[Resolved] Windows Only Runs in Safe Mode; Anti-Malware Apps Inac

I can't seem to access D:\i386 as it's a recovery partition. This message appears in my explorer window:

"Recovery Partition
Warning!

This area of your hard disk
(or partition) contains files used
for your system recovery.

Do not delete or alter these files.

Any change to this partition could
prevent any recovery later."

Everything seems to be working completely fine now.

hijackthis.log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:11 PM, on 2009-06-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
C:\Program Files\Strokeit\strokeit.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Dropbox\Dropbox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Documents and Settings\Dan\My Documents\Downloads\x.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/g/startpage.html?Ch…TP&M=GT5220
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {58CC178C-807D-74C8-917C-2D09857BA4DA} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp
O4 - HKCU\..\Run: [Power2GoExpress] NA
O4 - HKCU\..\Run: [StrokeIt] C:\Program Files\Strokeit\strokeit.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe
O4 - Startup: Grattitude Journal.txt.lnk = ?
O4 - Startup: Shortcut to Accomplishments2.txt.lnk = ?
O4 - Startup: Shortcut to Vision.bmp.lnk = ?
O4 - Startup: Spyware Doctor.lnk = C:\Program Files\Spyware Doctor\swdoctor.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Subliminal Blaster.lnk = C:\Program Files\Subliminal Blaster 2.0\subliminalblaster.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1160874555187
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161492703805
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://64.21.226.243/activex/AMC.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Groove Games Licensing Service - Groove Games - C:\Program Files\Common Files\Groove Games Shared\Service\ggameslicsvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

