A..H. — "C:\Program Files\America Online 8.0\aolphx.exe"
Tue 15 Oct 2002 36,939 A..H. — "C:\Program Files\America Online 8.0\aoltray.exe"
Tue 15 Oct 2002 40,960 A..H. — "C:\Program Files\America Online 8.0\RBM.exe"
Tue 15 Oct 2002 233,539 A..H. — "C:\Program Files\America Online 8.0\waol.exe"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RambtsC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RamptkC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RamttuC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RbmitxC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RbmktnC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RbmytjC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RcmdteC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RcmdtoC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RcmltgC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RcmntqC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RcmptkC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RcmttmC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RcmxtoC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RdmgtlC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RdmmtjC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RembtmC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RemftiC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RemntiC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RemxtqC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RfmitpC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RfmutrC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RgmhtsC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RgmjtsC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RgmvtmC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RgmvtwC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RhmcttC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RhmutpC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RimdtiC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RimftsC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RimlteC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RimttcC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RjmgtpC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RjmothC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RjmwtlC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RkmhtkC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RkmhtmC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RkmrtsC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RkmvtmC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RlmqtvC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RmmhtcC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RmmvtmC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RmmxteC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RnmctjC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RnmktpC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RnmmtdC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RnmutjC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RnmwthC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RombtwC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RomdtmC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RomftcC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RomttwC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RpmittC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RpmqttC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RpmwtxC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RrmctjC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RrmitlC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RrmktlC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RrmutdC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RsmbtqC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RsmdteC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RsmftoC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RsmhtcC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RsmrtwC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RsmttcC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RsmvtoC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RsmxtsC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RtmyttC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RumhtqC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RvmotdC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RvmstvC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RwmntgC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RwmntqC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RwmpteC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RwmtteC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RwmvtoC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RxmettC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RxmgtrC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RxmmtlC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RxmqtpC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RxmstnC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RymntkC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RymxteC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RzmctdC.dll"
Tue 17 Aug 2004 74,752 ..SH. — "C:\WINDOWS\SYSTEM32\RzmmtdC.dll"
Sun 19 Apr 2009 16,384 A.SH. — "C:\WINDOWS\SYSTEM32\userinet.exe"
Mon 26 Nov 2001 49,221 A..H. — "C:\Program Files\America Online 7.0\COMIT\cswitch.exe"
Tue 15 Oct 2002 49,225 A..H. — "C:\Program Files\America Online 8.0\COMIT\cswitch.exe"
Tue 17 Aug 2004 112,128 …H. — "C:\WINDOWS\SYSTEM32\DLLCACHE\qmgr.dll"
Tue 10 Feb 2004 123,392 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Templates\~WRL3552.tmp"
Tue 4 Feb 2003 34,816 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL0004.tmp"
Fri 12 Aug 2005 27,136 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL0406.tmp"
Tue 29 Mar 2005 61,440 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL0686.tmp"
Wed 28 Jan 2004 121,856 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL0777.tmp"
Tue 1 Apr 2003 30,208 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL0971.tmp"
Thu 7 Sep 2006 207,360 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1173.tmp"
Tue 14 Sep 2004 167,936 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1197.tmp"
Mon 28 Mar 2005 56,832 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1205.tmp"
Mon 22 Nov 2004 31,744 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1528.tmp"
Thu 7 Sep 2006 211,456 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1568.tmp"
Mon 4 Jun 2007 250,368 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1572.tmp"
Thu 13 Feb 2003 46,080 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1664.tmp"
Tue 14 Aug 2007 259,584 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1694.tmp"
Wed 12 Jul 2006 193,024 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1939.tmp"
Fri 14 Feb 2003 22,016 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL1986.tmp"
Tue 23 Nov 2004 35,840 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL2152.tmp"
Thu 13 Feb 2003 46,592 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL2196.tmp"
Tue 7 Sep 2004 166,912 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL2520.tmp"
Tue 1 Apr 2003 65,024 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL2620.tmp"
Wed 6 Sep 2006 206,848 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL2842.tmp"
Tue 16 Dec 2003 116,736 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL3087.tmp"
Thu 21 Aug 2003 94,208 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL3097.tmp"
Fri 21 Nov 2003 111,616 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL3324.tmp"
Fri 8 Sep 2006 206,848 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL3374.tmp"
Tue 1 Apr 2003 65,536 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL3460.tmp"
Mon 13 Aug 2007 259,584 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL3631.tmp"
Fri 7 Feb 2003 36,864 …H. — "C:\Documents and Settings\Karen\Application Data\Microsoft\Word\~WRL4032.tmp"
Tue 11 Apr 2006 2,461,696 A..H. — "C:\Documents and Settings\Karen\Application Data\U3\temp\Launchpad Removal.exe"
Tue 15 Oct 2002 106,496 A..H. — "C:\Program Files\Common Files\aolshare\shell\us\shellext.dll"

Finished!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:53:45 PM, on 5/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\calc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Browser MOUSE\mouse32a.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sirius.com/siriusinternetradio
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Mozilla Firefox.lnk = C:\Program Files\Mozilla Firefox\firefox.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126109366984
O17 - HKLM\System\CCS\Services\Tcpip\..\{8269D2D1-06DF-4530-A7A8-FED624009ACE}: NameServer = 129.15.1.120,129.15.1.121
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Domain Name Service (Domain) - Unknown owner - C:\Program Files\Domain.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: plication crashes to Microsof (reports service) - Unknown owner - C:\WINDOWS\system32\ctvhcst.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Serial Number Service loaded to the device. - Unknown owner - C:\Program Files\Common Files\Serial.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 11617 bytes

okieherper,

COMBOFIX-Script

Open notepad and copy/paste the text in the quotebox below into it:

http://forums.whatthetech.com/add_reply_f27_to102340.html

Collect::

Suspect::
C:\WINDOWS\SYSTEM32\RambtsC.dll
C:\WINDOWS\SYSTEM32\RamptkC.dll
C:\WINDOWS\SYSTEM32\RamttuC.dll
C:\WINDOWS\SYSTEM32\RbmitxC.dll
C:\WINDOWS\SYSTEM32\RbmktnC.dll
C:\WINDOWS\SYSTEM32\RbmytjC.dll
C:\WINDOWS\SYSTEM32\RcmdteC.dll
C:\WINDOWS\SYSTEM32\RcmdtoC.dll
C:\WINDOWS\SYSTEM32\RcmltgC.dll
C:\WINDOWS\SYSTEM32\RcmntqC.dll
C:\WINDOWS\SYSTEM32\RcmptkC.dll
C:\WINDOWS\SYSTEM32\RcmttmC.dll
C:\WINDOWS\SYSTEM32\RcmxtoC.dll
C:\WINDOWS\SYSTEM32\RdmgtlC.dll
C:\WINDOWS\SYSTEM32\RdmmtjC.dll
C:\WINDOWS\SYSTEM32\RembtmC.dll
C:\WINDOWS\SYSTEM32\RemftiC.dll
C:\WINDOWS\SYSTEM32\RemntiC.dll
C:\WINDOWS\SYSTEM32\RemxtqC.dll
C:\WINDOWS\SYSTEM32\RfmitpC.dll
C:\WINDOWS\SYSTEM32\RfmutrC.dll
C:\WINDOWS\SYSTEM32\RgmhtsC.dll
C:\WINDOWS\SYSTEM32\RgmjtsC.dll
C:\WINDOWS\SYSTEM32\RgmvtmC.dll
C:\WINDOWS\SYSTEM32\RgmvtwC.dll
C:\WINDOWS\SYSTEM32\RhmcttC.dll
C:\WINDOWS\SYSTEM32\RhmutpC.dll
C:\WINDOWS\SYSTEM32\RimdtiC.dll
C:\WINDOWS\SYSTEM32\RimftsC.dll
C:\WINDOWS\SYSTEM32\RimlteC.dll
C:\WINDOWS\SYSTEM32\RimttcC.dll
C:\WINDOWS\SYSTEM32\RjmgtpC.dll
C:\WINDOWS\SYSTEM32\RjmothC.dll
C:\WINDOWS\SYSTEM32\RjmwtlC.dll
C:\WINDOWS\SYSTEM32\RkmhtkC.dll
C:\WINDOWS\SYSTEM32\RkmhtmC.dll
C:\WINDOWS\SYSTEM32\RkmrtsC.dll
C:\WINDOWS\SYSTEM32\RkmvtmC.dll
C:\WINDOWS\SYSTEM32\RlmqtvC.dll
C:\WINDOWS\SYSTEM32\RmmhtcC.dll
C:\WINDOWS\SYSTEM32\RmmvtmC.dll
C:\WINDOWS\SYSTEM32\RmmxteC.dll
C:\WINDOWS\SYSTEM32\RnmctjC.dll
C:\WINDOWS\SYSTEM32\RnmktpC.dll
C:\WINDOWS\SYSTEM32\RnmmtdC.dll
C:\WINDOWS\SYSTEM32\RnmutjC.dll
C:\WINDOWS\SYSTEM32\RnmwthC.dll
C:\WINDOWS\SYSTEM32\RombtwC.dll
C:\WINDOWS\SYSTEM32\RomdtmC.dll
C:\WINDOWS\SYSTEM32\RomftcC.dll
C:\WINDOWS\SYSTEM32\RomttwC.dll
C:\WINDOWS\SYSTEM32\RpmittC.dll
C:\WINDOWS\SYSTEM32\RpmqttC.dll
C:\WINDOWS\SYSTEM32\RpmwtxC.dll
C:\WINDOWS\SYSTEM32\RrmctjC.dll
C:\WINDOWS\SYSTEM32\RrmitlC.dll
C:\WINDOWS\SYSTEM32\RrmktlC.dll
C:\WINDOWS\SYSTEM32\RrmutdC.dll
C:\WINDOWS\SYSTEM32\RsmbtqC.dll
C:\WINDOWS\SYSTEM32\RsmdteC.dll
C:\WINDOWS\SYSTEM32\RsmftoC.dll
C:\WINDOWS\SYSTEM32\RsmhtcC.dll
C:\WINDOWS\SYSTEM32\RsmrtwC.dll
C:\WINDOWS\SYSTEM32\RsmttcC.dll
C:\WINDOWS\SYSTEM32\RsmvtoC.dll
C:\WINDOWS\SYSTEM32\RsmxtsC.dll
C:\WINDOWS\SYSTEM32\RtmyttC.dll
C:\WINDOWS\SYSTEM32\RumhtqC.dll
C:\WINDOWS\SYSTEM32\RvmotdC.dll
C:\WINDOWS\SYSTEM32\RvmstvC.dll
C:\WINDOWS\SYSTEM32\RwmntgC.dll
C:\WINDOWS\SYSTEM32\RwmntqC.dll
C:\WINDOWS\SYSTEM32\RwmpteC.dll
C:\WINDOWS\SYSTEM32\RwmtteC.dll
C:\WINDOWS\SYSTEM32\RwmvtoC.dll
C:\WINDOWS\SYSTEM32\RxmettC.dll
C:\WINDOWS\SYSTEM32\RxmgtrC.dll
C:\WINDOWS\SYSTEM32\RxmmtlC.dll
C:\WINDOWS\SYSTEM32\RxmqtpC.dll
C:\WINDOWS\SYSTEM32\RxmstnC.dll
C:\WINDOWS\SYSTEM32\RymntkC.dll
C:\WINDOWS\SYSTEM32\RymxteC.dll
C:\WINDOWS\SYSTEM32\RzmctdC.dll
C:\WINDOWS\SYSTEM32\RzmmtdC.dll

