[Closed] uacinit.dll removal help!

Hello! I had quite a nasty run-in with a virus/trojan/malware that MBAM seemed to thouroughly remove, with the exception of uacinit.dll. With each reboot and scan the file still remains. Please help!

I have browsed previous threads and in anticipation of your assistance I will post my MBAM and HijackThis logs in my next 2 sequential posts.

Thanks in advance!

Malwarebytes' Anti-Malware 1.37
Database version: 2241
Windows 5.1.2600 Service Pack 2

6/7/2009 6:37:58 PM
mbam-log-2009-06-07 (18-37-55).txt

Scan type: Quick Scan
Objects scanned: 122278
Time elapsed: 11 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> No action taken.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:43:47 PM, on 6/7/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\fss\winspl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\SanDisk\SanDisk TransferMate\SD Monitor.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\mbam3\tool.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch…TB&M=MX6453
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch…TB&M=MX6453
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Microsoft Service] C:\WINDOWS\system32\fss\winspl.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\mbam3\tool.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Monitor.lnk = C:\Program Files\SanDisk\SanDisk TransferMate\SD Monitor.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/vwhpro/EN/install/gtdownlr.cab
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - https://secure.logmeinrescue.com/TechConsol…scueControl.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter hijack: text/html - {1c667024-cc5e-42a0-9b8d-1c0f218dac47} - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 8861 bytes

Anybody??