–
End of file - 12499 bytes

I've tried scanning with GMER at least 3 times now. When I return to the PC, it seems to crash by the time the scan is completed. It refuses to accept any mouse or keyboard input. DDS.txt: DDS (Ver_09-05-14.01) - NTFSx86 Run by [removed] at 20:35:17.34 on Wed 06/17/2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.517 [GMT -4:00] AV: Norton AntiVirus *On-access scanning disabled* (Outdated) {B5510F6F-87E1-47F7-A411-360BC453007C} FW: Norton Internet Security *disabled* {E641AC2D-955F-4A05-ABE7-F9C534ABDB46} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Norton Internet Security\NISUM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Norton Internet Security\ccPxySvc.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\System32\lxbucoms.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Symantec\LiveUpdate\AUpdate.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\ezSP_Px.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Lexmark 6200 Series\lxbumon.exe C:\Program Files\Lexmark 6200 Series\ezprint.exe C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe D:\program files\SpywareGuard\sgmain.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Dan\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.sony.com/vaiopeople uInternet Settings,ProxyOverride = *.local mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: MyIdentityDefender: {a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} - c:\documents and settings\george\local settings\application data\cyberdefender\cdmyidd.dll BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll BHO: 1 (0x1) - No File BHO: CNavExtBho Class: {bdf3e430-b101-42ad-a544-fadc6b084872} - c:\program files\norton antivirus\NavShExt.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll BHO: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No File TB: Norton AntiVirus: {42cdd1bf-3ffb-4238-8ad1-7859df00b1d6} - c:\program files\norton antivirus\NavShExt.dll TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll TB: MyIdentityDefender: {a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} - c:\documents and settings\george\local settings\application data\cyberdefender\cdmyidd.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\dan\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [Aim6] uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [ATIModeChange] Ati2mdxx.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /installquiet mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe mRun: [ZTgServerSwitch] "c:\program files\support.com\client\bin\tgcmd.exe" /server mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [CTHelper] CTHELPER.EXE mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [ccRegVfy] "c:\program files\common files\symantec shared\ccRegVfy.exe" mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe mRun: [LXBUCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXBUtime.dll,_RunDLLEntry@16 mRun: [lxbumon.exe] "c:\program files\lexmark 6200 series\lxbumon.exe" mRun: [FaxCenterServer] "c:\program files\lexmark fax solutions\fm3032.exe" /s mRun: [] mRun: [EzPrint] "c:\program files\lexmark 6200 series\ezprint.exe" mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u dRunOnce: [SetDefaultMidi] MIDIDEF.EXE uExplorerRun: [Systems Update] c:\program files\common files\services\s-1-5-21-1303342014-1704936951-537590071-0504\lsasvc.exe StartupFolder: c:\docume~1\dan\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.3\program\quickstart.exe StartupFolder: c:\docume~1\dan\startm~1\programs\startup\spywar~1.lnk - d:\program files\spywareguard\sgmain.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\billmi~1.lnk - c:\program files\quicken\billmind.exe IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim95\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197607749640 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\dan\applic~1\mozilla\firefox\profiles\xd15le4q.default\ FF - plugin: c:\documents and settings\dan\local settings\application data\google\update\1.2.145.5\npGoogleOneClick8.dll FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\photosynth\npPhotosynthMozilla.dll FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll —- FIREFOX POLICIES —- FF - user.js: yahoo.homepage.dontask - true ============= SERVICES / DRIVERS =============== R1 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2009-1-3 69224] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-5-26 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-5-26 72944] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2003-2-21 316672] R2 ccPxySvc;Symantec Proxy Service;c:\program files\norton internet security\ccPxySvc.exe [2003-3-3 34040] R2 SAVRTPEL;SAVRTPEL;c:\windows\system32\drivers\SAVRTPEL.SYS [2002-7-25 35552] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-12-13 24652] R3 RapportKE;RapportKE;c:\program files\trusteer\rapport\bin\RapportKE.sys [2009-1-3 106472] R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-5-26 7408] S2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-5-11 234888] S2 mrtRate;mrtRate; [x] S3 ccPwdSvc;Symantec Password Validation Service;c:\program files\common files\symantec shared\ccPwdSvc.exe [2003-3-3 99576] S3 navapsvc;Norton AntiVirus Auto Protect Service;c:\program files\norton antivirus\Navapsvc.exe [2003-3-3 115872] S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20080312.003\NAVENG.Sys [2008-3-12 82256] S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20080312.003\NavEx15.Sys [2008-3-12 895408] S3 SAVRT;SAVRT;c:\windows\system32\drivers\SAVRT.SYS [2002-7-25 235744] =============== Created Last 30 ================ 2009-06-15 09:28 –d—– c:\docume~1\alluse~1\applic~1\Azureus 2009-06-15 09:27 –d—– c:\program files\Vuze 2009-06-14 17:15 –d—– c:\program files\CCleaner 2009-06-14 15:51 –d—– c:\docume~1\dan\applic~1\Malwarebytes 2009-06-14 15:51 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-14 15:51 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-06-14 15:51 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-06-14 15:51 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-06-14 13:10 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2009-06-14 13:10 –d—– c:\program files\SUPERAntiSpyware 2009-06-14 13:10 –d—– c:\docume~1\dan\applic~1\SUPERAntiSpyware.com 2009-06-14 13:09 –d—– c:\program files\common files\Wise Installation Wizard 2009-06-14 11:51 –d—– c:\docume~1\dan\applic~1\QQ Games Plugin 2009-06-13 17:08 –d—– c:\docume~1\alluse~1\applic~1\98178276 2009-06-13 13:47 –d—– c:\program files\Tencent 2009-06-13 13:47 –d—– c:\docume~1\alluse~1\applic~1\Tencent 2009-06-04 15:41 56 a—h— c:\windows\system32\ezsidmv.dat 2009-06-04 15:39 –d–r– c:\program files\Skype 2009-05-30 23:54 –d—– c:\program files\HyCam2 2009-05-30 18:37 –d—– c:\program files\Microsoft Kids 2009-05-24 20:13 –d-h— c:\windows\PIF ==================== Find3M ==================== 2009-05-07 11:44 344,064 a——- c:\windows\system32\localspl.dll 2009-04-29 00:56 827,392 a——- c:\windows\system32\wininet.dll 2009-04-29 00:55 78,336 a——- c:\windows\system32\ieencode.dll 2009-04-17 05:58 1,846,656 a——- c:\windows\system32\win32k.sys 2009-04-15 16:24 90,112 a——- c:\windows\system32\dpl100.dll 2009-04-15 16:24 823,296 a——- c:\windows\system32\divx_xx0c.dll 2009-04-15 16:24 823,296 a——- c:\windows\system32\divx_xx07.dll 2009-04-15 16:24 815,104 a——- c:\windows\system32\divx_xx0a.dll 2009-04-15 16:24 802,816 a——- c:\windows\system32\divx_xx11.dll 2009-04-15 16:24 684,032 a——- c:\windows\system32\DivX.dll 2009-04-15 11:11 584,192 a——- c:\windows\system32\rpcrt4.dll 2007-12-13 19:09 32 a–sh— c:\windows\{369E1060-78F8-42C0-BF0D-B952002141D6}.dat 2007-12-13 19:10 32 a–sh— c:\windows\{B400C221-1896-4500-B0B3-94FC46A96273}.dat 2007-12-13 19:10 32 a–sh— c:\windows\system32\{31445233-96EC-4031-A87E-BDC362BD647D}.dat 2007-12-13 19:09 32 a–sh— c:\windows\system32\{6277328A-3BA5-49F8-816B-E13ADB0754D0}.dat ============= FINISH: 20:38:10.48 ===============