File::
c:\windows\system32\Down(1).exe
c:\windows\system32\drivers\hihmt.sys
c:\windows\system32\Hide.exe

Save this as CFScript.txt


[external image: Posted Image]


Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

• Ensure you are connected to the internet and click OK on the message box.

combofix log:

ComboFix 09-05-05.04 - Karen 05/06/2009 8:24.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.582 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karen\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
FW: COMODO Firewall *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\system32\Down(1).exe
c:\windows\system32\drivers\hihmt.sys
c:\windows\system32\Hide.exe

file zipped: c:\windows\SYSTEM32\Suspect_RambtsC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RamptkC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RamttuC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RbmitxC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RbmktnC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RbmytjC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RcmdteC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RcmdtoC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RcmltgC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RcmntqC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RcmptkC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RcmttmC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RcmxtoC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RdmgtlC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RdmmtjC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RembtmC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RemftiC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RemntiC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RemxtqC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RfmitpC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RfmutrC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RgmhtsC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RgmjtsC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RgmvtmC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RgmvtwC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RhmcttC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RhmutpC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RimdtiC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RimftsC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RimlteC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RimttcC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RjmgtpC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RjmothC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RjmwtlC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RkmhtkC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RkmhtmC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RkmrtsC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RkmvtmC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RlmqtvC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RmmhtcC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RmmvtmC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RmmxteC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RnmctjC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RnmktpC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RnmmtdC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RnmutjC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RnmwthC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RombtwC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RomdtmC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RomftcC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RomttwC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RpmittC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RpmqttC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RpmwtxC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RrmctjC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RrmitlC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RrmktlC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RrmutdC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RsmbtqC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RsmdteC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RsmftoC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RsmhtcC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RsmrtwC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RsmttcC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RsmvtoC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RsmxtsC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RtmyttC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RumhtqC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RvmotdC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RvmstvC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RwmntgC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RwmntqC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RwmpteC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RwmtteC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RwmvtoC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RxmettC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RxmgtrC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RxmmtlC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RxmqtpC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RxmstnC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RymntkC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RymxteC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RzmctdC.dll.vir
file zipped: c:\windows\SYSTEM32\Suspect_RzmmtdC.dll.vir
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Down(1).exe
c:\windows\system32\drivers\hihmt.sys
c:\windows\system32\Hide.exe
c:\windows\system32\result.txt
c:\windows\Temp\2504.exe
c:\windows\Temp\2544.exe
c:\windows\Temp\2624.exe
c:\windows\Temp\3028.exe

.
((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
.

2009-05-06 02:28 . 2009-05-06 08:04 15360 —-a-w c:\windows\system32\scan.exe
2009-05-05 18:33 . 2009-05-05 18:33 578560 —-a-w c:\windows\system32\dllcache\user32.dll
2009-05-05 18:31 . 2009-05-05 18:32 ——– d—–w c:\windows\ERUNT
2009-05-05 18:02 . 2009-05-05 19:05 ——– d—–w C:\SDFix
2009-04-29 17:06 . 2009-04-29 17:06 ——– d—–w c:\windows\Sun
2009-04-29 17:04 . 2009-04-29 17:04 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\Karen\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-28 13:59 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-24 15:52 . 2009-04-24 15:52 33061 —-a-w c:\windows\king-uninstall.exe
2009-04-24 15:50 . 2009-04-24 15:53 ——– d—–w c:\documents and settings\Karen\Local Settings\Application Data\king.com
2009-04-22 13:45 . 2009-04-22 13:45 ——– d—–w c:\program files\Trend Micro
2009-04-22 13:39 . 2009-04-22 13:39 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2009-04-21 02:53 . 2009-04-19 07:37 16384 –sha-w c:\windows\system32\userinet.exe
2009-04-20 14:36 . 2009-04-20 14:36 1 —-a-w c:\windows\system32\0005ca37.sys
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\_Domain.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\Domain.exe
2009-04-17 01:54 . 2009-04-30 20:18 38 —-a-w c:\windows\system32\install.dat
2009-04-17 01:54 . 2009-04-17 20:15 59904 —-a-w c:\windows\system32\Windows7.exe
2009-04-16 13:39 . 2009-04-16 13:39 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-04-16 13:32 . 2009-04-16 13:32 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-15 16:46 . 2008-12-16 12:30 354304 ——w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 03:28 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 03:28 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 03:28 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 03:28 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 03:28 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 03:28 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 03:28 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 03:28 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 03:28 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 03:28 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:23 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 03:23 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 13:16 . 2006-04-25 20:38 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-09 16:48 . 2003-01-14 16:55 ——– d—–w c:\program files\Java
2009-04-09 16:41 . 2002-11-10 14:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-18 13:10 . 2009-03-18 13:10 316672 —-a-w c:\windows\KingComIE.dll
2009-03-17 16:47 . 2009-03-17 16:45 ——– d—–w c:\program files\Yahoo!
2009-03-17 16:08 . 2008-07-14 17:06 24336 —-a-w c:\windows\system32\drivers\cmdhlp.sys
2009-03-17 16:08 . 2008-07-14 17:06 110992 —-a-w c:\windows\system32\drivers\cmdguard.sys
2009-03-17 16:08 . 2008-07-14 17:06 155384 —-a-w c:\windows\system32\guard32.dll
2009-03-12 19:37 . 2009-03-12 21:08 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-03-12 19:36 . 2009-03-12 19:45 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-03-12 19:28 . 2006-02-07 16:19 ——– d—–w c:\program files\Lavasoft
2009-03-12 18:18 . 2009-03-12 18:18 ——– d—–w c:\program files\CCleaner
2009-03-06 14:22 . 2003-01-14 17:54 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-12-07 22:37 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2005-04-08 21:35 78336 ——w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2001-08-18 13:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-01-14 05:33 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2001-08-18 13:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2001-08-18 13:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-02-21 00:46 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-08 00:02 . 1980-01-01 06:00 2066048 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2001-08-18 13:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 1980-01-01 06:00 2189056 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2001-08-18 13:00 35328 —-a-w c:\windows\system32\sc.exe
2006-02-02 20:29 . 2006-02-02 20:28 32803463 —-a-w c:\program files\Symantec_av_full_version_win.exe
2006-01-16 01:55 . 2006-01-16 01:55 5225384 —-a-w c:\program files\Firefox Setup 1.5.exe
2005-10-18 20:46 . 2005-10-18 20:46 4839222 —-a-w c:\program files\syncbackse_setup.exe
2005-09-09 14:44 . 2005-09-09 14:44 49634 —-a-w c:\program files\POBS Kelly grass.jpg
2005-09-09 14:43 . 2005-09-09 14:43 29226 —-a-w c:\program files\POBS Kelly rodent.jpg
2005-08-13 00:14 . 2005-08-13 00:13 9308264 —-a-w c:\program files\zlsSetup_60_631_003.exe
2005-06-28 15:37 . 2005-06-28 15:37 10808151 —-a-w c:\program files\Inkscape-0.41-1.win32.exe
2005-05-22 01:22 . 2005-05-22 01:22 32803463 —-a-w c:\program files\Symantec_av_full_version.exe
2005-05-21 18:49 . 2005-05-21 18:48 493270 —-a-w c:\program files\FastDefrag2.exe
2005-05-21 18:41 . 2005-05-21 18:41 2020143 —-a-w c:\program files\iaa23_enu.exe
2005-05-21 18:40 . 2005-05-21 18:40 122880 —-a-w c:\program files\ChipUtil.exe
2005-05-21 18:38 . 2005-05-21 18:37 861059 —-a-w c:\program files\infinst_autol.exe
2004-12-10 19:51 . 2004-12-10 19:51 6655600 —-a-w c:\program files\zlsSetup_55_062_004.exe
2004-10-10 17:27 . 2004-10-10 17:27 5827728 —-a-w c:\program files\zlsSetup_51_033_000.exe
2004-04-20 18:09 . 2004-04-20 18:09 91628 —-a-w c:\program files\r040115e.pdf
2004-04-13 17:36 . 2004-04-13 17:30 63880198 —-a-w c:\program files\qxpress61updater.zip
2003-05-21 13:13 . 2003-05-21 13:12 10364928 —-a-w c:\program files\McAfee7.0.exe
2003-05-08 13:38 . 2003-05-08 13:37 3750576 —-a-w c:\program files\zaSetup_37_143.exe
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RambtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RamptkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RamttuC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmitxC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmktnC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RbmytjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmdteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmdtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmltgC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmntqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmptkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmttmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RcmxtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RdmgtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RdmmtjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RembtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemftiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemntiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RemxtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RfmitpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RfmutrC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmhtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmjtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RgmvtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RhmcttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RhmutpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimdtiC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimftsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimlteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RimttcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmgtpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmothC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RjmwtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmhtkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmhtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmrtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RkmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RlmqtvC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmhtcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmvtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RmmxteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmctjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmktpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmmtdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmutjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RnmwthC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RombtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomdtmC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomftcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RomttwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmittC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmqttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RpmwtxC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmctjC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmitlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmktlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RrmutdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmbtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmdteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmftoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmhtcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmrtwC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmttcC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmvtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RsmxtsC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RtmyttC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RumhtqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RvmotdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RvmstvC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmntgC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmntqC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmpteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmtteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RwmvtoC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmettC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmgtrC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmmtlC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmqtpC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RxmstnC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RymntkC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RymxteC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RzmctdC.dll
2004-08-18 01:00 . 2004-08-18 01:00 74752 –sh–w c:\windows\SYSTEM32\RzmmtdC.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-30_13.30.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-06 13:14 . 2009-05-06 13:14 16384 c:\windows\Temp\Perflib_Perfdata_95c.dat
+ 2001-08-18 13:00 . 2008-04-14 00:12 87352 c:\windows\SYSTEM32\ntvdvd.dll
+ 2003-01-14 17:54 . 2004-08-18 01:00 112128 c:\windows\SYSTEM32\qmgr.dll
+ 2003-01-14 17:54 . 2004-08-18 01:00 112128 c:\windows\SYSTEM32\DLLCACHE\qmgr.dll
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-05-15 245760]
"LWBKEYBOARD"="c:\program files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe" [2002-04-02 371200]
"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2004-04-26 360448]
"StatusClient 2.6"="c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 61440]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-12 163840]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-12-17 45108]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-12-17 36864]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-02-25 139347]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-23 516440]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-29 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2005-6-6 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-26 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2006-1-15 307704]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [3/12/2009 2:45 PM 64160]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\SYSTEM32\DRIVERS\cmdguard.sys [7/14/2008 12:06 PM 110992]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\SYSTEM32\DRIVERS\cmdhlp.sys [7/14/2008 12:06 PM 24336]
R2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;c:\program files\PowerQuest\DataKeeper\PqFsmonNt.sys [4/26/2005 1:33 PM 49096]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 1:27 PM 169200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 11:20 AM 101936]
S2 DmPnSN;Portable Meda Number Service;c:\windows\SYSTEM32\userinet.exe [4/20/2009 9:53 PM 16384]
S2 Domain;Domain Name Service;c:\program files\Domain.exe [4/16/2009 9:20 PM 833024]
S2 MediaPlayer Serial;Portable MediaPlayer Serial Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSerial;Portable Media Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSoftware;MediaSoftware Control Center ;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 reports service;plication crashes to Microsof;c:\windows\SYSTEM32\ctvhcst.exe _k vetvcs [4/15/2009 4:31 PM 272384]
S2 Serial Number Service loaded to the device.;Serial Number Service loaded to the device.;c:\program files\Common Files\Serial.exe –> c:\program files\Common Files\Serial.exe [?]
S2 WinErp;Windows System Event reporting;c:\windows\system32\svchost.exe -KWinErp –> c:\windows\system32\svchost.exe -KWinErp [?]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 4:34 PM 953168]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10741