Hey sorry for the long response, I appreciate your help. During the scan I got 2 SortUtility errors, I don't know if that affected anything. Since my last post my Google links are now being re-directed to spam sites, so it would seem my problem has only gotten worse. Here are the logs requested. DDS (Ver_09-05-14.01) - NTFSx86 Run by [removed] at 12:40:19.95 on Sat 06/20/2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1148 [GMT -4:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\stsystra.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\system32\fss\winspl.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Zune\ZuneLauncher.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AIM6\aim6.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\Program Files\SanDisk\SanDisk TransferMate\SD Monitor.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Documents and Settings\Jeska.JESSICA\Desktop\dds.com ============== Pseudo HJT Report =============== uSearch Bar = hxxp://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MX6453 uStart Page = hxxp://www.google.com/ mSearchAssistant = hxxp://www.google.com/ie BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL BHO: {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - No File TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll uRun: [Power2GoExpress] NA uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [Reminder] %WINDIR%\Creator\Remind_XP.exe mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall mRun: [Adobe Photo Downloader] "c:\program files\adobe\adobe photoshop lightroom\apdproxy.exe" mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe" mRun: [Microsoft Service] c:\windows\system32\fss\winspl.exe mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_03\bin\jusched.exe" mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\instal~1.lnk - c:\program files\sifxinst\SIFXINST.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monitor.lnk - c:\program files\sandisk\sandisk transfermate\SD Monitor.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {25365FF3-2746-4230-9DA7-163CCA318309} - hxxp://inst.c-wss.com/vwhpro/EN/install/gtdownlr.cab DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1005.cab DPF: {55027008-315F-4F45-BBC3-8BE119764741} - hxxp://www.slide.com/uploader/SlideImageUploader.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1244984940187 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll Notify: LMIinit - LMIinit.dll AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\jeska~1.jes\applic~1\mozilla\firefox\profiles\e4jmoevr.default\ FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-26 325896] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-5-20 27784] R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-6-26 298776] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2007-11-17 45848] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\logmein\x86\rainfo.sys –> c:\program files\logmein\x86\RaInfo.sys [?] S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" –> c:\program files\viewpoint\common\ViewpointService.exe [?] S4 LMIRfsClientNP;LMIRfsClientNP; [x] =============== Created Last 30 ================ 2009-06-19 15:13 –d—– c:\program files\GameHouse 2009-06-15 17:09 –d—– c:\docume~1\jeska~1.jes\applic~1\Malwarebytes 2009-06-14 08:53 –dsh— c:\documents and settings\jeska.jessica\IECompatCache 2009-06-14 08:52 –dsh— c:\documents and settings\jeska.jessica\PrivacIE 2009-06-14 08:52 –d—– c:\docume~1\jeska~1.jes\applic~1\AVGTOOLBAR 2009-06-14 08:52 –dsh— c:\documents and settings\jeska.jessica\IETldCache 2009-06-14 08:51 –d—– c:\documents and settings\jeska.jessica\WINDOWS 2009-06-14 08:51 –d—– c:\docume~1\jeska~1.jes\applic~1\You've Got Pictures Screensaver 2009-06-10 01:09 –d—– c:\program files\Yahoo! 2009-06-07 18:43 –d—– c:\program files\Trend Micro 2009-06-06 14:15 –d—– c:\program files\mbam3 2009-06-06 14:03 –d—– c:\program files\Malwarebytes' Anti-Malware2 2009-06-06 11:06 –d—– c:\program files\NavNet 2009-06-05 20:13 –d—– c:\program files\FrostWire 2009-06-05 20:08 –d—– c:\program files\AskBarDis ==================== Find3M ==================== 2009-06-13 22:15 86,811 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2009-06-13 16:24 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-06-13 16:24 325,896 a——- c:\windows\system32\drivers\avgldx86.sys 2009-05-26 13:20 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-05-26 13:19 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-05-13 01:15 915,456 a——- c:\windows\system32\wininet.dll 2009-05-07 11:32 345,600 a——- c:\windows\system32\localspl.dll 2009-04-17 08:26 1,847,168 a——- c:\windows\system32\win32k.sys 2009-04-15 10:51 585,216 a——- c:\windows\system32\rpcrt4.dll ============= FINISH: 12:43:02.88 =============== ——————————————————————————————————————————————————– UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-05-14.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 10/18/2006 5:21:22 PM System Uptime: 6/20/2009 11:45:06 AM (0 hours ago) Motherboard: Gateway | | Processor: AMD Turion™ 64 X2 Mobile Technology TL-52 | Socket M2/S1G1 | 1595/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 142 GiB total, 79.262 GiB free. D: is FIXED (FAT32) - 7 GiB total, 4.702 GiB free. E: is CDROM () F: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP886: 6/13/2009 8:34:33 PM - System Checkpoint RP887: 6/13/2009 9:01:38 PM - Software Distribution Service 3.0 RP888: 6/14/2009 8:22:13 AM - Software Distribution Service 3.0 ==== Installed Programs ====================== ==== Event Viewer Messages From Past Week ======== 6/14/2009 9:29:39 AM, error: Service Control Manager [7000] - The Viewpoint Manager Service service failed to start due to the following error: The system cannot find the path specified. 6/14/2009 12:49:52 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 6/13/2009 9:13:20 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Windows XP Service Pack 3 (KB936929). 6/13/2009 8:34:33 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume. 6/13/2009 4:23:58 PM, error: Service Control Manager [7024] - The Media Center Extender Service service terminated with service-specific error 2147549183 (0x8000FFFF). 6/13/2009 3:53:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 6/13/2009 3:53:04 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 6/13/2009 3:52:11 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK8 AvgLdx86 AvgMfx86 Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip 6/13/2009 3:52:11 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 6/13/2009 3:52:11 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 6/13/2009 3:52:11 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 6/13/2009 3:52:11 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 6/13/2009 3:52:11 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 6/13/2009 3:52:11 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 6/13/2009 11:12:30 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Viewpoint Manager Service service to connect. 6/13/2009 11:12:30 PM, error: Service Control Manager [7000] - The Viewpoint Manager Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 6/13/2009 11:12:30 PM, error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified. 6/13/2009 10:37:23 PM, error: Service Control Manager [7028] - The Cfg Registry key denied access to SYSTEM account programs so the Service Control Manager took ownership of the Registry key. ==== End Of File ===========================

Yes! I am already seeing serious improvement, thank you so much. My google links are no longer being re-directed either.

As Requested here is a new dds.txt and the combofix log.txt




DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 16:58:51.81 on Sun 06/21/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1236 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\fss\winspl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\SanDisk\SanDisk TransferMate\SD Monitor.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AIM6\anotify.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Jeska.JESSICA\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = "c:\program files\outlook express\msimn.exe"
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - No File
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
uRun: [Power2GoExpress] NA
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Reminder] %WINDIR%\Creator\Remind_XP.exe
mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [Microsoft Service] c:\windows\system32\fss\winspl.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\instal~1.lnk - c:\program files\sifxinst\SIFXINST.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monitor.lnk - c:\program files\sandisk\sandisk transfermate\SD Monitor.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {25365FF3-2746-4230-9DA7-163CCA318309} - hxxp://inst.c-wss.com/vwhpro/EN/install/gtdownlr.cab
DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1005.cab
DPF: {55027008-315F-4F45-BBC3-8BE119764741} - hxxp://www.slide.com/uploader/SlideImageUploader.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1244984940187
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: LMIinit - LMIinit.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jeska~1.jes\applic~1\mozilla\firefox\profiles\e4jmoevr.default\
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-26 325896]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-5-20 27784]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-6-26 298776]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2007-11-17 45848]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\logmein\x86\rainfo.sys –> c:\program files\logmein\x86\RaInfo.sys [?]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" –> c:\program files\viewpoint\common\ViewpointService.exe [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

