[Closed] FakeAlert Trojan Problem

hello
got the fake alert trojan….i ran atf cleaner and antimalwarebytes. it said it cleaned it sucessfully, but i cannot shut down my system without the profile storage program from the trojan trying to run. please help

here are my logs:

Malwarebytes' Anti-Malware 1.19
Database version: 904
Windows 5.1.2600 Service Pack 3

6:44:16 PM 5/26/2009
mbam-log-5-26-2009 (18-44-16).txt

Scan type: Quick Scan
Objects scanned: 39767
Time elapsed: 9 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\sysguard.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:57:59 PM, on 5/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\FortiSslvpnDaemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\proquota.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\tp4serv.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: ::1 localhost
O1 - Hosts: 94.232.248.66 browser-security.microsoft.com
O1 - Hosts: 94.232.248.66 antivaresys.com
O1 - Hosts: 94.232.248.66 www.antivaresys.com
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 2Wire Wireless Client Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www-307.ibm.com
O15 - Trusted Zone: dps1.travelocity.com
O15 - Trusted Zone: svc.travelocity.com
O15 - Trusted Zone: www.travelocity.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1123815965322
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www-3.ibm.com/pc/support/access/asl…nt/IbmEgath.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://mail.flynngaskins.com/tsweb/msrdp.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} (Image Uploader Control) - http://www.ritzpix.com/NET/Uploader/LPUploader57.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} (acpRunner Class) - https://www-3.ibm.com/pc/support/access/asl…/AcpControl.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FortiSslvpnDaemon - Fortinet Inc. - C:\WINDOWS\system32\FortiSslvpnDaemon.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 9683 bytes


thank you for your help!!!!

i ran dds. here is the new log: DDS (Ver_09-05-14.01) - FAT32x86 Run by [removed] at 19:04:02.35 on Wed 05/27/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.767.444 [GMT -5:00] AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} ============== Running Processes =============== C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32\FortiSslvpnDaemon.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\proquota.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\tp4serv.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [TrackPointSrv] tp4serv.exe mRun: [ATIModeChange] Ati2mdxx.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [TPHOTKEY] c:\progra~1\thinkpad\pkgmgr\hotkey\TPHKMGR.exe mRun: [BMMGAG] RunDll32 c:\progra~1\thinkpad\utilit~1\pwrmonit.dll,StartPwrMonitor mRun: [BMMLREF] c:\program files\thinkpad\utilities\BMMLREF.EXE mRun: [BMMMONWND] rundll32.exe c:\progra~1\thinkpad\utilit~1\BatInfEx.dll,BMMAutonomicMonitor mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.5.0_09\bin\jusched.exe" mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe" mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\2wirew~1.lnk - c:\program files\2wire wireless\client manager\CMTWO.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe uPolicies-system: EnableProfileQuota = 1 (0x1) IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Trusted Zone: ibm.com\www-307 Trusted Zone: travelocity.com\dps1 Trusted Zone: travelocity.com\svc Trusted Zone: travelocity.com\www DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123815965322 DPF: {74FFE28D-2378-11D5-990C-006094235084} - hxxps://www-3.ibm.com/pc/support/access/aslibmain/content/IbmEgath.cab DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://mail.flynngaskins.com/tsweb/msrdp.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} - hxxp://www.systemrequirementslab.com/sysreqlab.cab DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://www.ritzpix.com/NET/Uploader/LPUploader57.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} - hxxp://www.live365.com/players/play365.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} - hxxps://www-3.ibm.com/pc/support/access/aslibmain/content/AcpControl.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll Notify: NavLogon - c:\windows\system32\NavLogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll, ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\p94ef0hc.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ ============= SERVICES / DRIVERS =============== R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-5-26 28544] R1 DSMBATT;DSMBATT;c:\windows\system32\drivers\DSMBATT.SYS [2004-9-25 9888] R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2005-12-19 337592] R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2005-12-19 54968] R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [2004-9-25 16384] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-3-24 192160] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-3-24 169632] R2 FortiSslvpnDaemon;FortiSslvpnDaemon;c:\windows\system32\FortiSslvpnDaemon.exe [2009-3-17 510496] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-1-10 24652] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2006-9-12 106808] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20070614.017\naveng.sys [2007-6-14 77688] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20070614.017\navex15.sys [2007-6-14 852824] R3 pppop;PPPoP WAN Adapter;c:\windows\system32\drivers\pppop.sys [2008-10-10 36384] R3 Tp4Track;IBM PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [2004-8-4 13904] R3 wltwo48b;2Wire Wireless PC Card Driver;c:\windows\system32\drivers\wltwo48b.sys [2002-10-21 156160] S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-6-15 115952] S3 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-6-15 1805552] ============== File Associations =============== regfile=regedit.exe "%1" %* scrfile="%1" %* =============== Created Last 30 ================ 2009-05-26 21:41 687,104 a——- c:\windows\isRS-000.tmp 2009-05-26 21:41 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-05-26 18:57 –d—– c:\program files\Trend Micro 2009-05-26 18:48 28,544 a——- c:\windows\system32\drivers\pavboot.sys 2009-05-26 18:48 –d—– c:\program files\Panda Security 2009-05-26 18:07 –dsh— C:\FOUND.010 2009-05-02 19:09 1,089,593 ——– c:\windows\system32\dllcache\ntprint.cat 2009-05-02 10:13 2,052 a——- c:\windows\system\MIFLHR.DRV 2009-05-02 10:13 –d—– c:\program files\Linktivity 2009-05-02 10:12 –d—– c:\temp\LinktivityPresenter 2009-05-02 10:12 –d—– C:\temp 2009-05-02 09:35 –d—– C:\Boon Jin 2009-05-02 09:00 –d—– C:\da03a9f1718ddfc974e79a 2009-05-02 08:59 –d—– c:\windows\SxsCaPendDel 2009-05-01 22:26 12 a——- c:\windows\bthservsdp.dat 2009-05-01 21:43 –d—– c:\windows\system32\XPSViewer 2009-05-01 21:41 14,048 ——– c:\windows\system32\spmsg2.dll 2009-05-01 21:21 –d—– C:\wiimoteconnect ==================== Find3M ==================== 2009-05-26 13:19 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-05-05 11:16 29,280 a——- c:\docume~1\admini~1\applic~1\GDIPFONTCACHEV1.DAT 2009-03-21 09:06 989,696 ——– c:\windows\system32\dllcache\kernel32.dll 2009-03-10 22:18 934,792 ——– c:\windows\system32\dllcache\WgaTray.exe 2009-03-10 22:18 239,496 ——– c:\windows\system32\dllcache\wgaLogon.dll 2009-03-09 15:01 36,384 a——- c:\windows\system32\pppop.sys 2009-03-09 15:01 510,496 a——- c:\windows\system32\FortiSslvpnDaemon.exe 2009-03-09 15:01 510,496 a——- c:\windows\FortiSSLVPNd.exe 2009-03-06 09:22 284,160 a——- c:\windows\system32\pdh.dll 2009-03-06 09:22 284,160 ——– c:\windows\system32\dllcache\pdh.dll 2009-03-02 19:18 826,368 a——- c:\windows\system32\wininet.dll 2009-03-02 19:18 826,368 a——- c:\windows\system32\dllcache\wininet.dll 2009-02-27 23:54 636,072 ——– c:\windows\system32\dllcache\iexplore.exe 2008-09-22 17:53 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008092220080923\index.dat ============= FINISH: 19:04:58.25 ===============