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinErp REG_MULTI_SZ WinErp
winErs REG_MULTI_SZ winErs
.
Contents of the 'Scheduled Tasks' folder

2009-05-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:46]

2009-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sirius.com/siriusinternetradio
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: {8269D2D1-06DF-4530-A7A8-FED624009ACE} = 129.15.1.120,129.15.1.121
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\q8zn4sem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 08:27
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(768)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(828)
c:\windows\system32\guard32.dll
.
Completion time: 2009-05-06 8:30
ComboFix-quarantined-files.txt 2009-05-06 13:30
ComboFix2.txt 2009-05-05 15:53
ComboFix3.txt 2009-04-30 16:32
ComboFix4.txt 2009-04-30 13:35

Pre-Run: 34,970,349,568 bytes free
Post-Run: 34,949,066,752 bytes free

414 — E O F — 2009-04-29 17:01
Upload was successful

ComboFix 09-05-05.04 - Karen 05/06/2009 11:10.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.537 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karen\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
FW: COMODO Firewall *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\SYSTEM32\RambtsC.dll
c:\windows\SYSTEM32\RamptkC.dll
c:\windows\SYSTEM32\RamttuC.dll
c:\windows\SYSTEM32\RbmitxC.dll
c:\windows\SYSTEM32\RbmktnC.dll
c:\windows\SYSTEM32\RbmytjC.dll
c:\windows\SYSTEM32\RcmdteC.dll
c:\windows\SYSTEM32\RcmdtoC.dll
c:\windows\SYSTEM32\RcmltgC.dll
c:\windows\SYSTEM32\RcmntqC.dll
c:\windows\SYSTEM32\RcmptkC.dll
c:\windows\SYSTEM32\RcmttmC.dll
c:\windows\SYSTEM32\RcmxtoC.dll
c:\windows\SYSTEM32\RdmgtlC.dll
c:\windows\SYSTEM32\RdmmtjC.dll
c:\windows\SYSTEM32\RembtmC.dll
c:\windows\SYSTEM32\RemftiC.dll
c:\windows\SYSTEM32\RemntiC.dll
c:\windows\SYSTEM32\RemxtqC.dll
c:\windows\SYSTEM32\RfmitpC.dll
c:\windows\SYSTEM32\RfmutrC.dll
c:\windows\SYSTEM32\RgmhtsC.dll
c:\windows\SYSTEM32\RgmjtsC.dll
c:\windows\SYSTEM32\RgmvtmC.dll
c:\windows\SYSTEM32\RgmvtwC.dll
c:\windows\SYSTEM32\RhmcttC.dll
c:\windows\SYSTEM32\RhmutpC.dll
c:\windows\SYSTEM32\RimdtiC.dll
c:\windows\SYSTEM32\RimftsC.dll
c:\windows\SYSTEM32\RimlteC.dll
c:\windows\SYSTEM32\RimttcC.dll
c:\windows\SYSTEM32\RjmgtpC.dll
c:\windows\SYSTEM32\RjmothC.dll
c:\windows\SYSTEM32\RjmwtlC.dll
c:\windows\SYSTEM32\RkmhtkC.dll
c:\windows\SYSTEM32\RkmhtmC.dll
c:\windows\SYSTEM32\RkmrtsC.dll
c:\windows\SYSTEM32\RkmvtmC.dll
c:\windows\SYSTEM32\RlmqtvC.dll
c:\windows\SYSTEM32\RmmhtcC.dll
c:\windows\SYSTEM32\RmmvtmC.dll
c:\windows\SYSTEM32\RmmxteC.dll
c:\windows\SYSTEM32\RnmctjC.dll
c:\windows\SYSTEM32\RnmktpC.dll
c:\windows\SYSTEM32\RnmmtdC.dll
c:\windows\SYSTEM32\RnmutjC.dll
c:\windows\SYSTEM32\RnmwthC.dll
c:\windows\SYSTEM32\RombtwC.dll
c:\windows\SYSTEM32\RomdtmC.dll
c:\windows\SYSTEM32\RomftcC.dll
c:\windows\SYSTEM32\RomttwC.dll
c:\windows\SYSTEM32\RpmittC.dll
c:\windows\SYSTEM32\RpmqttC.dll
c:\windows\SYSTEM32\RpmwtxC.dll
c:\windows\SYSTEM32\RrmctjC.dll
c:\windows\SYSTEM32\RrmitlC.dll
c:\windows\SYSTEM32\RrmktlC.dll
c:\windows\SYSTEM32\RrmutdC.dll
c:\windows\SYSTEM32\RsmbtqC.dll
c:\windows\SYSTEM32\RsmdteC.dll
c:\windows\SYSTEM32\RsmftoC.dll
c:\windows\SYSTEM32\RsmhtcC.dll
c:\windows\SYSTEM32\RsmrtwC.dll
c:\windows\SYSTEM32\RsmttcC.dll
c:\windows\SYSTEM32\RsmvtoC.dll
c:\windows\SYSTEM32\RsmxtsC.dll
c:\windows\SYSTEM32\RtmyttC.dll
c:\windows\SYSTEM32\RumhtqC.dll
c:\windows\SYSTEM32\RvmotdC.dll
c:\windows\SYSTEM32\RvmstvC.dll
c:\windows\SYSTEM32\RwmntgC.dll
c:\windows\SYSTEM32\RwmntqC.dll
c:\windows\SYSTEM32\RwmpteC.dll
c:\windows\SYSTEM32\RwmtteC.dll
c:\windows\SYSTEM32\RwmvtoC.dll
c:\windows\SYSTEM32\RxmettC.dll
c:\windows\SYSTEM32\RxmgtrC.dll
c:\windows\SYSTEM32\RxmmtlC.dll
c:\windows\SYSTEM32\RxmqtpC.dll
c:\windows\SYSTEM32\RxmstnC.dll
c:\windows\SYSTEM32\RymntkC.dll
c:\windows\SYSTEM32\RymxteC.dll
c:\windows\SYSTEM32\RzmctdC.dll
c:\windows\SYSTEM32\RzmmtdC.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SYSTEM32\RambtsC.dll
c:\windows\SYSTEM32\RamptkC.dll
c:\windows\SYSTEM32\RamttuC.dll
c:\windows\SYSTEM32\RbmitxC.dll
c:\windows\SYSTEM32\RbmktnC.dll
c:\windows\SYSTEM32\RbmytjC.dll
c:\windows\SYSTEM32\RcmdteC.dll
c:\windows\SYSTEM32\RcmdtoC.dll
c:\windows\SYSTEM32\RcmltgC.dll
c:\windows\SYSTEM32\RcmntqC.dll
c:\windows\SYSTEM32\RcmptkC.dll
c:\windows\SYSTEM32\RcmttmC.dll
c:\windows\SYSTEM32\RcmxtoC.dll
c:\windows\SYSTEM32\RdmgtlC.dll
c:\windows\SYSTEM32\RdmmtjC.dll
c:\windows\SYSTEM32\RembtmC.dll
c:\windows\SYSTEM32\RemftiC.dll
c:\windows\SYSTEM32\RemntiC.dll
c:\windows\SYSTEM32\RemxtqC.dll
c:\windows\SYSTEM32\RfmitpC.dll
c:\windows\SYSTEM32\RfmutrC.dll
c:\windows\SYSTEM32\RgmhtsC.dll
c:\windows\SYSTEM32\RgmjtsC.dll
c:\windows\SYSTEM32\RgmvtmC.dll
c:\windows\SYSTEM32\RgmvtwC.dll
c:\windows\SYSTEM32\RhmcttC.dll
c:\windows\SYSTEM32\RhmutpC.dll
c:\windows\SYSTEM32\RimdtiC.dll
c:\windows\SYSTEM32\RimftsC.dll
c:\windows\SYSTEM32\RimlteC.dll
c:\windows\SYSTEM32\RimttcC.dll
c:\windows\SYSTEM32\RjmgtpC.dll
c:\windows\SYSTEM32\RjmothC.dll
c:\windows\SYSTEM32\RjmwtlC.dll
c:\windows\SYSTEM32\RkmhtkC.dll
c:\windows\SYSTEM32\RkmhtmC.dll
c:\windows\SYSTEM32\RkmrtsC.dll
c:\windows\SYSTEM32\RkmvtmC.dll
c:\windows\SYSTEM32\RlmqtvC.dll
c:\windows\SYSTEM32\RmmhtcC.dll
c:\windows\SYSTEM32\RmmvtmC.dll
c:\windows\SYSTEM32\RmmxteC.dll
c:\windows\SYSTEM32\RnmctjC.dll
c:\windows\SYSTEM32\RnmktpC.dll
c:\windows\SYSTEM32\RnmmtdC.dll
c:\windows\SYSTEM32\RnmutjC.dll
c:\windows\SYSTEM32\RnmwthC.dll
c:\windows\SYSTEM32\RombtwC.dll
c:\windows\SYSTEM32\RomdtmC.dll
c:\windows\SYSTEM32\RomftcC.dll
c:\windows\SYSTEM32\RomttwC.dll
c:\windows\SYSTEM32\RpmittC.dll
c:\windows\SYSTEM32\RpmqttC.dll
c:\windows\SYSTEM32\RpmwtxC.dll
c:\windows\SYSTEM32\RrmctjC.dll
c:\windows\SYSTEM32\RrmitlC.dll
c:\windows\SYSTEM32\RrmktlC.dll
c:\windows\SYSTEM32\RrmutdC.dll
c:\windows\SYSTEM32\RsmbtqC.dll
c:\windows\SYSTEM32\RsmdteC.dll
c:\windows\SYSTEM32\RsmftoC.dll
c:\windows\SYSTEM32\RsmhtcC.dll
c:\windows\SYSTEM32\RsmrtwC.dll
c:\windows\SYSTEM32\RsmttcC.dll
c:\windows\SYSTEM32\RsmvtoC.dll
c:\windows\SYSTEM32\RsmxtsC.dll
c:\windows\SYSTEM32\RtmyttC.dll
c:\windows\SYSTEM32\RumhtqC.dll
c:\windows\SYSTEM32\RvmotdC.dll
c:\windows\SYSTEM32\RvmstvC.dll
c:\windows\SYSTEM32\RwmntgC.dll
c:\windows\SYSTEM32\RwmntqC.dll
c:\windows\SYSTEM32\RwmpteC.dll
c:\windows\SYSTEM32\RwmtteC.dll
c:\windows\SYSTEM32\RwmvtoC.dll
c:\windows\SYSTEM32\RxmettC.dll
c:\windows\SYSTEM32\RxmgtrC.dll
c:\windows\SYSTEM32\RxmmtlC.dll
c:\windows\SYSTEM32\RxmqtpC.dll
c:\windows\SYSTEM32\RxmstnC.dll
c:\windows\SYSTEM32\RymntkC.dll
c:\windows\SYSTEM32\RymxteC.dll
c:\windows\SYSTEM32\RzmctdC.dll
c:\windows\SYSTEM32\RzmmtdC.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_WINERP
——-\Service_WinErp