=============== Created Last 30 ================

2009-06-21 13:31 a-dshr– C:\cmdcons
2009-06-21 13:29 161,792 a——- c:\windows\SWREG.exe
2009-06-21 13:29 155,136 a——- c:\windows\PEV.exe
2009-06-21 13:29 98,816 a——- c:\windows\sed.exe
2009-06-20 21:35 –d—– c:\docume~1\jeska~1.jes\applic~1\JewelMatch2
2009-06-20 21:04 –d—– c:\docume~1\jeska~1.jes\applic~1\WildTangent
2009-06-19 15:13 –d—– c:\program files\GameHouse
2009-06-15 17:09 –d—– c:\docume~1\jeska~1.jes\applic~1\Malwarebytes
2009-06-15 09:29 268,648 a——- c:\windows\system32\mucltui.dll
2009-06-15 09:29 27,496 a——- c:\windows\system32\mucltui.dll.mui
2009-06-14 08:53 –dsh— c:\documents and settings\jeska.jessica\IECompatCache
2009-06-14 08:52 –dsh— c:\documents and settings\jeska.jessica\PrivacIE
2009-06-14 08:52 –d—– c:\docume~1\jeska~1.jes\applic~1\AVGTOOLBAR
2009-06-14 08:52 –dsh— c:\documents and settings\jeska.jessica\IETldCache
2009-06-14 08:51 –d—– c:\documents and settings\jeska.jessica\WINDOWS
2009-06-14 08:51 –d—– c:\docume~1\jeska~1.jes\applic~1\You've Got Pictures Screensaver
2009-06-14 08:51 –d—– c:\documents and settings\Jeska.JESSICA
2009-06-13 22:12 –d—– c:\windows\system32\scripting
2009-06-13 22:12 –d—– c:\windows\system32\en
2009-06-13 22:12 –d—– c:\windows\system32\bits
2009-06-13 22:12 –d—– c:\windows\l2schemas
2009-06-13 22:08 –d—– c:\windows\network diagnostic
2009-06-13 21:39 276,992 ——– c:\windows\system32\wmphoto.dll
2009-06-13 21:39 69,120 ——– c:\windows\system32\wlanapi.dll
2009-06-13 21:39 712,704 ——– c:\windows\system32\windowscodecs.dll
2009-06-13 21:39 346,112 ——– c:\windows\system32\windowscodecsext.dll
2009-06-13 21:37 33,792 ——– c:\windows\system32\mmcperf.exe
2009-06-13 21:36 39,936 ——– c:\windows\system32\dimsroam.dll
2009-06-13 21:36 19,456 ——– c:\windows\system32\dimsntfy.dll
2009-06-13 21:36 48,640 ——– c:\windows\system32\dhcpqec.dll
2009-06-13 21:36 12,800 ——– c:\windows\system32\credssp.dll
2009-06-13 21:36 233,472 ——– c:\windows\system32\azroles.dll
2009-06-13 21:36 7,168 ——– c:\windows\system32\bitsprx4.dll
2009-06-13 21:36 136,192 ——– c:\windows\system32\aaclient.dll
2009-06-13 20:42 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll
2009-06-13 20:42 11,064,832 -c—— c:\windows\system32\dllcache\ieframe.dll
2009-06-13 20:42 1,985,024 -c—— c:\windows\system32\dllcache\iertutil.dll
2009-06-13 20:42 246,272 -c—— c:\windows\system32\dllcache\ieproxy.dll
2009-06-13 20:42 –d—– c:\windows\ie8updates
2009-06-13 20:41 102,912 -c—— c:\windows\system32\dllcache\iecompat.dll
2009-06-13 20:39 -cd-h— c:\windows\ie8
2009-06-10 01:09 –d—– c:\program files\Yahoo!
2009-06-07 18:43 –d—– c:\program files\Trend Micro
2009-06-06 14:15 –d—– c:\program files\mbam3
2009-06-06 14:03 –d—– c:\program files\Malwarebytes' Anti-Malware2
2009-06-06 11:06 –d—– c:\program files\NavNet
2009-06-05 20:13 –d—– c:\program files\FrostWire
2009-06-05 20:10 73,728 a——- c:\windows\system32\javacpl.cpl
2009-06-05 20:08 –d—– c:\program files\AskBarDis
2009-06-04 02:16 2,560 ——– c:\windows\system32\xpsp4res.dll
2009-06-04 02:16 215,552 -c—— c:\windows\system32\dllcache\wordpad.exe