For what it's worth, I finally managed to get a hold of GMER.txt after 4 or 5 tries. Here it is, along with the Combofix report:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-19 11:59:45
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.15 —-

Code 86C65C78 ZwEnumerateKey
Code 86808448 ZwFlushInstructionCache
Code 86C6625E IofCallDriver
Code 86C670B6 IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!IofCallDriver 804E13A7 5 Bytes JMP 86C66263
.text ntoskrnl.exe!IofCompleteRequest 804E17BD 5 Bytes JMP 86C670BB
PAGE ntoskrnl.exe!ZwEnumerateKey 805783A4 5 Bytes JMP 86C65C7C
PAGE ntoskrnl.exe!ZwFlushInstructionCache 80585F1C 5 Bytes JMP 8680844C

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\System32\nvsvc32.exe[112] ntdll.dll!LdrLoadDll 7C915CBB 5 Bytes JMP 006A000A
.text C:\Program Files\Norton Internet Security\NISUM.EXE[196] ntdll.dll!LdrLoadDll 7C915CBB 5 Bytes JMP 00A4000A
.text C:\WINDOWS\System32\svchost.exe[500] ntdll.dll!LdrLoadDll 7C915CBB 5 Bytes JMP 0075000A
.text C:\WINDOWS\System32\svchost.exe[512] ntdll.dll!LdrLoadDll 7C915CBB 5 Bytes JMP 0075000A
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[608] ntdll.dll!LdrLoadDll 7C915CBB 5 Bytes JMP 00A4000A
.text …

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\SKYNETmjdvjenr.sys (*** hidden *** ) [SYSTEM] SKYNETxsstpotu <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu@imagepath \systemroot\system32\drivers\SKYNETmjdvjenr.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main@aid 10037
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main@sid 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main@cmddelay 7200
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main\connections
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main\injector@* SKYNETwsp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\[removed] \systemroot\system32\drivers\SKYNETmjdvjenr.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\[removed] \systemroot\system32\SKYNETldouwmcc.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\[removed] \systemroot\system32\SKYNETqnxyouoe.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\[removed] \systemroot\system32\SKYNETppqdxpnd.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETxsstpotu\[removed] \systemroot\system32\SKYNETiaqlcwge.dat
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu@imagepath \systemroot\system32\drivers\SKYNETmjdvjenr.sys
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main@aid 10037
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main@sid 0
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main@cmddelay 7200
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main\connections
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main\delete
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main\injector
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main\injector@* SKYNETwsp.dll
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\main\tasks
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\modules
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\[removed] \systemroot\system32\drivers\SKYNETmjdvjenr.sys
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\[removed] \systemroot\system32\SKYNETldouwmcc.dll
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\[removed] \systemroot\system32\SKYNETqnxyouoe.dat
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\[removed] \systemroot\system32\SKYNETppqdxpnd.dll
Reg HKLM\SYSTEM\ControlSet002\Services\SKYNETxsstpotu\[removed] \systemroot\system32\SKYNETiaqlcwge.dat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@NoChange 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skynet-laboratory.com
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skynet-laboratory.com@* 4
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skynet-laboratory.org
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skynet-laboratory.org@* 4