((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
.

2009-05-06 02:28 . 2009-05-06 08:04 15360 —-a-w c:\windows\system32\scan.exe
2009-05-05 18:33 . 2009-05-05 18:33 578560 —-a-w c:\windows\system32\dllcache\user32.dll
2009-05-05 18:31 . 2009-05-05 18:32 ——– d—–w c:\windows\ERUNT
2009-05-05 18:02 . 2009-05-05 19:05 ——– d—–w C:\SDFix
2009-04-29 17:06 . 2009-04-29 17:06 ——– d—–w c:\windows\Sun
2009-04-29 17:04 . 2009-04-29 17:04 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\Karen\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-28 13:59 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-24 15:52 . 2009-04-24 15:52 33061 —-a-w c:\windows\king-uninstall.exe
2009-04-24 15:50 . 2009-04-24 15:53 ——– d—–w c:\documents and settings\Karen\Local Settings\Application Data\king.com
2009-04-22 13:45 . 2009-04-22 13:45 ——– d—–w c:\program files\Trend Micro
2009-04-22 13:39 . 2009-04-22 13:39 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2009-04-21 02:53 . 2009-04-19 07:37 16384 –sha-w c:\windows\system32\userinet.exe
2009-04-20 14:36 . 2009-04-20 14:36 1 —-a-w c:\windows\system32\0005ca37.sys
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\_Domain.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\Domain.exe
2009-04-17 01:54 . 2009-04-30 20:18 38 —-a-w c:\windows\system32\install.dat
2009-04-17 01:54 . 2009-04-17 20:15 59904 —-a-w c:\windows\system32\Windows7.exe
2009-04-16 13:39 . 2009-04-16 13:39 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-04-16 13:32 . 2009-04-16 13:32 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-15 16:46 . 2008-12-16 12:30 354304 ——w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 03:28 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 03:28 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 03:28 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 03:28 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 03:28 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 03:28 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 03:28 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 03:28 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 03:28 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 03:28 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:23 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 03:23 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 16:17 . 2006-04-25 20:38 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-09 16:48 . 2003-01-14 16:55 ——– d—–w c:\program files\Java
2009-04-09 16:41 . 2002-11-10 14:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-18 13:10 . 2009-03-18 13:10 316672 —-a-w c:\windows\KingComIE.dll
2009-03-17 16:47 . 2009-03-17 16:45 ——– d—–w c:\program files\Yahoo!
2009-03-17 16:08 . 2008-07-14 17:06 24336 —-a-w c:\windows\system32\drivers\cmdhlp.sys
2009-03-17 16:08 . 2008-07-14 17:06 110992 —-a-w c:\windows\system32\drivers\cmdguard.sys
2009-03-17 16:08 . 2008-07-14 17:06 155384 —-a-w c:\windows\system32\guard32.dll
2009-03-12 19:37 . 2009-03-12 21:08 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-03-12 19:36 . 2009-03-12 19:45 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-03-12 19:28 . 2006-02-07 16:19 ——– d—–w c:\program files\Lavasoft
2009-03-12 18:18 . 2009-03-12 18:18 ——– d—–w c:\program files\CCleaner
2009-03-06 14:22 . 2003-01-14 17:54 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-12-07 22:37 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2005-04-08 21:35 78336 ——w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2001-08-18 13:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-01-14 05:33 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2001-08-18 13:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2001-08-18 13:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-02-21 00:46 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-08 00:02 . 1980-01-01 06:00 2066048 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2001-08-18 13:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 1980-01-01 06:00 2189056 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2001-08-18 13:00 35328 —-a-w c:\windows\system32\sc.exe
2006-02-02 20:29 . 2006-02-02 20:28 32803463 —-a-w c:\program files\Symantec_av_full_version_win.exe
2006-01-16 01:55 . 2006-01-16 01:55 5225384 —-a-w c:\program files\Firefox Setup 1.5.exe
2005-10-18 20:46 . 2005-10-18 20:46 4839222 —-a-w c:\program files\syncbackse_setup.exe
2005-09-09 14:44 . 2005-09-09 14:44 49634 —-a-w c:\program files\POBS Kelly grass.jpg
2005-09-09 14:43 . 2005-09-09 14:43 29226 —-a-w c:\program files\POBS Kelly rodent.jpg
2005-08-13 00:14 . 2005-08-13 00:13 9308264 —-a-w c:\program files\zlsSetup_60_631_003.exe
2005-06-28 15:37 . 2005-06-28 15:37 10808151 —-a-w c:\program files\Inkscape-0.41-1.win32.exe
2005-05-22 01:22 . 2005-05-22 01:22 32803463 —-a-w c:\program files\Symantec_av_full_version.exe
2005-05-21 18:49 . 2005-05-21 18:48 493270 —-a-w c:\program files\FastDefrag2.exe
2005-05-21 18:41 . 2005-05-21 18:41 2020143 —-a-w c:\program files\iaa23_enu.exe
2005-05-21 18:40 . 2005-05-21 18:40 122880 —-a-w c:\program files\ChipUtil.exe
2005-05-21 18:38 . 2005-05-21 18:37 861059 —-a-w c:\program files\infinst_autol.exe
2004-12-10 19:51 . 2004-12-10 19:51 6655600 —-a-w c:\program files\zlsSetup_55_062_004.exe
2004-10-10 17:27 . 2004-10-10 17:27 5827728 —-a-w c:\program files\zlsSetup_51_033_000.exe
2004-04-20 18:09 . 2004-04-20 18:09 91628 —-a-w c:\program files\r040115e.pdf
2004-04-13 17:36 . 2004-04-13 17:30 63880198 —-a-w c:\program files\qxpress61updater.zip
2003-05-21 13:13 . 2003-05-21 13:12 10364928 —-a-w c:\program files\McAfee7.0.exe
2003-05-08 13:38 . 2003-05-08 13:37 3750576 —-a-w c:\program files\zaSetup_37_143.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-04-30_13.30.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-06 16:15 . 2009-05-06 16:15 16384 c:\windows\Temp\Perflib_Perfdata_978.dat
+ 2001-08-18 13:00 . 2008-04-14 00:12 87352 c:\windows\SYSTEM32\ntvdvd.dll
+ 2003-01-14 17:54 . 2004-08-18 01:00 112128 c:\windows\SYSTEM32\qmgr.dll
+ 2003-01-14 17:54 . 2004-08-18 01:00 112128 c:\windows\SYSTEM32\DLLCACHE\qmgr.dll
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-05-15 245760]
"LWBKEYBOARD"="c:\program files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe" [2002-04-02 371200]
"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2004-04-26 360448]
"StatusClient 2.6"="c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 61440]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-12 163840]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-12-17 45108]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-12-17 36864]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-02-25 139347]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-23 516440]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-29 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2005-6-6 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-26 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2006-1-15 307704]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [3/12/2009 2:45 PM 64160]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\SYSTEM32\DRIVERS\cmdguard.sys [7/14/2008 12:06 PM 110992]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\SYSTEM32\DRIVERS\cmdhlp.sys [7/14/2008 12:06 PM 24336]
R2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;c:\program files\PowerQuest\DataKeeper\PqFsmonNt.sys [4/26/2005 1:33 PM 49096]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 1:27 PM 169200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 11:20 AM 101936]
S2 DmPnSN;Portable Meda Number Service;c:\windows\SYSTEM32\userinet.exe [4/20/2009 9:53 PM 16384]
S2 Domain;Domain Name Service;c:\program files\Domain.exe [4/16/2009 9:20 PM 833024]
S2 MediaPlayer Serial;Portable MediaPlayer Serial Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSerial;Portable Media Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSoftware;MediaSoftware Control Center ;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 reports service;plication crashes to Microsof;c:\windows\SYSTEM32\ctvhcst.exe _k vetvcs [4/15/2009 4:31 PM 272384]
S2 Serial Number Service loaded to the device.;Serial Number Service loaded to the device.;c:\program files\Common Files\Serial.exe –> c:\program files\Common Files\Serial.exe [?]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 4:34 PM 953168]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10741