i received a trojan the other day that malwarebytes deleted with a quick scan. now, there is this red circle in my system tray with a big white 'X'. it says that i have exceeded my profile space by several gb. it will not let me log off the computer. it says that i need to move items from my profile to local or network storage. i dont use profiles on my computer (that i know of). here are my logs: Malwarebytes' Anti-Malware 1.37 Database version: 2194 Windows 5.1.2600 Service Pack 3 5/29/2009 6:57:06 PM mbam-log-2009-05-29 (18-56-57).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 150194 Time elapsed: 1 hour(s), 3 minute(s), 56 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> No action taken. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\program files\real alternative\settings.exe (Rogue.Installer) -> No action taken. c:\program files\real alternative\mpclauncher.exe (Rogue.Installer) -> No action taken. c:\FOUND.010\FILE0005.CHK (Trojan.Agent) -> No action taken. DDS (Ver_09-05-14.01) - FAT32x86 Run by [removed] at 17:48:20.90 on Fri 05/29/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.767.448 [GMT -5:00] AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} ============== Running Processes =============== C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\svchost -k DcomLaunch SVCHOST.EXE C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup SVCHOST.EXE SVCHOST.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe SVCHOST.EXE C:\WINDOWS\system32\Ati2evxx.exe SVCHOST.EXE C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32\FortiSslvpnDaemon.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\proquota.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\tp4serv.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe C:\Documents and Settings\Administrator\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [TrackPointSrv] tp4serv.exe mRun: [ATIModeChange] Ati2mdxx.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [TPHOTKEY] c:\progra~1\thinkpad\pkgmgr\hotkey\TPHKMGR.exe mRun: [BMMGAG] RunDll32 c:\progra~1\thinkpad\utilit~1\pwrmonit.dll,StartPwrMonitor mRun: [BMMLREF] c:\program files\thinkpad\utilities\BMMLREF.EXE mRun: [BMMMONWND] rundll32.exe c:\progra~1\thinkpad\utilit~1\BatInfEx.dll,BMMAutonomicMonitor mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.5.0_09\bin\jusched.exe" mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe" mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\2wirew~1.lnk - c:\program files\2wire wireless\client manager\CMTWO.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe uPolicies-system: EnableProfileQuota = 1 (0x1) IE: &Download; by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201 IE: &Grab; video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204 IE: Do&wnload; selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203 IE: Down&load; all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202 IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Trusted Zone: ibm.com\www-307 Trusted Zone: travelocity.com\dps1 Trusted Zone: travelocity.com\svc Trusted Zone: travelocity.com\www DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123815965322 DPF: {74FFE28D-2378-11D5-990C-006094235084} - hxxps://www-3.ibm.com/pc/support/access/aslibmain/content/IbmEgath.cab DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://mail.flynngaskins.com/tsweb/msrdp.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} - hxxp://www.systemrequirementslab.com/sysreqlab.cab DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://www.ritzpix.com/NET/Uploader/LPUploader57.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} - hxxp://www.live365.com/players/play365.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} - hxxps://www-3.ibm.com/pc/support/access/aslibmain/content/AcpControl.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll Notify: NavLogon - c:\windows\system32\NavLogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll, ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\p94ef0hc.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ ============= SERVICES / DRIVERS =============== R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-5-26 28544] R1 DSMBATT;DSMBATT;c:\windows\system32\drivers\DSMBATT.SYS [2004-9-25 9888] R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2005-12-19 337592] R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2005-12-19 54968] R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [2004-9-25 16384] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-3-24 192160] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-3-24 169632] R2 FortiSslvpnDaemon;FortiSslvpnDaemon;c:\windows\system32\FortiSslvpnDaemon.exe [2009-3-17 510496] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-1-10 24652] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2006-9-12 106808] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20070614.017\naveng.sys [2007-6-14 77688] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20070614.017\navex15.sys [2007-6-14 852824] R3 pppop;PPPoP WAN Adapter;c:\windows\system32\drivers\pppop.sys [2008-10-10 36384] R3 Tp4Track;IBM PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [2004-8-4 13904] R3 wltwo48b;2Wire Wireless PC Card Driver;c:\windows\system32\drivers\wltwo48b.sys [2002-10-21 156160] S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-6-15 115952] S3 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-6-15 1805552] ============== File Associations =============== regfile=regedit.exe "%1" %* scrfile="%1" %* =============== Created Last 30 ================ 2009-05-26 21:41 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-05-26 18:57 –d—– c:\program files\Trend Micro 2009-05-26 18:48 28,544 a——- c:\windows\system32\drivers\pavboot.sys 2009-05-26 18:48 –d—– c:\program files\Panda Security 2009-05-26 18:07 –dsh— C:\FOUND.010 2009-05-22 20:45 –d—– C:\3.5 2009-05-02 19:09 1,089,593 ——– c:\windows\system32\dllcache\ntprint.cat 2009-05-02 10:13 2,052 a——- c:\windows\system\MIFLHR.DRV 2009-05-02 10:13 –d—– c:\program files\Linktivity 2009-05-02 10:12 –d—– c:\temp\LinktivityPresenter 2009-05-02 10:12 –d—– C:\temp 2009-05-02 09:35 –d—– C:\Boon Jin 2009-05-02 09:00 –d—– C:\da03a9f1718ddfc974e79a 2009-05-02 08:59 –d—– c:\windows\SxsCaPendDel 2009-05-01 22:26 12 a——- c:\windows\bthservsdp.dat 2009-05-01 21:43 –d—– c:\windows\system32\XPSViewer 2009-05-01 21:41 14,048 ——– c:\windows\system32\spmsg2.dll 2009-05-01 21:21 –d—– C:\wiimoteconnect ==================== Find3M ==================== 2009-05-26 13:19 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-05-05 11:16 29,280 a——- c:\docume~1\admini~1\applic~1\GDIPFONTCACHEV1.DAT 2009-03-21 09:06 989,696 ——– c:\windows\system32\dllcache\kernel32.dll 2009-03-10 22:18 934,792 ——– c:\windows\system32\dllcache\WgaTray.exe 2009-03-10 22:18 239,496 ——– c:\windows\system32\dllcache\wgaLogon.dll 2009-03-09 15:01 36,384 a——- c:\windows\system32\pppop.sys 2009-03-09 15:01 510,496 a——- c:\windows\system32\FortiSslvpnDaemon.exe 2009-03-09 15:01 510,496 a——- c:\windows\FortiSSLVPNd.exe 2009-03-06 09:22 284,160 a——- c:\windows\system32\pdh.dll 2009-03-06 09:22 284,160 ——– c:\windows\system32\dllcache\pdh.dll 2009-03-02 19:18 826,368 a——- c:\windows\system32\wininet.dll 2009-03-02 19:18 826,368 a——- c:\windows\system32\dllcache\wininet.dll 2008-09-22 17:53 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008092220080923\index.dat ============= FINISH: 17:49:32.50 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-05-14.