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\SKYNETldouwmcc.dll 44544 bytes executable
File C:\WINDOWS\system32\SKYNETppqdxpnd.dll 19968 bytes executable
File C:\WINDOWS\system32\SKYNETqnxyouoe.dat 193061 bytes
File C:\WINDOWS\system32\drivers\SKYNETmjdvjenr.sys 69120 bytes executable <– ROOTKIT !!!
File C:\WINDOWS\Temp\SKYNETfshdcvnbss.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETfviopirbqm.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETfwxrsaceau.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETgewrljtlbx.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETgqfuymsbcr.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNEThmoyvuvepy.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETikcitrxiqu.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETipwefhtqqg.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETjhhwqebqon.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETjismqhektu.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETkcapfsoplk.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETkdruuknbfv.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETkrvbqhpjik.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETkxcjiaoeys.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETlxjxtatbhb.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETlykaemstti.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETmbffyvtdwr.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETmhaglyifrd.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETmjrncitrds.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETmmbtajrvah.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETmoqactxtde.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETmpbddtcnva.tmp 20992 bytes executable
File C:\WINDOWS\Temp\sos29C.tmp 278070 bytes
File C:\WINDOWS\Temp\sos29D.tmp 5056 bytes
File C:\WINDOWS\Temp\Temporary Internet Files 0 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5 0 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini 67 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6 0 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-5475.English[1].dist 27494 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-3638.English[1].dist 18179 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-4200.English[1].dist 6293 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-4249.English[1].dist 6025 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-4512.English[1].dist 6760 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-4513.English[1].dist 6869 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-4514.English[1].dist 6484 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-4638.English[1].dist 33351 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-4708.English[1].dist 24639 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-4834.English[1].dist 27446 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-5351.English[1].dist 17924 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-5814.English[1].dist 33892 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-5844.English[1].dist 17140 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-5849.English[1].dist 3161 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-5859.English[1].dist 33164 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-6107.English[1].dist 27226 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-6202.English[1].dist 17144 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-6273.English[1].dist 17079 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\061-6667.English[1].dist 33042 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\Bonjour[1].msi 2357760 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\btn92x25Over[1] 1076 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\desktop.ini 67 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G65QNPV6\small_header[1] 26311 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat 65536 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ 0 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4026.English[1].dist 24340 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4457.English[1].dist 24716 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4608.English[1].dist 18478 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4639.English[1].dist 32747 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4664.English[1].dist 25456 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4827.English[1].dist 18669 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4828.English[1].dist 18660 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4835.English[1].dist 26292 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-4972.English[1].dist 17087 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-5449.English[1].dist 27574 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-5527.English[1].dist 33674 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-5815.English[1].dist 33164 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-5850.English[1].dist 17749 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-5926.English[1].dist 27394 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-6116.English[1].dist 24791 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-6174.English[1].dist 34010 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-6274.English[1].dist 17070 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\061-6684.English[1].dist 28797 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\alert[2] 3500 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\AppleMobileDeviceSupport[1].msi 13878272 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\desktop.ini 67 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\iTunesSetupAdmin[1].exe 79144 bytes executable
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U6A057SJ\xpButton[1] 3285 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R 0 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-5350.English[1].dist 17918 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-2802.English[1].dist 16876 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-3452.English[1].dist 3742 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-3637.English[1].dist 18178 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-3965.English[1].dist 18272 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-4609.English[1].dist 18471 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-4633.English[1].dist 26292 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-5118.English[1].dist 32042 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-5345.English[1].dist 17089 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-5790.English[1].dist 17755 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-5798.English[1].dist 17219 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-5843.English[1].dist 17149 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-5858.English[1].dist 33892 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-5969.English[1].dist 17718 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-6193.English[1].dist 33281 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-6201.English[1].dist 17153 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-6236.English[1].dist 18218 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\061-6666.English[1].dist 33769 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\btn92x25Focused[2] 1199 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\btn92x25Pressed[1] 844 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\desktop.ini 67 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\index-windows-1[1].sucatalog 73186 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W1V98P8R\spacer[1] 43 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G 0 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-5344.English[1].dist 17108 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-3872.English[1].dist 17006 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-3964.English[1].dist 18279 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-4212.English[1].dist 20136 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-4339.English[1].dist 17288 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-4603.English[1].dist 27444 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-4642.English[1].dist 24669 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-5117.English[1].dist 32734 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-5374.English[1].dist 24564 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-5528.English[1].dist 32946 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-5797.English[1].dist 17234 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-5807.English[1].dist 27138 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-6175.English[1].dist 33282 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-6192.English[1].dist 34009 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-6235.English[1].dist 18227 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\061-6310.English[1].dist 17941 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\alert[1] 2833 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\btn92x25[1] 976 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\desktop.ini 67 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\dot[2] 332 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\iTunes[1].msi 26833408 bytes
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\W5VEMX9G\ssc[2] 1656 bytes
File C:\WINDOWS\Temp\WGAErrLog.txt 483 bytes
File C:\WINDOWS\Temp\WLTB Custom Button Feeds 0 bytes
File C:\WINDOWS\Temp\_ISTMP0.DIR 0 bytes
File C:\WINDOWS\Temp\SKYNETnixbtifbhy.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETnkcitrxiqu.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETnqsmkiaavx.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETnrqrperpor.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETocaxtgduca.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETocdjxlvvjo.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETprjorwlnuf.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETqudvxkkeqa.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETregsgidyop.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETrtcjentpev.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETsqhdyoouof.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETthqogoicxj.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETtntxylprxt.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETucbgudvfki.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETuxcqduxneb.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETvbpqispviw.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETvfxvrecxns.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETvpiogwcotj.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETvrwddfanwc.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETwdtidacndy.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETwmvxnypjub.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETwwtattlrpv.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETxbdmexmspj.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETxretvxixfv.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETxtuefjpced.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETxvpofvrnss.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETybaopaiuxh.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETytfqjuylji.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETfguqmfvkql.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETnfwqugjrno.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETacggvmokxg.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETaevlrfpnaj.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETapulqipyra.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETaxvbdwprph.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETbfgoibcjix.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETbxtfwkrywx.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETcgmymomiaa.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETcyiriubopi.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETcynxbqphsh.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETeckdjpjgbn.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETegiooifvlu.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETeomtbempxo.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETerxmgopggr.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETetwdalphfu.tmp 20992 bytes executable
File C:\WINDOWS\Temp\SKYNETfeptjynfpy.tmp 20992 bytes executable