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinErp REG_MULTI_SZ WinErp
winErs REG_MULTI_SZ winErs
.
Contents of the 'Scheduled Tasks' folder

2009-05-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:46]

2009-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sirius.com/siriusinternetradio
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: {8269D2D1-06DF-4530-A7A8-FED624009ACE} = 129.15.1.120,129.15.1.121
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\q8zn4sem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 11:16
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(832)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(2960)
c:\windows\system32\guard32.dll
c:\program files\Browser MOUSE\MOUDL32A.DLL
.
———————— Other Running Processes ————————
.
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
c:\program files\Symantec AntiVirus\DoScan.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SYSTEM32\mstsc.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\SYSTEM32\CALC.EXE
c:\windows\wanmpsvc.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-06 11:22 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-06 16:22
ComboFix2.txt 2009-05-06 13:31
ComboFix3.txt 2009-05-05 15:53
ComboFix4.txt 2009-04-30 16:32
ComboFix5.txt 2009-05-06 16:09

Pre-Run: 34,932,666,368 bytes free
Post-Run: 34,906,316,800 bytes free

434 — E O F — 2009-04-29 17:01

ComboFix 09-05-05.05 - Karen 05/06/2009 15:29.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.543 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karen\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
FW: COMODO Firewall *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\program files\Common Files\Serial.exe
c:\program files\McAfee7.0.exe
c:\program files\zaSetup_37_143.exe
c:\windows\SYSTEM32\ctvhcst.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\McAfee7.0.exe
c:\program files\Network Associates
c:\program files\Network Associates\Common Framework\0409\AgentRes.dll
c:\program files\Network Associates\Common Framework\0409\CmaUIRes.dll
c:\program files\Network Associates\Common Framework\0409\ListenSrvRes.dll
c:\program files\Network Associates\Common Framework\0409\Schedres.dll
c:\program files\Network Associates\Common Framework\0409\ScrptRes.dll
c:\program files\Network Associates\Common Framework\0409\UpdRes.dll
c:\program files\Network Associates\Common Framework\Agent.dll
c:\program files\Network Associates\Common Framework\AgentPlugin.dll
c:\program files\Network Associates\Common Framework\Cleanup.exe
c:\program files\Network Associates\Common Framework\ClientUI.dll
c:\program files\Network Associates\Common Framework\CmdAgent.exe
c:\program files\Network Associates\Common Framework\ComponentSubSystem.dll
c:\program files\Network Associates\Common Framework\ComponentUserInterface.dll
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\Common Framework\FrmInst.exe
c:\program files\Network Associates\Common Framework\FrmPlugin.dll
c:\program files\Network Associates\Common Framework\GenEvtInf.dll
c:\program files\Network Associates\Common Framework\InternetManager.dll
c:\program files\Network Associates\Common Framework\LicWrap.dll
c:\program files\Network Associates\Common Framework\ListenServer.dll
c:\program files\Network Associates\Common Framework\Logging.dll
c:\program files\Network Associates\Common Framework\Management.dll
c:\program files\Network Associates\Common Framework\McScript.exe
c:\program files\Network Associates\Common Framework\mcurial.dll
c:\program files\Network Associates\Common Framework\naCmnLib.dll
c:\program files\Network Associates\Common Framework\nagshr32.dll
c:\program files\Network Associates\Common Framework\naicrt32.dll
c:\program files\Network Associates\Common Framework\nailog.dll
c:\program files\Network Associates\Common Framework\naInet.dll
c:\program files\Network Associates\Common Framework\naisign.dll
c:\program files\Network Associates\Common Framework\naPolicyManager.dll
c:\program files\Network Associates\Common Framework\naPrdMgr.exe
c:\program files\Network Associates\Common Framework\naSPIPE.dll
c:\program files\Network Associates\Common Framework\naXML.dll
c:\program files\Network Associates\Common Framework\nmcomn32.dll
c:\program files\Network Associates\Common Framework\patchw32.dll
c:\program files\Network Associates\Common Framework\PcrPlug.dll
c:\program files\Network Associates\Common Framework\PoEvtInf.dll
c:\program files\Network Associates\Common Framework\PSAPI.dll
c:\program files\Network Associates\Common Framework\Scheduler.dll
c:\program files\Network Associates\Common Framework\ScriptSubSys.dll
c:\program files\Network Associates\Common Framework\SecureFrameworkFactory.dll
c:\program files\Network Associates\Common Framework\unicows.dll
c:\program files\Network Associates\Common Framework\UpdaterUI.exe
c:\program files\Network Associates\Common Framework\UpdateSubSys.dll
c:\program files\Network Associates\Common Framework\UpdPlug.dll
c:\program files\Network Associates\Common Framework\UserSpace.dll
c:\program files\Network Associates\Common Framework\XMLWrap.dll
c:\program files\zaSetup_37_143.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_REPORTS_SERVICE
——-\Legacy_SERIAL_NUMBER_SERVICE_LOADED_TO_THE_DEVICE.
——-\Service_reports service
——-\Service_Serial Number Service loaded to the device.


((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
.

2009-05-06 02:28 . 2009-05-06 08:04 15360 —-a-w c:\windows\system32\scan.exe
2009-05-05 18:33 . 2009-05-05 18:33 578560 —-a-w c:\windows\system32\dllcache\user32.dll
2009-05-05 18:31 . 2009-05-05 18:32 ——– d—–w c:\windows\ERUNT
2009-05-05 18:02 . 2009-05-05 19:05 ——– d—–w C:\SDFix
2009-04-29 17:06 . 2009-04-29 17:06 ——– d—–w c:\windows\Sun
2009-04-29 17:04 . 2009-04-29 17:04 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\Karen\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-28 13:59 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-24 15:52 . 2009-04-24 15:52 33061 —-a-w c:\windows\king-uninstall.exe
2009-04-24 15:50 . 2009-04-24 15:53 ——– d—–w c:\documents and settings\Karen\Local Settings\Application Data\king.com
2009-04-22 13:45 . 2009-04-22 13:45 ——– d—–w c:\program files\Trend Micro
2009-04-22 13:39 . 2009-04-22 13:39 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2009-04-21 02:53 . 2009-04-19 07:37 16384 –sha-w c:\windows\system32\userinet.exe
2009-04-20 14:36 . 2009-04-20 14:36 1 —-a-w c:\windows\system32\0005ca37.sys
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\_Domain.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\Domain.exe
2009-04-17 01:54 . 2009-04-30 20:18 38 —-a-w c:\windows\system32\install.dat
2009-04-17 01:54 . 2009-04-17 20:15 59904 —-a-w c:\windows\system32\Windows7.exe
2009-04-16 13:39 . 2009-04-16 13:39 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-04-16 13:32 . 2009-04-16 13:32 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-15 16:46 . 2008-12-16 12:30 354304 ——w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 03:28 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 03:28 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 03:28 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 03:28 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 03:28 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 03:28 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 03:28 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 03:28 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 03:28 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 03:28 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:23 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 03:23 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 20:35 . 2006-04-25 20:38 ——– d—–w c:\program files\Symantec AntiVirus
2009-04-09 16:48 . 2003-01-14 16:55 ——– d—–w c:\program files\Java
2009-04-09 16:41 . 2002-11-10 14:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-18 13:10 . 2009-03-18 13:10 316672 —-a-w c:\windows\KingComIE.dll
2009-03-17 16:47 . 2009-03-17 16:45 ——– d—–w c:\program files\Yahoo!
2009-03-17 16:08 . 2008-07-14 17:06 24336 —-a-w c:\windows\system32\drivers\cmdhlp.sys
2009-03-17 16:08 . 2008-07-14 17:06 110992 —-a-w c:\windows\system32\drivers\cmdguard.sys
2009-03-17 16:08 . 2008-07-14 17:06 155384 —-a-w c:\windows\system32\guard32.dll
2009-03-12 19:37 . 2009-03-12 21:08 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-03-12 19:36 . 2009-03-12 19:45 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-03-12 19:28 . 2006-02-07 16:19 ——– d—–w c:\program files\Lavasoft
2009-03-12 18:18 . 2009-03-12 18:18 ——– d—–w c:\program files\CCleaner
2009-03-06 14:22 . 2003-01-14 17:54 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-12-07 22:37 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2005-04-08 21:35 78336 ——w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2001-08-18 13:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-01-14 05:33 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2001-08-18 13:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2001-08-18 13:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-02-21 00:46 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-08 00:02 . 1980-01-01 06:00 2066048 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2001-08-18 13:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 1980-01-01 06:00 2189056 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2001-08-18 13:00 35328 —-a-w c:\windows\system32\sc.exe
2006-02-02 20:29 . 2006-02-02 20:28 32803463 —-a-w c:\program files\Symantec_av_full_version_win.exe
2006-01-16 01:55 . 2006-01-16 01:55 5225384 —-a-w c:\program files\Firefox Setup 1.5.exe
2005-10-18 20:46 . 2005-10-18 20:46 4839222 —-a-w c:\program files\syncbackse_setup.exe
2005-09-09 14:44 . 2005-09-09 14:44 49634 —-a-w c:\program files\POBS Kelly grass.jpg
2005-09-09 14:43 . 2005-09-09 14:43 29226 —-a-w c:\program files\POBS Kelly rodent.jpg
2005-08-13 00:14 . 2005-08-13 00:13 9308264 —-a-w c:\program files\zlsSetup_60_631_003.exe
2005-06-28 15:37 . 2005-06-28 15:37 10808151 —-a-w c:\program files\Inkscape-0.41-1.win32.exe
2005-05-22 01:22 . 2005-05-22 01:22 32803463 —-a-w c:\program files\Symantec_av_full_version.exe
2005-05-21 18:49 . 2005-05-21 18:48 493270 —-a-w c:\program files\FastDefrag2.exe
2005-05-21 18:41 . 2005-05-21 18:41 2020143 —-a-w c:\program files\iaa23_enu.exe
2005-05-21 18:40 . 2005-05-21 18:40 122880 —-a-w c:\program files\ChipUtil.exe
2005-05-21 18:38 . 2005-05-21 18:37 861059 —-a-w c:\program files\infinst_autol.exe
2004-12-10 19:51 . 2004-12-10 19:51 6655600 —-a-w c:\program files\zlsSetup_55_062_004.exe
2004-10-10 17:27 . 2004-10-10 17:27 5827728 —-a-w c:\program files\zlsSetup_51_033_000.exe
2004-04-20 18:09 . 2004-04-20 18:09 91628 —-a-w c:\program files\r040115e.pdf
2004-04-13 17:36 . 2004-04-13 17:30 63880198 —-a-w c:\program files\qxpress61updater.zip
.