==================== Find3M ====================

2009-06-13 22:15 86,811 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-06-13 16:24 11,952 a——- c:\windows\system32\avgrsstx.dll
2009-06-13 16:24 325,896 a——- c:\windows\system32\drivers\avgldx86.sys
2009-05-26 13:20 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 13:19 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-05-13 01:15 915,456 a——- c:\windows\system32\wininet.dll
2009-05-07 11:32 345,600 a——- c:\windows\system32\localspl.dll
2009-04-17 08:26 1,847,168 a——- c:\windows\system32\win32k.sys
2009-04-15 10:51 585,216 a——- c:\windows\system32\rpcrt4.dll

============= FINISH: 16:59:06.62 ===============





—————————————————————————————————————————————————




ComboFix 09-06-20.04 - Jeska 06/21/2009 13:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1443 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\12345.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common
c:\recycler\S-1-5-21-4271892322-2391042433-389183813-500
c:\windows\system32\drivers\SKYNETebxwqmlu.sys
c:\windows\system32\drivers\UACkrxjgojufyxjtyd.sys
c:\windows\system32\UACatgpwdkdyfdxtka.dll
c:\windows\system32\UACdewbjkrrmmxowpo.log
c:\windows\system32\UACdwoefvmsucbpvei.dat
c:\windows\system32\UACglumuntobtiyyob.log
c:\windows\system32\UACkxwnooawjbewmvd.dll
c:\windows\system32\UACmtveglqeondlvgm.dll
c:\windows\system32\UACrqkrnfpiynkcjqo.db
c:\windows\system32\UACtakdarusorpawom.dll
c:\windows\system32\UACtxwtmhtuxunpuvk.dll
c:\windows\system32\UACujelidmtgwyirkt.log
c:\windows\system32\UACxyxjpdgbdlqfill.dll
c:\program files\Common\_helper.sig
c:\recycler\S-1-5-21-4271892322-2391042433-389183813-500\desktop.ini
c:\recycler\S-1-5-21-4271892322-2391042433-389183813-500\INFO2
c:\windows\kb913800.exe
c:\windows\system32\drivers\SKYNETebxwqmlu.sys
c:\windows\system32\drivers\UACkrxjgojufyxjtyd.sys
c:\windows\system32\Ijl11.dll
c:\windows\system32\SKYNETkijviayv.dll
c:\windows\system32\SKYNETpqwenhaq.dll
c:\windows\system32\SKYNETqwhfnynd.dat
c:\windows\system32\UACatgpwdkdyfdxtka.dll
c:\windows\system32\UACdewbjkrrmmxowpo.log
c:\windows\system32\UACdwoefvmsucbpvei.dat
c:\windows\system32\UACglumuntobtiyyob.log
c:\windows\system32\uacinit.dll
c:\windows\system32\UACkxwnooawjbewmvd.dll
c:\windows\system32\UACmtveglqeondlvgm.dll
c:\windows\system32\UACrqkrnfpiynkcjqo.db
c:\windows\system32\UACtakdarusorpawom.dll
c:\windows\system32\uactmp.db
c:\windows\system32\UACtxwtmhtuxunpuvk.dll
c:\windows\system32\UACujelidmtgwyirkt.log
c:\windows\system32\UACxyxjpdgbdlqfill.dll
D:\Autorun.inf
D:\Desktop.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_UACd.sys
——-\Service_SKYNETjeoveves


((((((((((((((((((((((((( Files Created from 2009-05-21 to 2009-06-21 )))))))))))))))))))))))))))))))
.