—- EOF - GMER 1.0.15 —-

The following files were mentioned in the rootkit prompt while running Combofix:

C:\WINDOWS\system32\drivers\SKYNETmjdvjenr.sys
C:\WINDOWS\system32\SKYNETldouwmcc.dll
C:\WINDOWS\system32\SKYNETqnxyouoe.dat
C:\WINDOWS\system32\SKYNETppqdxpnd.dll
C:\WINDOWS\system32\SKYNETiaqlcwge.dat

Combofix.txt:

ComboFix 09-06-18.02 - Dan 06/19/2009 13:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.734 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Outdated) {B5510F6F-87E1-47F7-A411-360BC453007C}
FW: Norton Internet Security *disabled* {E641AC2D-955F-4A05-ABE7-F9C534ABDB46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1920559593-4246537333-724126164-500
c:\recycler\S-1-5-21-209492073-3674133416-1378050517-500
c:\recycler\S-1-5-21-2116335978-2157533855-1313663921-500
c:\recycler\S-1-5-21-2143598644-3687302534-3303579826-500
c:\recycler\S-1-5-21-2418363999-1349117539-4091102717-500
c:\recycler\S-1-5-21-3099799160-3138980496-2031538576-500
c:\recycler\S-1-5-21-3554469320-1591296024-4123393706-500
c:\recycler\S-1-5-21-3906940580-1136378138-784388141-500
c:\recycler\S-1-5-21-484763869-1275210071-839522115-500
c:\recycler\S-1-5-21-5493846154-6952851705-172906215-8328
c:\recycler\S-1-5-21-713641079-2050230182-2779886532-500
c:\recycler\S-1-5-21-787292248-2873537835-3433591878-500
c:\recycler\S-1-5-21-1920559593-4246537333-724126164-500\desktop.ini
c:\recycler\S-1-5-21-1920559593-4246537333-724126164-500\INFO2
c:\recycler\S-1-5-21-209492073-3674133416-1378050517-500\desktop.ini
c:\recycler\S-1-5-21-209492073-3674133416-1378050517-500\INFO2
c:\recycler\S-1-5-21-2116335978-2157533855-1313663921-500\desktop.ini
c:\recycler\S-1-5-21-2116335978-2157533855-1313663921-500\INFO2
c:\recycler\S-1-5-21-2143598644-3687302534-3303579826-500\desktop.ini
c:\recycler\S-1-5-21-2143598644-3687302534-3303579826-500\INFO2
c:\recycler\S-1-5-21-2418363999-1349117539-4091102717-500\desktop.ini
c:\recycler\S-1-5-21-2418363999-1349117539-4091102717-500\INFO2
c:\recycler\S-1-5-21-3099799160-3138980496-2031538576-500\desktop.ini
c:\recycler\S-1-5-21-3099799160-3138980496-2031538576-500\INFO2
c:\recycler\S-1-5-21-3554469320-1591296024-4123393706-500\desktop.ini
c:\recycler\S-1-5-21-3554469320-1591296024-4123393706-500\INFO2
c:\recycler\S-1-5-21-3906940580-1136378138-784388141-500\desktop.ini
c:\recycler\S-1-5-21-3906940580-1136378138-784388141-500\INFO2
c:\recycler\S-1-5-21-484763869-1275210071-839522115-500\desktop.ini
c:\recycler\S-1-5-21-484763869-1275210071-839522115-500\INFO2
c:\recycler\S-1-5-21-5493846154-6952851705-172906215-8328\Desktop.ini
c:\recycler\S-1-5-21-713641079-2050230182-2779886532-500\desktop.ini
c:\recycler\S-1-5-21-713641079-2050230182-2779886532-500\INFO2
c:\recycler\S-1-5-21-787292248-2873537835-3433591878-500\desktop.ini
c:\recycler\S-1-5-21-787292248-2873537835-3433591878-500\INFO2
c:\windows\system32\404Fix.exe
c:\windows\system32\drivers\SKYNETmjdvjenr.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\Process.exe
c:\windows\system32\SKYNETiaqlcwge.dat
c:\windows\system32\SKYNETldouwmcc.dll
c:\windows\system32\SKYNETppqdxpnd.dll
c:\windows\system32\SKYNETqnxyouoe.dat
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_SKYNETxsstpotu


((((((((((((((((((((((((( Files Created from 2009-05-19 to 2009-06-19 )))))))))))))))))))))))))))))))
.