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 9/25/2004 6:21:07 PM System Uptime: 5/29/2009 4:42:18 PM (1 hours ago) Motherboard: IBM | | 2658N3U Processor: Intel® Pentium® 4 Mobile CPU 2.00GHz | None | 1199/400mhz ==== Disk Partitions ========================= C: is FIXED (FAT32) - 26 GiB total, 3.418 GiB free. D: is FIXED (FAT32) - 1 GiB total, 0.199 GiB free. ==== Disabled Device Manager Items ============= Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Intel® PRO/100 VE Network Connection Device ID: PCI\VEN_8086&DEV;_1031&SUBSYS;_05201014&REV;_42\4&139E449D&0&40F0 Manufacturer: Intel Name: Intel® PRO/100 VE Network Connection PNP Device ID: PCI\VEN_8086&DEV;_1031&SUBSYS;_05201014&REV;_42\4&139E449D&0&40F0 Service: E100B ==== System Restore Points =================== RP1206: 4/26/2009 10:00:03 AM - System Checkpoint RP1207: 4/27/2009 6:10:05 PM - System Checkpoint RP1208: 4/28/2009 7:16:25 PM - System Checkpoint RP1209: 4/30/2009 6:32:03 PM - System Checkpoint RP1210: 5/1/2009 9:41:30 PM - Installed %1 %2. RP1211: 5/1/2009 9:41:48 PM - Printer Driver Microsoft XPS Document Writer Installed RP1212: 5/2/2009 9:01:39 AM - Installed Windows KB954550-v5. RP1213: 5/2/2009 9:02:19 AM - Printer Driver Microsoft XPS Document Writer Installed RP1214: 5/2/2009 9:27:10 AM - Installed Windows XP WgaNotify. RP1215: 5/2/2009 7:57:54 PM - Removed PC Connectivity Solution RP1216: 5/2/2009 7:59:22 PM - Removed QuickTime RP1217: 5/2/2009 8:01:20 PM - Removed TI Connect 1.6 RP1218: 5/2/2009 10:21:22 PM - Software Distribution Service 3.0 RP1219: 5/4/2009 7:46:53 PM - System Checkpoint RP1220: 5/6/2009 12:54:03 PM - System Checkpoint RP1221: 5/8/2009 6:39:57 PM - System Checkpoint RP1222: 5/9/2009 7:35:18 PM - System Checkpoint RP1223: 5/10/2009 8:56:57 PM - System Checkpoint RP1224: 5/12/2009 7:02:45 PM - System Checkpoint RP1225: 5/12/2009 9:13:41 PM - Software Distribution Service 3.0 RP1226: 5/14/2009 8:17:28 PM - System Checkpoint RP1227: 5/16/2009 11:09:19 AM - System Checkpoint RP1228: 5/17/2009 6:58:04 PM - System Checkpoint RP1229: 5/20/2009 8:28:14 PM - System Checkpoint RP1230: 5/22/2009 8:37:07 PM - System Checkpoint RP1231: 5/24/2009 10:33:02 AM - System Checkpoint RP1232: 5/25/2009 4:07:52 PM - System Checkpoint RP1233: 5/25/2009 6:50:25 PM - Configured WinDVD RP1234: 5/27/2009 7:29:09 PM - System Checkpoint RP1235: 5/28/2009 7:30:39 PM - System Checkpoint ==== Installed Programs ====================== µTorrent 2Wire Wireless Client Manager Adobe Acrobat Connect Add-in Adobe Flash Player ActiveX Adobe Flash Player Plugin Adobe Reader 7.0 Adobe Shockwave Player afreeCodecVT 1.1.52 Agere Systems AC'97 Modem AsfTools 3.1 (remove only) ATI Control Panel ATI Display Driver AutoUpdate AVIcodec (remove only) Brownstone Equation Editor 5 CambridgeSoft ChemDraw Plugin Net 11.0 CambridgeSoft ChemOffice Ultra 2006 Camera Access Library Camera Support Core Library Camera Window DS Camera Window DVC Camera Window MC Canon Camera Access Library Canon Camera Support Core Library Canon Camera Window DC_DV 5 for ZoomBrowser EX Canon Camera Window DC_DV 6 for ZoomBrowser EX Canon Camera Window DSLR 5 for ZoomBrowser EX Canon Camera Window MC 6 for ZoomBrowser EX Canon MovieEdit Task for ZoomBrowser EX Canon PhotoRecord Canon RAW Image Task for ZoomBrowser EX Canon Utilities PhotoStitch 3.1 Canon ZoomBrowser EX (E) Critical Update for Windows Media Player 11 (KB959772) Diploma 6 DivX Codec DivX Player DVD X Player Professional V3.0 DVDXCopy (remove only) EndNote 8.0.1 Exam ExamView Assessment Suite Flash Movie Player 1.5 FLV Player Garmin City Navigator North America NT 2008 Update Garmin Communicator Plugin Garmin Trip and Waypoint Manager v4 GeoGebra GoldWave v5.10 Grade Machine HijackThis 2.0.2 HotDog Professional 7 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) hp deskjet 3420 series (Remove only) HP Deskjet 3840 HP Precisionscan Pro 3.1 IBM ThinkPad Battery MaxiMiser and Power Management Features IBM ThinkPad Configuration IBM ThinkPad Power Management Driver IBM ThinkPad Presentation Director IBM TrackPoint Support ISI ResearchSoft - Export Helper J2SE Runtime Environment 5.0 Update 2 J2SE Runtime Environment 5.0 Update 9 K-Lite Codec Pack 2.34 Full Lab Partners LinktivityPresenter Malwarebytes' Anti-Malware MapSource MapSource - US Topo 24K National Parks, Central v3 MathType 5 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft National Language Support Downlevel APIs Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office XP Professional with FrontPage Microsoft Text-to-Speech Engine 4.0 (English) Microsoft User-Mode Driver Framework Feature Pack 1.5 Microsoft Visual C++ 2005 Redistributable Microsoft XML Parser mIRC Move Networks Media Player for Internet Explorer MovieEdit Task Mozilla Firefox (2.0.0.20) MSVC80_x86 MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) Netflix Movie Viewer Nokia Connectivity Cable Driver NTI CD-Maker NTI CD-Maker 6 Platinum Orbit Panda ActiveScan 2.0 PhotoStitch Random Student RAW Image Task 2.2 Real Alternative 1.46 ScummVM 0.7.1 Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961373) SmartCapture v2.0.0 Smoothboard 1.0 SoundMAX Symantec AntiVirus System Requirements Lab TBS WMP Plug-in ThinkPad FullScreen Magnifier ThinkPad Software Installer TVUPlayer [removed] Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Viewpoint Manager (Remove Only) WebFldrs XP Winamp (remove only) Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage v1.3.0254.0 Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 3 WinRAR archiver XML Paper Specification Shared Components Pack 1.0 ==== Event Viewer Messages From Past Week ======== 5/27/2009 6:16:53 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort1. 5/27/2009 6:16:28 PM, error: PlugPlayManager [12] - The device 'HL-DT-ST RW/DVD GCC-4160N' (IDE\CdRomHL-DT-ST_RW/DVD_GCC-4160N_______________0012____\5&29356cf8&0&0.0.0) disappeared from the system without first being prepared for removal. 5/27/2009 6:16:19 PM, error: atapi [9] - The device, \Device\Ide\IdePort1, did not respond within the timeout period. 5/25/2009 4:12:03 PM, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible. 5/25/2009 3:42:31 PM, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00022DB5DEC1 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message). ==== End Of File =========================== that you so much for your help so far!!!! michele