2009-06-21 02:45 . 2009-06-21 02:45 1639352 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Gateway Game Console\Downloads\en-us\Installers\SetupGamesClient.exe
2009-06-21 01:35 . 2009-06-21 02:19 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Application Data\JewelMatch2
2009-06-21 01:04 . 2009-06-21 01:04 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Application Data\WildTangent
2009-06-19 19:13 . 2009-06-19 19:13 ——– d—–w- c:\program files\GameHouse
2009-06-18 20:23 . 2009-06-18 20:23 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Local Settings\Application Data\Mozilla
2009-06-18 05:26 . 2009-06-18 05:26 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Application Data\acccore
2009-06-18 05:26 . 2009-06-18 05:26 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Local Settings\Application Data\AOL OCP
2009-06-15 21:09 . 2009-06-15 21:09 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Application Data\Malwarebytes
2009-06-15 21:07 . 2009-06-15 21:07 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2009-06-15 21:07 . 2009-06-15 21:07 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR
2009-06-15 13:29 . 2008-10-16 18:06 268648 —-a-w- c:\windows\system32\mucltui.dll
2009-06-14 14:18 . 2009-06-14 14:18 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Local Settings\Application Data\Apple
2009-06-14 13:59 . 2009-06-14 13:59 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Application Data\Apple Computer
2009-06-14 12:53 . 2009-06-14 12:53 ——– d-sh–w- c:\documents and settings\Jeska.JESSICA\IECompatCache
2009-06-14 12:53 . 2009-06-14 13:59 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Local Settings\Application Data\Apple Computer
2009-06-14 12:52 . 2009-06-14 12:52 ——– d-sh–w- c:\documents and settings\Jeska.JESSICA\PrivacIE
2009-06-14 12:52 . 2009-06-14 12:52 ——– d—–w- c:\documents and settings\Jeska.JESSICA\Application Data\AVGTOOLBAR
2009-06-14 12:52 . 2009-06-14 12:52 ——– d-sh–w- c:\documents and settings\Jeska.JESSICA\IETldCache
2009-06-14 04:39 . 2009-06-14 04:39 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2009-06-14 04:39 . 2009-06-14 04:39 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-06-14 03:18 . 2009-06-14 03:18 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-06-14 02:12 . 2009-06-14 02:12 ——– d—–w- c:\windows\system32\scripting
2009-06-14 02:12 . 2009-06-14 02:12 ——– d—–w- c:\windows\system32\en
2009-06-14 02:12 . 2009-06-14 02:12 ——– d—–w- c:\windows\system32\bits
2009-06-14 02:12 . 2009-06-14 02:12 ——– d—–w- c:\windows\l2schemas
2009-06-14 01:39 . 2008-04-14 00:12 276992 ——w- c:\windows\system32\wmphoto.dll
2009-06-14 01:39 . 2008-04-14 00:12 69120 ——w- c:\windows\system32\wlanapi.dll
2009-06-14 01:39 . 2008-04-14 00:12 712704 ——w- c:\windows\system32\windowscodecs.dll
2009-06-14 01:39 . 2008-04-14 00:12 346112 ——w- c:\windows\system32\windowscodecsext.dll
2009-06-14 01:37 . 2008-04-14 00:12 33792 ——w- c:\windows\system32\mmcperf.exe
2009-06-14 01:36 . 2008-04-14 00:11 39936 ——w- c:\windows\system32\dimsroam.dll
2009-06-14 01:36 . 2008-04-14 00:11 19456 ——w- c:\windows\system32\dimsntfy.dll
2009-06-14 01:36 . 2008-04-14 00:11 48640 ——w- c:\windows\system32\dhcpqec.dll
2009-06-14 01:36 . 2008-04-14 00:11 12800 ——w- c:\windows\system32\credssp.dll
2009-06-14 01:36 . 2008-04-14 00:11 7168 ——w- c:\windows\system32\bitsprx4.dll
2009-06-14 01:36 . 2008-04-14 00:11 233472 ——w- c:\windows\system32\azroles.dll
2009-06-14 01:36 . 2008-04-14 00:11 136192 ——w- c:\windows\system32\aaclient.dll
2009-06-14 00:45 . 2009-06-14 00:45 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-14 00:42 . 2009-04-30 21:22 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2009-06-14 00:42 . 2009-04-30 21:22 1985024 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2009-06-14 00:42 . 2009-04-30 21:22 11064832 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2009-06-14 00:42 . 2009-04-30 21:22 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-14 00:42 . 2009-06-14 00:42 ——– d—–w- c:\windows\ie8updates
2009-06-14 00:41 . 2009-05-12 05:11 102912 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2009-06-14 00:39 . 2009-06-14 00:41 ——– dc-h–w- c:\windows\ie8
2009-06-10 05:09 . 2009-06-10 05:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-06-10 05:09 . 2009-06-10 06:14 ——– d—–w- c:\program files\Yahoo!
2009-06-07 22:43 . 2009-06-07 22:43 ——– d—–w- c:\program files\Trend Micro
2009-06-06 18:15 . 2009-06-06 18:16 ——– d—–w- c:\program files\mbam3
2009-06-06 18:03 . 2009-06-06 18:03 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware2
2009-06-06 15:06 . 2009-06-06 17:58 ——– d—–w- c:\program files\NavNet
2009-06-06 00:13 . 2009-06-06 00:14 ——– d—–w- c:\program files\FrostWire
2009-06-06 00:08 . 2009-06-06 00:19 ——– d—–w- c:\program files\AskBarDis
2009-06-04 06:16 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2009-06-04 06:16 . 2008-04-21 12:08 215552 -c—-w- c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-21 02:36 . 2008-06-26 20:52 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-06-21 02:02 . 2006-09-13 22:42 ——– d—–w- c:\program files\Gateway Games