2009-06-18 03:44 . 2009-06-18 03:44 ——– d—–w- c:\documents and settings\Dan\Local Settings\Application Data\Apple
2009-06-15 13:28 . 2009-06-15 13:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Azureus
2009-06-15 13:28 . 2009-06-15 13:44 ——– d—–w- c:\documents and settings\Andrew\Application Data\Azureus
2009-06-15 13:27 . 2009-06-15 13:28 ——– d—–w- c:\program files\Vuze
2009-06-14 21:15 . 2009-06-14 21:15 ——– d—–w- c:\program files\CCleaner
2009-06-14 19:51 . 2009-06-14 19:51 ——– d—–w- c:\documents and settings\Dan\Application Data\Malwarebytes
2009-06-14 19:51 . 2009-05-26 17:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-14 19:51 . 2009-06-14 19:51 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-14 19:51 . 2009-06-14 19:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-14 19:51 . 2009-05-26 17:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-14 18:01 . 2009-06-19 05:09 117760 —-a-w- c:\documents and settings\Dan\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-14 17:10 . 2009-06-14 17:10 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-14 17:10 . 2009-06-14 17:10 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-06-14 17:10 . 2009-06-14 17:10 ——– d—–w- c:\documents and settings\Dan\Application Data\SUPERAntiSpyware.com
2009-06-14 17:09 . 2009-06-14 17:09 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-06-14 15:51 . 2009-06-14 15:52 ——– d—–w- c:\documents and settings\Dan\Application Data\QQ Games Plugin
2009-06-14 12:51 . 2009-06-14 12:51 ——– d—–w- c:\documents and settings\Andrew\Application Data\QQ Games Plugin
2009-06-14 12:42 . 2009-06-14 12:42 ——– d—–w- c:\documents and settings\Andrew\Application Data\Yahoo!
2009-06-14 00:35 . 2009-06-14 00:35 ——– d—–w- c:\documents and settings\Lindsay\Application Data\QQ Games Plugin
2009-06-13 21:21 . 2009-06-13 21:21 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-06-13 21:08 . 2009-06-14 19:42 ——– d—–w- c:\documents and settings\All Users\Application Data\98178276
2009-06-13 17:47 . 2009-06-13 17:47 ——– d—–w- c:\program files\Tencent
2009-06-13 17:47 . 2009-06-13 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Tencent
2009-06-11 11:08 . 2009-06-11 11:08 50320 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-04 19:41 . 2009-06-04 19:41 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-06-04 19:40 . 2009-06-18 19:27 ——– d—–w- c:\documents and settings\Lindsay\Application Data\skypePM
2009-06-04 19:39 . 2009-06-18 19:28 ——– d—–w- c:\documents and settings\Lindsay\Application Data\Skype
2009-06-04 19:39 . 2009-06-04 19:39 ——– d—–w- c:\program files\Common Files\Skype
2009-06-04 19:39 . 2009-06-04 19:39 ——– d—–r- c:\program files\Skype
2009-06-04 19:38 . 2009-06-04 19:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-06-04 16:31 . 2009-06-04 16:31 ——– d—–w- c:\documents and settings\Dan\Application Data\acccore
2009-06-04 16:31 . 2009-06-04 16:31 ——– d—–w- c:\documents and settings\Dan\Local Settings\Application Data\AOL OCP
2009-06-04 16:31 . 2009-06-04 16:31 ——– d—–w- c:\documents and settings\Dan\Local Settings\Application Data\AOL
2009-05-31 03:54 . 2009-05-31 03:54 ——– d—–w- c:\program files\HyCam2
2009-05-30 22:37 . 2009-05-30 22:37 ——– d—–w- c:\program files\Microsoft Kids
2009-05-25 00:13 . 2009-05-25 00:13 ——– d–h–w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-19 17:36 . 2007-12-13 22:57 288 —-a-w- c:\windows\system32\DVCStateBkp-{00000003-00000000-0000000A-00001102-00000004-00541102}.dat
2009-06-19 17:36 . 2007-12-13 22:57 288 —-a-w- c:\windows\system32\DVCState-{00000003-00000000-0000000A-00001102-00000004-00541102}.dat
2009-06-19 16:15 . 2007-12-13 23:08 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-06-18 22:29 . 2007-12-17 20:04 50320 —-a-w- c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-18 15:21 . 2007-12-13 23:08 ——– d—–w- c:\program files\Norton AntiVirus
2009-06-16 22:47 . 2008-06-06 22:01 ——– d—–w- c:\documents and settings\Lindsay\Application Data\OpenOffice.org2
2009-06-16 21:43 . 2008-10-04 18:20 1 —-a-w- c:\documents and settings\Lindsay\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-06-15 13:45 . 2009-05-11 21:36 ——– d—–w- c:\documents and settings\Lindsay\Application Data\uTorrent
2009-06-15 12:36 . 2008-01-09 11:39 1 —-a-w- c:\documents and settings\Andrew\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-06-15 12:08 . 2008-01-09 11:38 ——– d—–w- c:\documents and settings\Andrew\Application Data\OpenOffice.org2
2009-06-14 15:51 . 2009-03-31 03:11 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-14 00:36 . 2008-02-17 02:00 ——– d—–w- c:\program files\AIMTunes
2009-06-14 00:32 . 2009-03-31 03:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-14 00:31 . 2007-12-14 02:32 ——– d—–w- c:\program files\AIM6
2009-06-13 17:47 . 2008-02-17 02:00 5946704 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimqqgames\QQSetup65.exe