i see that the malwarebytes log says that i did not remove the trojans found, however, i am almost sure that i did! at any rate, i went into the quarrantine tab and deleted all trojans listed. i then ran the malwarebytes quick scan:

Malwarebytes' Anti-Malware 1.37
Database version: 2204
Windows 5.1.2600 Service Pack 3

5/31/2009 8:51:31 PM
mbam-log-2009-05-31 (20-51-31).txt

Scan type: Quick Scan
Objects scanned: 96661
Time elapsed: 10 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


here is the log from combofix:

ComboFix 09-05-31.02 - Administrator 05/31/2009 21:02.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.767.444 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-05-01 to 2009-06-01 )))))))))))))))))))))))))))))))
.

2009-05-30 14:38 . 2009-05-30 14:38 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-05-30 13:41 . 2009-05-30 13:41 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2009-05-30 13:37 . 2009-05-30 13:37 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-05-30 13:33 . 2009-05-30 13:33 ——– d—–w- c:\windows\ie8updates
2009-05-30 13:33 . 2009-05-12 05:11 102912 ——w- c:\windows\system32\dllcache\iecompat.dll
2009-05-30 13:30 . 2009-05-30 13:30 ——– d–h–w- c:\windows\ie8
2009-05-30 12:24 . 2009-05-30 12:24 ——– d-sh–w- C:\FOUND.011
2009-05-27 02:41 . 2009-05-26 18:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-27 02:41 . 2009-05-27 02:41 3371383 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-26 23:57 . 2009-05-26 23:57 ——– d—–w- c:\program files\Trend Micro
2009-05-26 23:48 . 2008-06-19 22:24 28544 —-a-w- c:\windows\system32\drivers\pavboot.sys
2009-05-26 23:48 . 2009-05-26 23:48 ——– d—–w- c:\program files\Panda Security
2009-05-26 23:07 . 2009-05-26 23:07 ——– d-sh–w- C:\FOUND.010
2009-05-23 01:45 . 2009-05-23 01:45 ——– d—–w- C:\3.5
2009-05-15 22:37 . 2009-05-15 22:37 34062 —-a-w- c:\documents and settings\Administrator\Application Data\Move Networks\ie_bin\Uninst.exe
2009-05-15 22:36 . 2009-05-15 22:36 1047072 —-a-w- c:\documents and settings\Administrator\Application Data\Move Networks\MoveMediaPlayer_071303000006.exe
2009-05-02 15:13 . 2009-05-02 15:13 ——– d—–w- c:\program files\Linktivity
2009-05-02 15:13 . 2001-08-18 10:00 2052 —-a-w- c:\windows\system\MIFLHR.DRV
2009-05-02 15:12 . 2009-05-02 15:12 ——– d—–w- c:\temp\LinktivityPresenter
2009-05-02 15:12 . 2009-05-02 15:12 ——– d—–w- C:\temp
2009-05-02 14:35 . 2009-05-02 14:35 ——– d—–w- C:\Boon Jin
2009-05-02 14:30 . 2009-05-02 14:30 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Lukas_Reinhart
2009-05-02 14:00 . 2009-05-02 14:00 ——– d—–w- C:\da03a9f1718ddfc974e79a
2009-05-02 13:59 . 2009-05-02 14:00 ——– d—–w- c:\windows\SxsCaPendDel
2009-05-02 03:26 . 2009-05-31 18:02 12 —-a-w- c:\windows\bthservsdp.dat
2009-05-02 02:43 . 2009-05-02 02:43 ——– d—–w- c:\program files\MSBuild
2009-05-02 02:43 . 2009-05-02 02:43 ——– d—–w- c:\windows\system32\XPSViewer
2009-05-02 02:42 . 2009-05-02 02:42 ——– d—–w- c:\program files\Reference Assemblies
2009-05-02 02:41 . 2006-06-29 18:07 14048 ——w- c:\windows\system32\spmsg2.dll
2009-05-02 02:21 . 2009-05-02 02:21 ——– d—–w- C:\wiimoteconnect