2009-06-21 00:58 . 2006-09-13 22:42 ——– d—–w- c:\documents and settings\All Users\Application Data\WildTangent
2009-06-14 13:09 . 2006-09-13 22:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-06-14 12:52 . 2009-06-14 12:51 136 —-a-w- c:\documents and settings\Jeska.JESSICA\Local Settings\Application Data\fusioncache.dat
2009-06-14 03:01 . 2008-02-24 00:24 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-14 02:39 . 2008-02-24 00:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-14 02:15 . 2006-06-17 09:39 86811 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-13 03:22 . 2006-10-19 00:55 16 —-a-w- c:\windows\popcinfo.dat
2009-06-06 18:12 . 2009-02-03 02:28 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-06 00:10 . 2006-09-13 22:41 ——– d—–w- c:\program files\Java
2009-05-26 17:20 . 2009-02-03 02:28 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 17:19 . 2009-02-03 02:28 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-05-19 05:36 . 2009-06-19 02:28 2884832 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\vwpt.exe
2009-05-19 05:36 . 2009-06-19 02:28 28 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\unregister.bat
2009-05-19 05:36 . 2009-06-19 02:28 25 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\register.bat
2009-05-19 05:36 . 2009-06-19 02:28 1484856 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\toolbar.exe
2009-05-19 05:36 . 2009-06-19 02:28 97072 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\bsetutil.exe
2009-05-19 05:36 . 2009-06-19 02:28 142040 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\alsetup.exe
2009-05-19 05:36 . 2009-06-19 02:28 30512 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\Uninstaller.exe
2009-05-19 05:36 . 2009-06-19 02:28 111920 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AOLSearch.dll
2009-05-13 05:15 . 2006-06-17 09:23 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2006-06-17 09:23 345600 —-a-w- c:\windows\system32\localspl.dll
2009-04-17 12:26 . 2006-06-17 09:23 1847168 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2006-06-17 09:23 585216 —-a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-09 02:08 279944 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 688218]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-26 966656]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-03 45056]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-05-24 573440]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-11-12 1236992]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]
"Microsoft Service"="c:\windows\system32\fss\winspl.exe" [2007-02-23 229376]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-13 1947928]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-12-27 413696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Install Pending Files.LNK - c:\program files\SIFXINST\SIFXINST.EXE [2006-9-13 729088]
Monitor.lnk - c:\program files\SanDisk\SanDisk TransferMate\SD Monitor.exe [2007-3-28 110592]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-13 20:24 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-05-28 16:32 87352 —-a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\AIM\\AIM95_c0\\aim.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [6/26/2008 4:52 PM 325896]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [6/26/2008 4:52 PM 298776]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [11/17/2007 10:08 PM 45848]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys –> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" –> c:\program files\Viewpoint\Common\ViewpointService.exe [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]

2006-10-18 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\system32\OOBE\oobebaln.exe [2006-06-17 00:12]

2009-06-21 c:\windows\Tasks\User_Feed_Synchronization-{0BEC028A-6542-40D9-A036-BBD4255E53E9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Adobe Photo Downloader - c:\program files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe
HKLM-Run-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_03\bin\jusched.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-21 14:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(888)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\System32\BCMLogon.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(1020)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehSched.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\ehome\ehrec.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\ZuneBusEnum.exe
c:\program files\Zune\ZuneNss.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\AIM6\anotify.exe
.
**************************************************************************
.
Completion time: 2009-06-21 14:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-21 18:11

Pre-Run: 84,825,436,160 bytes free
Post-Run: 85,216,538,624 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /fastdetect /usepmtimer /NoExecute=OptIn

Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
287 — E O F — 2009-06-14 12:22