2009-06-13 17:46 . 2008-02-17 02:00 1144808 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\aimtunes\AIMTunes.exe
2009-06-13 17:45 . 2007-12-14 02:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-05-16 03:21 . 2009-05-16 03:21 ——– d—–w- c:\program files\Gabest
2009-05-16 03:02 . 2008-01-26 06:32 ——– d—–w- c:\documents and settings\Lindsay\Application Data\DivX
2009-05-16 02:40 . 2008-01-07 00:24 ——– d—–w- c:\program files\DivX
2009-05-16 02:39 . 2009-04-21 00:33 ——– d—–w- c:\program files\Mozilla Thunderbird
2009-05-16 02:39 . 2009-05-16 02:39 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-05-12 23:16 . 2009-05-12 23:16 ——– d—–w- c:\documents and settings\Lindsay\Application Data\vlc
2009-05-11 21:36 . 2009-05-11 21:36 ——– d—–w- c:\program files\AskBarDis
2009-05-11 21:36 . 2009-05-11 21:36 ——– d—–w- c:\program files\uTorrent
2009-05-07 15:44 . 2003-08-18 22:02 344064 —-a-w- c:\windows\system32\localspl.dll
2009-05-06 20:04 . 2009-05-06 20:04 ——– d—–w- c:\program files\Coupons
2009-04-29 04:56 . 2006-06-23 16:33 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-25 13:27 . 2009-04-25 13:27 ——– d—–w- c:\program files\Ask Search Assistant
2009-04-25 13:27 . 2009-01-03 02:06 ——– d—–w- c:\program files\Messenger Plus! Live
2009-04-24 04:07 . 2009-04-24 04:07 1878984 —-a-w- c:\documents and settings\George\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-04-21 00:33 . 2009-04-21 00:33 ——– d—–w- c:\documents and settings\George\Application Data\Thunderbird
2009-04-17 09:58 . 2003-08-18 22:02 1846656 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 20:24 . 2009-04-15 20:24 90112 —-a-w- c:\windows\system32\dpl100.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 —-a-w- c:\windows\system32\divx_xx0c.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 —-a-w- c:\windows\system32\divx_xx07.dll
2009-04-15 20:24 . 2009-04-15 20:24 815104 —-a-w- c:\windows\system32\divx_xx0a.dll
2009-04-15 20:24 . 2009-04-15 20:24 802816 —-a-w- c:\windows\system32\divx_xx11.dll
2009-04-15 20:24 . 2009-04-15 20:24 684032 —-a-w- c:\windows\system32\DivX.dll
2009-04-15 15:11 . 2004-03-06 02:16 584192 —-a-w- c:\windows\system32\rpcrt4.dll
2009-04-10 21:59 . 2009-04-10 21:59 15240 —-a-w- c:\documents and settings\Lindsay\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll
2009-03-27 14:58 . 2009-03-27 14:58 503808 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-34d5d5ca-n\msvcp71.dll
2009-03-27 14:58 . 2009-03-27 14:58 499712 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-34d5d5ca-n\jmc.dll
2009-03-27 14:58 . 2009-03-27 14:58 348160 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-34d5d5ca-n\msvcr71.dll
2009-03-27 14:56 . 2009-03-27 14:56 152576 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-15 20:24 . 2009-04-15 20:24 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-12-13 23:09 . 2007-12-13 23:09 32 –sha-w- c:\windows\{369E1060-78F8-42C0-BF0D-B952002141D6}.dat
2007-12-13 23:10 . 2007-12-13 23:10 32 –sha-w- c:\windows\{B400C221-1896-4500-B0B3-94FC46A96273}.dat
2007-12-13 23:10 . 2007-12-13 23:10 32 –sha-w- c:\windows\system32\{31445233-96EC-4031-A87E-BDC362BD647D}.dat
2007-12-13 23:09 . 2007-12-13 23:09 32 –sha-w- c:\windows\system32\{6277328A-3BA5-49F8-816B-E13ADB0754D0}.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6}]
2009-04-02 21:14 3958088 —-a-w- c:\documents and settings\George\Local Settings\Application Data\CyberDefender\cdmyidd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Google Update"="c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-25 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-06 335872]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-07-16 4743168]
"ezShieldProtector for Px"="c:\windows\System32\ezSP_Px.exe" [2002-08-20 40960]
"ZTgServerSwitch"="c:\program files\support.com\client\bin\tgcmd.exe" [2003-06-24 1409024]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2003-03-03 54520]
"ccRegVfy"="c:\program files\Common Files\Symantec Shared\ccRegVfy.exe" [2003-03-03 58616]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"LXBUCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-08-20 65536]
"lxbumon.exe"="c:\program files\Lexmark 6200 Series\lxbumon.exe" [2004-08-20 188416]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-08-24 299008]
"EzPrint"="c:\program files\Lexmark 6200 Series\ezprint.exe" [2004-08-24 61440]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-03-22 1191936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-07-16 323584]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\cthelper.exe [2003-07-03 28672]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2003-05-23 88363]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SetDefaultMidi"="MIDIDEF.EXE" - c:\windows\mididef.exe [2003-07-03 49152]