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-30 12:28 . 2004-09-26 00:21 27216 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-26 18:19 . 2008-06-29 23:43 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-03-09 20:01 . 2008-10-10 23:26 36384 —-a-w- c:\windows\system32\pppop.sys
2009-03-09 20:01 . 2008-10-10 23:26 36384 —-a-w- c:\windows\system32\drivers\pppop.sys
2009-03-09 20:01 . 2009-03-17 22:40 510496 —-a-w- c:\windows\system32\FortiSslvpnDaemon.exe
2009-03-09 20:01 . 2008-10-10 23:26 510496 —-a-w- c:\windows\FortiSSLVPNd.exe
2009-03-09 17:29 . 2009-03-09 17:29 97144 —-a-w- c:\documents and settings\Administrator\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-03-09 17:29 . 2009-03-09 17:29 1010552 —-a-w- c:\documents and settings\Administrator\Application Data\Move Networks\ie_bin\qsp2ie071303000006.dll
2009-03-08 09:34 . 1980-01-01 05:00 914944 —-a-w- c:\windows\system32\wininet.dll
2009-03-08 09:34 . 1980-01-01 05:00 43008 —-a-w- c:\windows\system32\licmgr10.dll
2009-03-08 09:33 . 1980-01-01 05:00 18944 —-a-w- c:\windows\system32\corpol.dll
2009-03-08 09:33 . 1980-01-01 05:00 420352 —-a-w- c:\windows\system32\vbscript.dll
2009-03-08 09:32 . 1980-01-01 05:00 72704 —-a-w- c:\windows\system32\admparse.dll
2009-03-08 09:32 . 1980-01-01 05:00 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-03-08 09:31 . 1980-01-01 05:00 34816 —-a-w- c:\windows\system32\imgutil.dll
2009-03-08 09:31 . 1980-01-01 05:00 48128 —-a-w- c:\windows\system32\mshtmler.dll
2009-03-08 09:31 . 1980-01-01 05:00 45568 —-a-w- c:\windows\system32\mshta.exe
2009-03-08 09:22 . 1980-01-01 05:00 156160 —-a-w- c:\windows\system32\msls31.dll
2009-03-06 14:22 . 1980-01-01 05:00 284160 —-a-w- c:\windows\system32\pdh.dll
2009-01-11 13:47 . 2006-02-20 02:13 67688 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-01-11 13:47 . 2006-02-20 02:13 54368 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-01-11 13:47 . 2008-05-21 01:27 34944 —-a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-01-11 13:47 . 2008-05-21 01:27 46712 —-a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-01-11 13:47 . 2006-02-20 02:13 172136 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-02 335872]
"TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2004-08-07 94208]
"BMMGAG"="c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2004-07-29 110592]
"BMMLREF"="c:\program files\ThinkPad\Utilities\BMMLREF.EXE" [2004-07-29 20480]
"BMMMONWND"="c:\progra~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2004-07-29 395776]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2006-01-13 172032]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-03-20 213936]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-20 86960]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"TrackPointSrv"="tp4serv.exe" - c:\windows\system32\tp4serv.exe [2004-08-04 94208]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2002-10-18 87751]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
2Wire Wireless Client Manager.lnk - c:\program files\2Wire Wireless\Client Manager\CMTWO.EXE [2004-9-25 344064]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\CambridgeSoft\\ChemOffice2006\\ChemDraw\\ChemDraw.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10331:TCP"= 10331:TCP:PORT_10331
"48219:TCP"= 48219:TCP:PORT_48219
"13967:TCP"= 13967:TCP:PORT_13967
"57476:TCP"= 57476:TCP:PORT_57476
"13440:TCP"= 13440:TCP:PORT_13440
"51403:TCP"= 51403:TCP:PORT_51403
"24252:TCP"= 24252:TCP:PORT_24252
"51893:TCP"= 51893:TCP:PORT_51893
"13620:TCP"= 13620:TCP:PORT_13620
"60978:TCP"= 60978:TCP:PORT_60978
"8437:TCP"= 8437:TCP:PORT_8437
"58036:TCP"= 58036:TCP:PORT_58036
"29377:TCP"= 29377:TCP:PORT_29377
"56214:TCP"= 56214:TCP:PORT_56214
"32657:TCP"= 32657:TCP:PORT_32657
"40353:TCP"= 40353:TCP:PORT_40353
"59562:TCP"= 59562:TCP:PORT_59562
"13642:TCP"= 13642:TCP:PORT_13642
"30590:TCP"= 30590:TCP:PORT_30590
"35713:TCP"= 35713:TCP:PORT_35713
"22523:TCP"= 22523:TCP:PORT_22523
"44092:TCP"= 44092:TCP:PORT_44092
"48200:TCP"= 48200:TCP:PORT_48200
"59180:TCP"= 59180:TCP:PORT_59180
"7359:TCP"= 7359:TCP:PORT_7359
"57213:TCP"= 57213:TCP:PORT_57213
"26527:TCP"= 26527:TCP:PORT_26527
"51281:TCP"= 51281:TCP:PORT_51281
"37806:TCP"= 37806:TCP:PORT_37806
"64155:TCP"= 64155:TCP:PORT_64155
"31598:TCP"= 31598:TCP:PORT_31598
"15241:TCP"= 15241:TCP:PORT_15241
"20895:TCP"= 20895:TCP:PORT_20895
"42173:TCP"= 42173:TCP:PORT_42173
"45402:TCP"= 45402:TCP:PORT_45402
"56865:TCP"= 56865:TCP:PORT_56865
"12140:TCP"= 12140:TCP:PORT_12140
"44916:TCP"= 44916:TCP:PORT_44916
"59768:TCP"= 59768:TCP:PORT_59768
"13857:TCP"= 13857:TCP:PORT_13857
"55610:TCP"= 55610:TCP:PORT_55610
"16995:TCP"= 16995:TCP:PORT_16995
"53756:TCP"= 53756:TCP:PORT_53756
"50011:TCP"= 50011:TCP:PORT_50011
"18122:TCP"= 18122:TCP:PORT_18122
"58334:TCP"= 58334:TCP:PORT_58334
"30000:TCP"= 30000:TCP:PORT_30000
"55090:TCP"= 55090:TCP:PORT_55090
"47354:TCP"= 47354:TCP:PORT_47354
"35023:TCP"= 35023:TCP:PORT_35023
"20482:TCP"= 20482:TCP:PORT_20482
"29916:TCP"= 29916:TCP:PORT_29916
"17684:TCP"= 17684:TCP:PORT_17684
"37214:TCP"= 37214:TCP:PORT_37214
"27997:TCP"= 27997:TCP:PORT_27997
"47721:TCP"= 47721:TCP:PORT_47721
"33797:TCP"= 33797:TCP:PORT_33797
"56046:TCP"= 56046:TCP:PORT_56046
"29129:TCP"= 29129:TCP:PORT_29129
"32403:TCP"= 32403:TCP:PORT_32403
"8463:TCP"= 8463:TCP:PORT_8463
"18988:TCP"= 18988:TCP:PORT_18988
"65265:TCP"= 65265:TCP:PORT_65265
"34356:TCP"= 34356:TCP:PORT_34356
"57211:TCP"= 57211:TCP:PORT_57211
"53150:TCP"= 53150:TCP:PORT_53150