((((((((((((((((((((((((((((( SnapShot@2009-04-30_13.30.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-06 20:34 . 2009-05-06 20:34 16384 c:\windows\Temp\Perflib_Perfdata_93c.dat
+ 2001-08-18 13:00 . 2008-04-14 00:12 87352 c:\windows\SYSTEM32\ntvdvd.dll
+ 2003-01-14 17:54 . 2004-08-18 01:00 112128 c:\windows\SYSTEM32\qmgr.dll
+ 2003-01-14 17:54 . 2004-08-18 01:00 112128 c:\windows\SYSTEM32\DLLCACHE\qmgr.dll
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-05-15 245760]
"LWBKEYBOARD"="c:\program files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe" [2002-04-02 371200]
"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2004-04-26 360448]
"StatusClient 2.6"="c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 61440]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-12 163840]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-12-17 45108]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-12-17 36864]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-23 516440]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-29 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2005-6-6 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-26 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2006-1-15 307704]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [3/12/2009 2:45 PM 64160]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\SYSTEM32\DRIVERS\cmdguard.sys [7/14/2008 12:06 PM 110992]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\SYSTEM32\DRIVERS\cmdhlp.sys [7/14/2008 12:06 PM 24336]
R2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;c:\program files\PowerQuest\DataKeeper\PqFsmonNt.sys [4/26/2005 1:33 PM 49096]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 1:27 PM 169200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 11:20 AM 101936]
S2 DmPnSN;Portable Meda Number Service;c:\windows\SYSTEM32\userinet.exe [4/20/2009 9:53 PM 16384]
S2 Domain;Domain Name Service;c:\program files\Domain.exe [4/16/2009 9:20 PM 833024]
S2 MediaPlayer Serial;Portable MediaPlayer Serial Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSerial;Portable Media Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSoftware;MediaSoftware Control Center ;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 4:34 PM 953168]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10741

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinErp REG_MULTI_SZ WinErp
winErs REG_MULTI_SZ winErs
.
Contents of the 'Scheduled Tasks' folder

2009-05-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:46]

2009-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-McAfeeUpdaterUI - c:\program files\Network Associates\Common Framework\UpdaterUI.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sirius.com/siriusinternetradio
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: {8269D2D1-06DF-4530-A7A8-FED624009ACE} = 129.15.1.120,129.15.1.121
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\q8zn4sem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 15:35
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(832)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(2340)
c:\windows\system32\guard32.dll
c:\program files\Browser MOUSE\MOUDL32A.DLL
.
———————— Other Running Processes ————————
.
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
c:\program files\Symantec AntiVirus\DoScan.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SYSTEM32\mstsc.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\wanmpsvc.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\windows\SYSTEM32\CALC.EXE
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-06 15:40 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-06 20:40
ComboFix2.txt 2009-05-06 16:22
ComboFix3.txt 2009-05-06 13:31
ComboFix4.txt 2009-05-05 15:53
ComboFix5.txt 2009-05-06 20:27

Pre-Run: 34,833,444,864 bytes free
Post-Run: 34,795,257,856 bytes free

318 — E O F — 2009-04-29 17:01


——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Thursday, May 7, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, May 07, 2009 17:00:18
Records in database: 2143249
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 89759
Threat name: 18
Infected objects: 165
Suspicious objects: 44
Duration of the scan: 02:18:32


File name / Threat name / Threats count
c:\windows\system32\romftoc.dll/c:\windows\system32\romftoc.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\default\exxk4or2.slt\Mail\pop.ou-1.edu\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 8
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\default\exxk4or2.slt\Mail\pop.ou-1.edu\Junk Infected: Trojan-Spy.HTML.Paylap.dl 1
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\default\exxk4or2.slt\Mail\pop.ou-1.edu\Junk Infected: Trojan-Spy.HTML.Paylap.m 1
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\default\exxk4or2.slt\Mail\pop.ou-1.edu\Trash Suspicious: Trojan-Spy.HTML.Fraud.gen 5
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou-1.edu\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 8
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou-1.edu\Junk Infected: Trojan-Spy.HTML.Paylap.dl 1
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou-1.edu\Junk Infected: Trojan-Spy.HTML.Paylap.m 1
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou-1.edu\Trash Suspicious: Trojan-Spy.HTML.Fraud.gen 5
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 8
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Junk Infected: Trojan-Spy.HTML.Paylap.dl 1
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Junk Infected: Trojan-Spy.HTML.Paylap.m 1
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Trash Suspicious: Trojan-Spy.HTML.Fraud.gen 10
C:\Documents and Settings\Karen\Application Data\Mozilla\Profiles\Default User\i5062m12.slt\Mail\pop.ou.edu\Trash Infected: Trojan-Spy.HTML.Paylap.m 1
C:\Documents and Settings\Karen\Desktop\ATF-Cleaner.exe Infected: Worm.Win32.AutoRun.ahuy 1
C:\Program Files\Symantec AntiVirus\cte.exe Infected: Backdoor.Win32.Hupigon.gqbd 1
C:\Qoobox\Quarantine\C\Program Files\Common Files\wen1.exe.vir Infected: Trojan.Win32.AntiAV.bge 1
C:\Qoobox\Quarantine\C\Program Files\Common Files\wen4.exe.vir Infected: Trojan.Win32.Buzus.axee 1
C:\Qoobox\Quarantine\C\Program Files\Common Files\wena.exe.vir Infected: Trojan.Win32.AntiAV.bdv 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RambtsC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RbmytjC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RcmltgC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RcmntqC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RcmttmC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RcmxtoC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RdmgtlC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RemftiC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RemntiC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RemxtqC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RfmitpC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RfmutrC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RgmjtsC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RgmvtwC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RhmcttC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RimdtiC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RimftsC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RimttcC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RjmgtpC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RjmothC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RkmhtkC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RlmqtvC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RmmhtcC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RnmctjC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RnmktpC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RnmmtdC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RnmutjC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RnmwthC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RombtwC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RomttwC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RpmqttC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RpmwtxC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RrmitlC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RsmftoC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RsmhtcC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RsmrtwC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RsmvtoC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RtmyttC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RvmotdC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RwmntgC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RwmntqC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RwmtteC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RwmvtoC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RymntkC.dll.vir Infected: Backdoor.Win32.Agent.afxc 1
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\RymxteC.dll.vir Infected: Backdoor.Win32.Agent.agdw 1
C:\Qoobox\Quarantine\[4]-Submit_2009-05-06_08.21.32.zip Infected: Backdoor.Win32.Agent.agdw 30
C:\Qoobox\Quarantine\[4]-Submit_2009-05-06_08.21.32.zip Infected: Backdoor.Win32.Agent.afxc 15
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1364\A0282081.exe Infected: Backdoor.Win32.Hupigon.bmfk 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1365\A0282183.exe Infected: Backdoor.Win32.PcClient.ajcc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1367\A0282318.exe Infected: not-a-virus:NetTool.Win32.TCPScan.a 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1368\A0282349.exe Infected: not-a-virus:NetTool.Win32.TCPScan.a 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1371\A0282580.exe Infected: not-a-virus:NetTool.Win32.TCPScan.a 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1371\A0282581.exe Infected: HackTool.Win32.Agent.nd 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1376\A0282822.exe Infected: Trojan.Win32.AntiAV.bbp 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1376\A0282986.dll Infected: Trojan.Win32.AntiAV.bel 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283276.exe Infected: Trojan.Win32.AntiAV.bge 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283277.exe Infected: Trojan.Win32.Buzus.axee 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283278.exe Infected: Trojan.Win32.AntiAV.bdv 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283637.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283642.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283645.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283646.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283648.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283649.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283650.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283653.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283654.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283655.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283656.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283657.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283659.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283661.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283662.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283664.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283665.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283667.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283668.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283669.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283671.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283675.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283676.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283679.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283680.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283681.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283682.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283683.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283684.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283687.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283689.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283690.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283692.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283697.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283698.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283699.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283701.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283703.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283705.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283707.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283708.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283710.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283711.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283717.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\System Volume Information\_restore{E87A81FB-FDCF-4B92-A20C-951710F82D7C}\RP1378\A0283718.dll Infected: Backdoor.Win32.Agent.agdw 1
C:\WINDOWS\SYSTEM32\ctvhcst.exe _k vetvcs Infected: Backdoor.Win32.Hupigon.gqbd 1
C:\WINDOWS\SYSTEM32\DLLCACHE\qmgr.dll Infected: Trojan.Win32.AntiAV.bie 1
C:\WINDOWS\SYSTEM32\ntvdvd.dll Infected: not-a-virus:NetTool.Win32.ZXProxy.a 1
C:\WINDOWS\SYSTEM32\qmgr.dll Infected: Trojan.Win32.AntiAV.bie 1
C:\WINDOWS\SYSTEM32\RomftoC.dll Infected: Backdoor.Win32.Agent.afxc 1
C:\WINDOWS\SYSTEM32\scan.exe Infected: not-a-virus:NetTool.Win32.TCPScan.a 1

The selected area was scanned.