"24878:TCP"= 24878:TCP:PORT_24878
"64464:TCP"= 64464:TCP:PORT_64464
"59781:TCP"= 59781:TCP:PORT_59781
"64055:TCP"= 64055:TCP:PORT_64055
"18129:TCP"= 18129:TCP:PORT_18129
"23723:TCP"= 23723:TCP:PORT_23723
"45115:TCP"= 45115:TCP:PORT_45115
"28897:TCP"= 28897:TCP:PORT_28897
"9797:TCP"= 9797:TCP:PORT_9797
"28211:TCP"= 28211:TCP:PORT_28211
"12342:TCP"= 12342:TCP:PORT_12342
"46405:TCP"= 46405:TCP:PORT_46405
"27029:TCP"= 27029:TCP:PORT_27029
"57483:TCP"= 57483:TCP:PORT_57483
"35105:TCP"= 35105:TCP:PORT_35105
"63654:TCP"= 63654:TCP:PORT_63654
"54453:TCP"= 54453:TCP:PORT_54453
"24756:TCP"= 24756:TCP:PORT_24756
"18091:TCP"= 18091:TCP:PORT_18091
"7525:TCP"= 7525:TCP:PORT_7525
"40018:TCP"= 40018:TCP:PORT_40018
"15873:TCP"= 15873:TCP:PORT_15873
"9374:TCP"= 9374:TCP:PORT_9374
"33861:TCP"= 33861:TCP:PORT_33861
"45866:TCP"= 45866:TCP:PORT_45866
"41452:TCP"= 41452:TCP:PORT_41452
"32948:TCP"= 32948:TCP:PORT_32948
"24600:TCP"= 24600:TCP:PORT_24600
"25099:TCP"= 25099:TCP:PORT_25099
"10362:TCP"= 10362:TCP:PORT_10362
"51262:TCP"= 51262:TCP:PORT_51262
"61529:TCP"= 61529:TCP:PORT_61529
"62102:TCP"= 62102:TCP:PORT_62102
"42157:TCP"= 42157:TCP:PORT_42157
"39241:TCP"= 39241:TCP:PORT_39241
"39597:TCP"= 39597:TCP:PORT_39597
"18671:TCP"= 18671:TCP:PORT_18671
"40265:TCP"= 40265:TCP:PORT_40265
"58872:TCP"= 58872:TCP:PORT_58872
"33769:TCP"= 33769:TCP:PORT_33769
"29471:TCP"= 29471:TCP:PORT_29471
"39635:TCP"= 39635:TCP:PORT_39635
"42594:TCP"= 42594:TCP:PORT_42594
"54691:TCP"= 54691:TCP:PORT_54691
"40991:TCP"= 40991:TCP:PORT_40991
"37501:TCP"= 37501:TCP:PORT_37501
"34682:TCP"= 34682:TCP:PORT_34682
"33553:TCP"= 33553:TCP:PORT_33553
"41112:TCP"= 41112:TCP:PORT_41112
"50253:TCP"= 50253:TCP:PORT_50253
"5008:TCP"= 5008:TCP:PORT_5008
"41833:TCP"= 41833:TCP:PORT_41833
"11209:TCP"= 11209:TCP:PORT_11209
"37196:TCP"= 37196:TCP:PORT_37196
"48743:TCP"= 48743:TCP:PORT_48743
"11982:TCP"= 11982:TCP:PORT_11982
"52168:TCP"= 52168:TCP:PORT_52168
"52854:TCP"= 52854:TCP:PORT_52854
"24938:TCP"= 24938:TCP:PORT_24938
"24862:TCP"= 24862:TCP:PORT_24862
"41831:TCP"= 41831:TCP:PORT_41831
"8802:TCP"= 8802:TCP:PORT_8802
"11075:TCP"= 11075:TCP:PORT_11075
"20194:TCP"= 20194:TCP:PORT_20194
"48080:TCP"= 48080:TCP:PORT_48080
"44657:TCP"= 44657:TCP:PORT_44657
"37775:TCP"= 37775:TCP:PORT_37775
"26663:TCP"= 26663:TCP:PORT_26663
"55187:TCP"= 55187:TCP:PORT_55187
"26411:TCP"= 26411:TCP:PORT_26411
"17167:TCP"= 17167:TCP:PORT_17167
"17117:TCP"= 17117:TCP:PORT_17117
"49582:TCP"= 49582:TCP:PORT_49582
"23414:TCP"= 23414:TCP:PORT_23414
"9867:TCP"= 9867:TCP:PORT_9867
"18557:TCP"= 18557:TCP:PORT_18557
"17287:TCP"= 17287:TCP:PORT_17287
"14874:TCP"= 14874:TCP:PORT_14874
"48925:TCP"= 48925:TCP:PORT_48925
"7119:TCP"= 7119:TCP:PORT_7119
"43042:TCP"= 43042:TCP:PORT_43042
"60325:TCP"= 60325:TCP:PORT_60325
"47093:TCP"= 47093:TCP:PORT_47093
"36858:TCP"= 36858:TCP:PORT_36858
"46590:TCP"= 46590:TCP:PORT_46590
"45770:TCP"= 45770:TCP:PORT_45770
"54319:TCP"= 54319:TCP:PORT_54319
"22808:TCP"= 22808:TCP:PORT_22808
"16004:TCP"= 16004:TCP:PORT_16004
"38558:TCP"= 38558:TCP:PORT_38558
"31085:TCP"= 31085:TCP:PORT_31085
"10698:TCP"= 10698:TCP:PORT_10698
"61970:TCP"= 61970:TCP:PORT_61970
"54104:TCP"= 54104:TCP:PORT_54104
"9719:TCP"= 9719:TCP:PORT_9719
"20432:TCP"= 20432:TCP:PORT_20432
"31828:TCP"= 31828:TCP:PORT_31828
"47215:TCP"= 47215:TCP:PORT_47215
"43375:TCP"= 43375:TCP:PORT_43375
"33845:TCP"= 33845:TCP:PORT_33845
"16356:TCP"= 16356:TCP:PORT_16356
"27903:TCP"= 27903:TCP:PORT_27903
"56588:TCP"= 56588:TCP:PORT_56588
"39217:TCP"= 39217:TCP:PORT_39217
"20931:TCP"= 20931:TCP:PORT_20931
"40072:TCP"= 40072:TCP:PORT_40072
"53357:TCP"= 53357:TCP:PORT_53357
"51847:TCP"= 51847:TCP:PORT_51847
"35774:TCP"= 35774:TCP:PORT_35774
"28476:TCP"= 28476:TCP:PORT_28476
"32928:TCP"= 32928:TCP:PORT_32928
"34041:TCP"= 34041:TCP:PORT_34041
"43743:TCP"= 43743:TCP:PORT_43743
"58104:TCP"= 58104:TCP:PORT_58104
"12803:TCP"= 12803:TCP:PORT_12803
"10458:TCP"= 10458:TCP:PORT_10458
"23897:TCP"= 23897:TCP:PORT_23897
"11349:TCP"= 11349:TCP:PORT_11349
"7017:TCP"= 7017:TCP:PORT_7017
"43842:TCP"= 43842:TCP:PORT_43842
"33781:TCP"= 33781:TCP:PORT_33781
"38490:TCP"= 38490:TCP:PORT_38490
"48088:TCP"= 48088:TCP:PORT_48088
"43783:TCP"= 43783:TCP:PORT_43783
"44012:TCP"= 44012:TCP:PORT_44012
"6262:TCP"= 6262:TCP:PORT_6262
"39532:TCP"= 39532:TCP:PORT_39532
"39599:TCP"= 39599:TCP:PORT_39599
"6660:TCP"= 6660:TCP:PORT_6660
"34468:TCP"= 34468:TCP:PORT_34468
"9166:TCP"= 9166:TCP:PORT_9166
"14431:TCP"= 14431:TCP:PORT_14431
"53878:TCP"= 53878:TCP:PORT_53878
"42145:TCP"= 42145:TCP:PORT_42145
"39655:TCP"= 39655:TCP:PORT_39655
"21511:TCP"= 21511:TCP:PORT_21511
"10606:TCP"= 10606:TCP:PORT_10606
"10540:TCP"= 10540:TCP:PORT_10540
"53237:TCP"= 53237:TCP:PORT_53237
"18898:TCP"= 18898:TCP:PORT_18898
"45506:TCP"= 45506:TCP:PORT_45506
"41168:TCP"= 41168:TCP:PORT_41168
"14982:TCP"= 14982:TCP:PORT_14982
"36249:TCP"= 36249:TCP:PORT_36249
"19418:TCP"= 19418:TCP:PORT_19418
"52270:TCP"= 52270:TCP:PORT_52270
"39367:TCP"= 39367:TCP:PORT_39367
"61439:TCP"= 61439:TCP:PORT_61439
"32030:TCP"= 32030:TCP:PORT_32030
"63786:TCP"= 63786:TCP:PORT_63786
"22903:TCP"= 22903:TCP:PORT_22903
"20682:TCP"= 20682:TCP:PORT_20682
"58374:TCP"= 58374:TCP:PORT_58374
"43643:TCP"= 43643:TCP:PORT_43643
"32602:TCP"= 32602:TCP:PORT_32602
"46674:TCP"= 46674:TCP:PORT_46674
"7571:TCP"= 7571:TCP:PORT_7571
"53423:TCP"= 53423:TCP:PORT_53423
"17726:TCP"= 17726:TCP:PORT_17726
"19851:TCP"= 19851:TCP:PORT_19851
"55500:TCP"= 55500:TCP:PORT_55500
"58216:TCP"= 58216:TCP:PORT_58216
"11728:TCP"= 11728:TCP:PORT_11728
"42265:TCP"= 42265:TCP:PORT_42265
"65189:TCP"= 65189:TCP:PORT_65189
"62304:TCP"= 62304:TCP:PORT_62304
"17628:TCP"= 17628:TCP:PORT_17628
"40423:TCP"= 40423:TCP:PORT_40423
"31057:TCP"= 31057:TCP:PORT_31057
"12619:TCP"= 12619:TCP:PORT_12619
"63314:TCP"= 63314:TCP:PORT_63314
"39401:TCP"= 39401:TCP:PORT_39401
"40703:TCP"= 40703:TCP:PORT_40703
"33373:TCP"= 33373:TCP:PORT_33373
"64716:TCP"= 64716:TCP:PORT_64716
"56925:TCP"= 56925:TCP:PORT_56925
"46075:TCP"= 46075:TCP:PORT_46075
"8877:TCP"= 8877:TCP:PORT_8877
"17998:TCP"= 17998:TCP:PORT_17998
"24874:TCP"= 24874:TCP:PORT_24874
"26675:TCP"= 26675:TCP:PORT_26675
"9765:TCP"= 9765:TCP:PORT_9765
"11522:TCP"= 11522:TCP:PORT_11522
"33729:TCP"= 33729:TCP:PORT_33729
"54802:TCP"= 54802:TCP:PORT_54802
"45136:TCP"= 45136:TCP:PORT_45136
"18046:TCP"= 18046:TCP:PORT_18046
"60752:TCP"= 60752:TCP:PORT_60752
"12230:TCP"= 12230:TCP:PORT_12230
"37565:TCP"= 37565:TCP:PORT_37565
"54447:TCP"= 54447:TCP:PORT_54447
"46942:TCP"= 46942:TCP:PORT_46942
"32908:TCP"= 32908:TCP:PORT_32908
"20430:TCP"= 20430:TCP:PORT_20430
"33126:TCP"= 33126:TCP:PORT_33126
"46595:TCP"= 46595:TCP:PORT_46595
"20360:TCP"= 20360:TCP:PORT_20360
"17095:TCP"= 17095:TCP:PORT_17095
"33959:TCP"= 33959:TCP:PORT_33959
"34867:TCP"= 34867:TCP:PORT_34867
"25245:TCP"= 25245:TCP:PORT_25245
"32644:TCP"= 32644:TCP:PORT_32644
"21063:TCP"= 21063:TCP:PORT_21063
"62883:TCP"= 62883:TCP:PORT_62883
"6856:TCP"= 6856:TCP:PORT_6856
"36072:TCP"= 36072:TCP:PORT_36072
"50671:TCP"= 50671:TCP:PORT_50671
"29700:TCP"= 29700:TCP:PORT_29700
"24047:TCP"= 24047:TCP:PORT_24047
"37941:TCP"= 37941:TCP:PORT_37941
"59025:TCP"= 59025:TCP:PORT_59025
"43185:TCP"= 43185:TCP:PORT_43185
"7768:TCP"= 7768:TCP:PORT_7768
"47673:TCP"= 47673:TCP:PORT_47673
"52795:TCP"= 52795:TCP:PORT_52795
"38896:TCP"= 38896:TCP:PORT_38896
"12893:TCP"= 12893:TCP:PORT_12893
"26857:TCP"= 26857:TCP:PORT_26857
"47359:TCP"= 47359:TCP:PORT_47359
"8144:TCP"= 8144:TCP:PORT_8144
"40517:TCP"= 40517:TCP:PORT_40517
"18738:TCP"= 18738:TCP:PORT_18738
"47559:TCP"= 47559:TCP:PORT_47559
"14023:TCP"= 14023:TCP:PORT_14023
"16056:TCP"= 16056:TCP:PORT_16056
"26265:TCP"= 26265:TCP:PORT_26265
"60160:TCP"= 60160:TCP:PORT_60160
"14934:TCP"= 14934:TCP:PORT_14934
"50047:TCP"= 50047:TCP:PORT_50047
"19238:TCP"= 19238:TCP:PORT_19238
"22551:TCP"= 22551:TCP:PORT_22551
"40240:TCP"= 40240:TCP:PORT_40240
"6842:TCP"= 6842:TCP:PORT_6842
"63073:TCP"= 63073:TCP:PORT_63073
"61331:TCP"= 61331:TCP:PORT_61331
"16178:TCP"= 16178:TCP:PORT_16178
"38338:TCP"= 38338:TCP:PORT_38338
"28067:TCP"= 28067:TCP:PORT_28067
"49566:TCP"= 49566:TCP:PORT_49566
"30995:TCP"= 30995:TCP:PORT_30995
"65170:TCP"= 65170:TCP:PORT_65170
"53457:TCP"= 53457:TCP:PORT_53457
"13300:TCP"= 13300:TCP:PORT_13300
"25281:TCP"= 25281:TCP:PORT_25281
"9476:TCP"= 9476:TCP:PORT_9476
"13306:TCP"= 13306:TCP:PORT_13306
"61663:TCP"= 61663:TCP:PORT_61663
"62434:TCP"= 62434:TCP:PORT_62434
"51995:TCP"= 51995:TCP:PORT_51995
"50195:TCP"= 50195:TCP:PORT_50195
"9897:TCP"= 9897:TCP:PORT_9897
"14113:TCP"= 14113:TCP:PORT_14113
"21668:TCP"= 21668:TCP:PORT_21668
"32851:TCP"= 32851:TCP:PORT_32851
"42059:TCP"= 42059:TCP:PORT_42059
"42391:TCP"= 42391:TCP:PORT_42391
"29466:TCP"= 29466:TCP:PORT_29466
"15826:TCP"= 15826:TCP:PORT_15826
"51074:TCP"= 51074:TCP:PORT_51074
"39215:TCP"= 39215:TCP:PORT_39215
"52472:TCP"= 52472:TCP:PORT_52472
"55260:TCP"= 55260:TCP:PORT_55260
"47906:TCP"= 47906:TCP:PORT_47906
"13368:TCP"= 13368:TCP:PORT_13368
"60462:TCP"= 60462:TCP:PORT_60462
"48456:TCP"= 48456:TCP:PORT_48456
"47900:TCP"= 47900:TCP:PORT_47900
"62617:TCP"= 62617:TCP:PORT_62617
"46974:TCP"= 46974:TCP:PORT_46974
"10185:TCP"= 10185:TCP:PORT_10185
"35494:TCP"= 35494:TCP:PORT_35494
"14037:TCP"= 14037:TCP:PORT_14037
"31918:TCP"= 31918:TCP:PORT_31918
"47851:TCP"= 47851:TCP:PORT_47851
"55304:TCP"= 55304:TCP:PORT_55304
"40841:TCP"= 40841:TCP:PORT_40841
"56075:TCP"= 56075:TCP:PORT_56075
"37797:TCP"= 37797:TCP:PORT_37797
"26279:TCP"= 26279:TCP:PORT_26279
"40869:TCP"= 40869:TCP:PORT_40869
"6880:TCP"= 6880:TCP:PORT_6880
"7620:TCP"= 7620:TCP:PORT_7620
"46527:TCP"= 46527:TCP:PORT_46527
"37474:TCP"= 37474:TCP:PORT_37474
"27030:TCP"= 27030:TCP:PORT_27030
"63616:TCP"= 63616:TCP:PORT_63616
"30262:TCP"= 30262:TCP:PORT_30262
"30202:TCP"= 30202:TCP:PORT_30202
"16480:TCP"= 16480:TCP:PORT_16480
"13781:TCP"= 13781:TCP:PORT_13781
"55062:TCP"= 55062:TCP:PORT_55062
"39447:TCP"= 39447:TCP:PORT_39447
"29815:TCP"= 29815:TCP:PORT_29815
"6050:TCP"= 6050:TCP:PORT_6050
"21187:TCP"= 21187:TCP:PORT_21187
"51693:TCP"= 51693:TCP:PORT_51693
"14929:TCP"= 14929:TCP:PORT_14929
"40659:TCP"= 40659:TCP:PORT_40659
"32237:TCP"= 32237:TCP:PORT_32237
"62428:TCP"= 62428:TCP:PORT_62428
"56457:TCP"= 56457:TCP:PORT_56457
"44352:TCP"= 44352:TCP:PORT_44352
"18717:TCP"= 18717:TCP:PORT_18717
"46604:TCP"= 46604:TCP:PORT_46604
"6586:TCP"= 6586:TCP:PORT_6586
"10487:TCP"= 10487:TCP:PORT_10487
"50994:TCP"= 50994:TCP:PORT_50994
"60830:TCP"= 60830:TCP:PORT_60830
"22621:TCP"= 22621:TCP:PORT_22621
"7221:TCP"= 7221:TCP:PORT_7221
"32990:TCP"= 32990:TCP:PORT_32990
"55060:TCP"= 55060:TCP:PORT_55060
"10720:TCP"= 10720:TCP:PORT_10720
"43523:TCP"= 43523:TCP:PORT_43523
"20943:TCP"= 20943:TCP:PORT_20943
"15483:TCP"= 15483:TCP:PORT_15483
"54742:TCP"= 54742:TCP:PORT_54742
"11600:TCP"= 11600:TCP:PORT_11600
"46820:TCP"= 46820:TCP:PORT_46820
"22060:TCP"= 22060:TCP:PORT_22060
"9028:TCP"= 9028:TCP:PORT_9028
"21596:TCP"= 21596:TCP:PORT_21596
"45707:TCP"= 45707:TCP:PORT_45707
"21023:TCP"= 21023:TCP:PORT_21023
"56759:TCP"= 56759:TCP:PORT_56759
"40254:TCP"= 40254:TCP:PORT_40254
"21503:TCP"= 21503:TCP:PORT_21503