I'm really sorry. I swear I sent a reply on Friday. I was just waiting for the e-mail saying you replied again. I apparently got everything ready to run and got side-tracked. Either way here is the next CF log.


ComboFix 09-05-05.05 - Karen 05/11/2009 9:16.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.580 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karen\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
FW: COMODO Firewall *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\documents and settings\Karen\Desktop\ATF-Cleaner.exe
c:\program files\Symantec AntiVirus\cte.exe
c:\windows\SYSTEM32\ctvhcst.exe
c:\windows\SYSTEM32\DLLCACHE\qmgr.dll
c:\windows\SYSTEM32\ntvdvd.dll
c:\windows\SYSTEM32\qmgr.dll
c:\windows\SYSTEM32\RomftoC.dll
c:\windows\SYSTEM32\scan.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Karen\Desktop\ATF-Cleaner.exe
c:\program files\Symantec AntiVirus\cte.exe
c:\windows\SYSTEM32\DLLCACHE\qmgr.dll
c:\windows\SYSTEM32\ntvdvd.dll
c:\windows\SYSTEM32\qmgr.dll
c:\windows\SYSTEM32\RomftoC.dll
c:\windows\SYSTEM32\scan.exe

.
((((((((((((((((((((((((( Files Created from 2009-04-11 to 2009-05-11 )))))))))))))))))))))))))))))))
.

2009-05-07 15:15 . 2009-05-07 15:15 ——– d—–w c:\program files\Common Files\Adobe AIR
2009-05-07 14:09 . 2009-05-07 14:50 ——– d—–w c:\documents and settings\All Users\Application Data\NOS
2009-05-07 14:09 . 2009-05-07 14:09 ——– d—–w c:\program files\NOS
2009-05-07 06:13 . 2009-05-07 06:13 96968 —-a-w c:\windows\system32\Down(1).exe
2009-05-05 18:33 . 2009-05-05 18:33 578560 —-a-w c:\windows\system32\dllcache\user32.dll
2009-05-05 18:31 . 2009-05-05 18:32 ——– d—–w c:\windows\ERUNT
2009-05-05 18:02 . 2009-05-05 19:05 ——– d—–w C:\SDFix
2009-04-29 17:06 . 2009-04-29 17:06 ——– d—–w c:\windows\Sun
2009-04-29 17:04 . 2009-04-29 17:04 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\Karen\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-28 13:59 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-24 15:52 . 2009-04-24 15:52 33061 —-a-w c:\windows\king-uninstall.exe
2009-04-24 15:50 . 2009-04-24 15:53 ——– d—–w c:\documents and settings\Karen\Local Settings\Application Data\king.com
2009-04-22 13:45 . 2009-04-22 13:45 ——– d—–w c:\program files\Trend Micro
2009-04-22 13:39 . 2009-04-22 13:39 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2009-04-21 02:53 . 2009-04-19 07:37 16384 –sha-w c:\windows\system32\userinet.exe
2009-04-20 14:36 . 2009-04-20 14:36 1 —-a-w c:\windows\system32\0005ca37.sys
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\_Domain.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\Domain.exe
2009-04-17 01:54 . 2009-04-30 20:18 38 —-a-w c:\windows\system32\install.dat
2009-04-17 01:54 . 2009-04-17 20:15 59904 —-a-w c:\windows\system32\Windows7.exe
2009-04-16 13:39 . 2009-04-16 13:39 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-04-16 13:32 . 2009-04-16 13:32 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-15 16:46 . 2008-12-16 12:30 354304 ——w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 03:28 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 03:28 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 03:28 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 03:28 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 03:28 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 03:28 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 03:28 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 03:28 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 03:28 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 03:28 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:23 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 03:23 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-11 14:23 . 2006-04-25 20:38 ——– d—–w c:\program files\Symantec AntiVirus
2009-05-07 17:57 . 2009-05-07 17:57 6144 –sha-w c:\program files\Thumbs.db
2009-05-07 15:13 . 2003-01-16 20:18 ——– d—–w c:\program files\Common Files\Adobe
2009-04-09 16:48 . 2003-01-14 16:55 ——– d—–w c:\program files\Java
2009-04-09 16:41 . 2002-11-10 14:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-18 13:10 . 2009-03-18 13:10 316672 —-a-w c:\windows\KingComIE.dll
2009-03-17 16:47 . 2009-03-17 16:45 ——– d—–w c:\program files\Yahoo!
2009-03-17 16:08 . 2008-07-14 17:06 24336 —-a-w c:\windows\system32\drivers\cmdhlp.sys
2009-03-17 16:08 . 2008-07-14 17:06 110992 —-a-w c:\windows\system32\drivers\cmdguard.sys
2009-03-17 16:08 . 2008-07-14 17:06 155384 —-a-w c:\windows\system32\guard32.dll
2009-03-12 19:37 . 2009-03-12 21:08 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-03-12 19:36 . 2009-03-12 19:45 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-03-12 19:28 . 2006-02-07 16:19 ——– d—–w c:\program files\Lavasoft
2009-03-12 18:18 . 2009-03-12 18:18 ——– d—–w c:\program files\CCleaner
2009-03-06 14:22 . 2003-01-14 17:54 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-12-07 22:37 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2005-04-08 21:35 78336 ——w c:\windows\system32\ieencode.dll
2006-02-02 20:29 . 2006-02-02 20:28 32803463 —-a-w c:\program files\Symantec_av_full_version_win.exe
2006-01-16 01:55 . 2006-01-16 01:55 5225384 —-a-w c:\program files\Firefox Setup 1.5.exe
2005-10-18 20:46 . 2005-10-18 20:46 4839222 —-a-w c:\program files\syncbackse_setup.exe
2005-09-09 14:44 . 2005-09-09 14:44 49634 —-a-w c:\program files\POBS Kelly grass.jpg
2005-09-09 14:43 . 2005-09-09 14:43 29226 —-a-w c:\program files\POBS Kelly rodent.jpg
2005-08-13 00:14 . 2005-08-13 00:13 9308264 —-a-w c:\program files\zlsSetup_60_631_003.exe
2005-06-28 15:37 . 2005-06-28 15:37 10808151 —-a-w c:\program files\Inkscape-0.41-1.win32.exe
2005-05-22 01:22 . 2005-05-22 01:22 32803463 —-a-w c:\program files\Symantec_av_full_version.exe
2005-05-21 18:49 . 2005-05-21 18:48 493270 —-a-w c:\program files\FastDefrag2.exe
2005-05-21 18:41 . 2005-05-21 18:41 2020143 —-a-w c:\program files\iaa23_enu.exe
2005-05-21 18:40 . 2005-05-21 18:40 122880 —-a-w c:\program files\ChipUtil.exe
2005-05-21 18:38 . 2005-05-21 18:37 861059 —-a-w c:\program files\infinst_autol.exe
2004-12-10 19:51 . 2004-12-10 19:51 6655600 —-a-w c:\program files\zlsSetup_55_062_004.exe
2004-10-10 17:27 . 2004-10-10 17:27 5827728 —-a-w c:\program files\zlsSetup_51_033_000.exe
2004-04-20 18:09 . 2004-04-20 18:09 91628 —-a-w c:\program files\r040115e.pdf
2004-04-13 17:36 . 2004-04-13 17:30 63880198 —-a-w c:\program files\qxpress61updater.zip
.

((((((((((((((((((((((((((((( SnapShot@2009-04-30_13.30.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-11 14:22 . 2009-05-11 14:22 16384 c:\windows\Temp\Perflib_Perfdata_978.dat
+ 2009-05-07 15:18 . 2009-05-07 15:18 295606 c:\windows\Installer\{AC76BA86-7AD7-5464-3428-900000000004}\ARPPRODUCTICON.exe
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-05-15 245760]
"LWBKEYBOARD"="c:\program files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe" [2002-04-02 371200]
"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2004-04-26 360448]
"StatusClient 2.6"="c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 61440]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-12 163840]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-12-17 45108]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-12-17 36864]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-23 516440]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-29 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2005-6-6 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-26 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2006-1-15 307704]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [3/12/2009 2:45 PM 64160]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\SYSTEM32\DRIVERS\cmdguard.sys [7/14/2008 12:06 PM 110992]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\SYSTEM32\DRIVERS\cmdhlp.sys [7/14/2008 12:06 PM 24336]
R2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;c:\program files\PowerQuest\DataKeeper\PqFsmonNt.sys [4/26/2005 1:33 PM 49096]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 1:27 PM 169200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 11:20 AM 101936]
S2 DmPnSN;Portable Meda Number Service;c:\windows\SYSTEM32\userinet.exe [4/20/2009 9:53 PM 16384]
S2 Domain;Domain Name Service;c:\program files\Domain.exe [4/16/2009 9:20 PM 833024]
S2 MediaPlayer Serial;Portable MediaPlayer Serial Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSerial;Portable Media Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSoftware;MediaSoftware Control Center ;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [5/7/2009 9:09 AM 33176]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 4:34 PM 953168]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10741

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinErp REG_MULTI_SZ WinErp
winErs REG_MULTI_SZ winErs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
FastUserSwitchingCompatibility
HidServ
LanmanServer
LanmanWorkstation
Messenger
Nla
NWCWorkstation
Schedule
Seclogon
SRService
Themes
TrkWks
W32Time
Wmi
WmdmPmSp
winmgmt
TermService
wuauserv
BITS
ShellHWDetection
helpsvc
xmlprov
wscsvc
napagent
hkmsvc
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:46]

2009-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sirius.com/siriusinternetradio
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: {8269D2D1-06DF-4530-A7A8-FED624009ACE} = 129.15.1.120,129.15.1.121
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\q8zn4sem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-11 09:23
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(832)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(1020)
c:\windows\system32\guard32.dll
c:\program files\Browser MOUSE\MOUDL32A.DLL
.
———————— Other Running Processes ————————
.
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SYSTEM32\mstsc.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\wanmpsvc.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\windows\SYSTEM32\CALC.EXE
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-11 9:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-11 14:38
ComboFix2.txt 2009-05-06 20:41
ComboFix3.txt 2009-05-06 16:22
ComboFix4.txt 2009-05-06 13:31
ComboFix5.txt 2009-05-11 14:15

Pre-Run: 34,109,956,096 bytes free
Post-Run: 34,159,448,064 bytes free

289 — E O F — 2009-04-29 17:01

ComboFix 09-05-10.07 - Karen 05/11/2009 11:02.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.547 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karen\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
FW: COMODO Firewall *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\system32\Down(1).exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Down(1).exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MEDIAPLAYER_SERIAL
——-\Service_MediaPlayer Serial


((((((((((((((((((((((((( Files Created from 2009-04-11 to 2009-05-11 )))))))))))))))))))))))))))))))
.

2009-05-07 15:15 . 2009-05-07 15:15 ——– d—–w c:\program files\Common Files\Adobe AIR
2009-05-07 14:09 . 2009-05-07 14:50 ——– d—–w c:\documents and settings\All Users\Application Data\NOS
2009-05-07 14:09 . 2009-05-07 14:09 ——– d—–w c:\program files\NOS
2009-05-05 18:33 . 2009-05-05 18:33 578560 —-a-w c:\windows\system32\dllcache\user32.dll
2009-05-05 18:31 . 2009-05-05 18:32 ——– d—–w c:\windows\ERUNT
2009-05-05 18:02 . 2009-05-05 19:05 ——– d—–w C:\SDFix
2009-04-29 17:06 . 2009-04-29 17:06 ——– d—–w c:\windows\Sun
2009-04-29 17:04 . 2009-04-29 17:04 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\Karen\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-28 13:59 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-28 13:59 . 2009-04-28 13:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-24 15:52 . 2009-04-24 15:52 33061 —-a-w c:\windows\king-uninstall.exe
2009-04-24 15:50 . 2009-04-24 15:53 ——– d—–w c:\documents and settings\Karen\Local Settings\Application Data\king.com
2009-04-22 13:45 . 2009-04-22 13:45 ——– d—–w c:\program files\Trend Micro
2009-04-22 13:39 . 2009-04-22 13:39 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
2009-04-21 02:53 . 2009-04-19 07:37 16384 –sha-w c:\windows\system32\userinet.exe
2009-04-20 14:36 . 2009-04-20 14:36 1 —-a-w c:\windows\system32\0005ca37.sys
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\_Domain.exe
2009-04-17 02:20 . 2009-04-17 02:20 833024 –sh–w c:\program files\Domain.exe
2009-04-17 01:54 . 2009-04-30 20:18 38 —-a-w c:\windows\system32\install.dat
2009-04-17 01:54 . 2009-04-17 20:15 59904 —-a-w c:\windows\system32\Windows7.exe
2009-04-16 13:39 . 2009-04-16 13:39 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-04-16 13:32 . 2009-04-16 13:32 ——– d—–w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-15 16:46 . 2008-12-16 12:30 354304 ——w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 03:28 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 03:28 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 03:28 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 03:28 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 03:28 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 03:28 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 03:28 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 03:28 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 03:28 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 03:28 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:23 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 03:23 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-11 16:09 . 2006-04-25 20:38 ——– d—–w c:\program files\Symantec AntiVirus
2009-05-07 17:57 . 2009-05-07 17:57 6144 –sha-w c:\program files\Thumbs.db
2009-05-07 15:13 . 2003-01-16 20:18 ——– d—–w c:\program files\Common Files\Adobe
2009-04-09 16:48 . 2003-01-14 16:55 ——– d—–w c:\program files\Java
2009-04-09 16:41 . 2002-11-10 14:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-18 13:10 . 2009-03-18 13:10 316672 —-a-w c:\windows\KingComIE.dll
2009-03-17 16:47 . 2009-03-17 16:45 ——– d—–w c:\program files\Yahoo!
2009-03-17 16:08 . 2008-07-14 17:06 24336 —-a-w c:\windows\system32\drivers\cmdhlp.sys
2009-03-17 16:08 . 2008-07-14 17:06 110992 —-a-w c:\windows\system32\drivers\cmdguard.sys
2009-03-17 16:08 . 2008-07-14 17:06 155384 —-a-w c:\windows\system32\guard32.dll
2009-03-12 19:37 . 2009-03-12 21:08 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-03-12 19:36 . 2009-03-12 19:45 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-03-12 19:28 . 2006-02-07 16:19 ——– d—–w c:\program files\Lavasoft
2009-03-12 18:18 . 2009-03-12 18:18 ——– d—–w c:\program files\CCleaner
2009-03-06 14:22 . 2003-01-14 17:54 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-12-07 22:37 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2005-04-08 21:35 78336 ——w c:\windows\system32\ieencode.dll
2006-02-02 20:29 . 2006-02-02 20:28 32803463 —-a-w c:\program files\Symantec_av_full_version_win.exe
2006-01-16 01:55 . 2006-01-16 01:55 5225384 —-a-w c:\program files\Firefox Setup 1.5.exe
2005-10-18 20:46 . 2005-10-18 20:46 4839222 —-a-w c:\program files\syncbackse_setup.exe
2005-09-09 14:44 . 2005-09-09 14:44 49634 —-a-w c:\program files\POBS Kelly grass.jpg
2005-09-09 14:43 . 2005-09-09 14:43 29226 —-a-w c:\program files\POBS Kelly rodent.jpg
2005-08-13 00:14 . 2005-08-13 00:13 9308264 —-a-w c:\program files\zlsSetup_60_631_003.exe
2005-06-28 15:37 . 2005-06-28 15:37 10808151 —-a-w c:\program files\Inkscape-0.41-1.win32.exe
2005-05-22 01:22 . 2005-05-22 01:22 32803463 —-a-w c:\program files\Symantec_av_full_version.exe
2005-05-21 18:49 . 2005-05-21 18:48 493270 —-a-w c:\program files\FastDefrag2.exe
2005-05-21 18:41 . 2005-05-21 18:41 2020143 —-a-w c:\program files\iaa23_enu.exe
2005-05-21 18:40 . 2005-05-21 18:40 122880 —-a-w c:\program files\ChipUtil.exe
2005-05-21 18:38 . 2005-05-21 18:37 861059 —-a-w c:\program files\infinst_autol.exe
2004-12-10 19:51 . 2004-12-10 19:51 6655600 —-a-w c:\program files\zlsSetup_55_062_004.exe
2004-10-10 17:27 . 2004-10-10 17:27 5827728 —-a-w c:\program files\zlsSetup_51_033_000.exe
2004-04-20 18:09 . 2004-04-20 18:09 91628 —-a-w c:\program files\r040115e.pdf
2004-04-13 17:36 . 2004-04-13 17:30 63880198 —-a-w c:\program files\qxpress61updater.zip
.

((((((((((((((((((((((((((((( SnapShot@2009-04-30_13.30.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-11 16:07 . 2009-05-11 16:07 16384 c:\windows\Temp\Perflib_Perfdata_960.dat
+ 2009-05-07 15:18 . 2009-05-07 15:18 295606 c:\windows\Installer\{AC76BA86-7AD7-5464-3428-900000000004}\ARPPRODUCTICON.exe
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 458752 c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2009-05-05 18:32 . 2008-08-07 20:27 163328 c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2009-05-05 18:32 . 2009-05-05 18:32 5517312 c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-05-15 245760]
"LWBKEYBOARD"="c:\program files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe" [2002-04-02 371200]
"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2004-04-26 360448]
"StatusClient 2.6"="c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 61440]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-12 163840]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-12-17 45108]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-12-17 36864]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-23 516440]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-17 1851128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-29 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2005-6-6 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-1-26 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2006-1-15 307704]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [3/12/2009 2:45 PM 64160]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\SYSTEM32\DRIVERS\cmdguard.sys [7/14/2008 12:06 PM 110992]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\SYSTEM32\DRIVERS\cmdhlp.sys [7/14/2008 12:06 PM 24336]
R2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;c:\program files\PowerQuest\DataKeeper\PqFsmonNt.sys [4/26/2005 1:33 PM 49096]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 1:27 PM 169200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 11:20 AM 101936]
S2 DmPnSN;Portable Meda Number Service;c:\windows\SYSTEM32\userinet.exe [4/20/2009 9:53 PM 16384]
S2 Domain;Domain Name Service;c:\program files\Domain.exe [4/16/2009 9:20 PM 833024]
S2 MediaSerial;Portable Media Number;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S2 MediaSoftware;MediaSoftware Control Center ;c:\windows\System32\svchost.exe -k krnlsrvc [8/18/2001 8:00 AM 14336]
S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [5/7/2009 9:09 AM 33176]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 4:34 PM 953168]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10741

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinErp REG_MULTI_SZ WinErp
winErs REG_MULTI_SZ winErs
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 19:46]

2009-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sirius.com/siriusinternetradio
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: {8269D2D1-06DF-4530-A7A8-FED624009ACE} = 129.15.1.120,129.15.1.121
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\q8zn4sem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-11 11:09
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(832)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(2172)
c:\windows\system32\guard32.dll
c:\program files\Browser MOUSE\MOUDL32A.DLL
.
———————— Other Running Processes ————————
.
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
c:\program files\Symantec AntiVirus\DoScan.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SYSTEM32\mstsc.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\wanmpsvc.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\windows\SYSTEM32\CALC.EXE
c:\windows\SYSTEM32\wscntfy.exe
c:\program files\COMODO\Firewall\cfpupdat.exe
.
**************************************************************************
.
Completion time: 2009-05-11 11:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-11 16:14
ComboFix2.txt 2009-05-11 14:38
ComboFix3.txt 2009-05-06 20:41
ComboFix4.txt 2009-05-06 16:22
ComboFix5.txt 2009-05-11 16:01

Pre-Run: 34,159,800,320 bytes free
Post-Run: 34,140,164,096 bytes free

256 — E O F — 2009-04-29 17:01