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [5/26/2009 6:48 PM 28544]
R1 DSMBATT;DSMBATT;c:\windows\system32\drivers\DSMBATT.SYS [9/25/2004 11:48 PM 9888]
R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [9/25/2004 11:48 PM 16384]
R2 FortiSslvpnDaemon;FortiSslvpnDaemon;c:\windows\system32\FortiSslvpnDaemon.exe [3/17/2009 5:40 PM 510496]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 11:26 AM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [9/12/2006 5:39 PM 106808]
R3 pppop;PPPoP WAN Adapter;c:\windows\system32\drivers\pppop.sys [10/10/2008 6:26 PM 36384]
R3 Tp4Track;IBM PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [8/4/2004 3:13 AM 13904]
R3 wltwo48b;2Wire Wireless PC Card Driver;c:\windows\system32\drivers\wltwo48b.sys [10/21/2002 3:53 AM 156160]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/15/2006 1:40 AM 115952]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2004-10-02 c:\windows\Tasks\BMMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2004-09-26 06:37]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
SafeBoot-procexp90.Sys


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
IE: &Download; by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab; video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload; selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load; all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: ibm.com\www-307
Trusted Zone: travelocity.com\dps1
Trusted Zone: travelocity.com\svc
Trusted Zone: travelocity.com\www
DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://www.ritzpix.com/NET/Uploader/LPUploader57.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\p94ef0hc.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 21:08
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1343024091-842925246-1957994488-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6b,3d,2b,81,f6,12,34,4b,b2,a7,a3,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6b,3d,2b,81,f6,12,34,4b,b2,a7,a3,\

[HKEY_USERS\S-1-5-21-1343024091-842925246-1957994488-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D8666454-28B0-03F6-61A8-12C99FB3E6BE}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"nacfmickibkkccjfomfallinicdo"=hex:6a,61,6f,62,6e,65,6d,63,6f,70,67,65,69,6f,
6c,66,63,6b,64,68,00,77
"maieohkkagbddpndjhoieindec"=hex:6a,61,6f,62,69,65,64,6b,66,6a,69,64,68,6a,63,
66,6e,6d,6b,6d,00,00
.
Completion time: 2009-06-01 21:11
ComboFix-quarantined-files.txt 2009-06-01 02:11

Pre-Run: 2,373,615,616 bytes free
Post-Run: 3,029,155,840 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
C:\="Microsoft Windows"

588 — E O F — 2009-05-30 13:34


thanks again!