c:\documents and settings\Andrew\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]

c:\documents and settings\Lindsay\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Billminder.lnk - c:\program files\Quicken\billmind.exe [2002-9-20 36864]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Startup.lnk
backup=c:\windows\pss\Quicken Startup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\support.com\\client\\bin\\tgcmd.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Documents and Settings\\Lindsay\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [1/3/2009 10:17 AM 69224]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 ccPxySvc;Symantec Proxy Service;c:\program files\Norton Internet Security\ccPxySvc.exe [3/3/2003 2:05 PM 34040]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/13/2007 10:33 PM 24652]
R3 RapportKE;RapportKE;c:\program files\Trusteer\Rapport\bin\RapportKE.sys [1/3/2009 10:17 AM 106472]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [5/11/2009 5:36 PM 234888]
S2 mrtRate;mrtRate; [x]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-06-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-19 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 16:20]

2009-06-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1255920486-560898740-3130408052-1005.job
- c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-25 04:18]

2009-06-13 c:\windows\Tasks\Norton AntiVirus - Scan my computer.job
- c:\progra~1\NORTON~1\NAVW32.exe [2003-03-03 18:06]

2009-06-19 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2007-12-13 14:04]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
HKCU-Explorer_Run-Systems Update - c:\program files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\lsasvc.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-19 13:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBUCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …


c:\docume~1\Dan\LOCALS~1\Temp\catchme.dll 53248 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(716)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-06-19 13:57
ComboFix-quarantined-files.txt 2009-06-19 17:57

Pre-Run: 648,384,512 bytes free
Post-Run: 4,838,088,704 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

317 — E O F — 2009-06-10 07:04

VirSCAN.org Scanned Report :
Scanned time : 2009/06/19 17:18:33 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : {369E1060-78F8-42C0-BF0D-B952002141D6}.dat
File Size : 32 byte
File Type : Non-ISO extended-ASCII text, with no line terminators
MD5 : 787bac3b1dde5af2124020df96c5350c
SHA1 : d702f226142d56bd10a02d391ae850b5493bf313
Online report : http://virscan.org/report/6b90f24998bef59e…1a8037fc7d.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.1 20090619170318 2009-06-19 2.23 -
AhnLab V3 2009.06.20.00 2009.06.20 2009-06-20 0.76 -
AntiVir 8.2.0.193 7.1.4.117 2009-06-19 0.07 -
Antiy 2.0.18 2.0.18. 0002-18-00 0.12 -
Arcavir 2009 200906191229 2009-06-19 0.02 -
Authentium 5.1.1 200906191513 2009-06-19 1.14 -
AVAST! 4.7.4 090618-0 2009-06-18 0.00 -
AVG 8.5.286 270.12.81/2188 2009-06-20 3.38 -
BitDefender 7.81008.3439163 7.26075 2009-06-20 3.10 -
CA (VET) 9.0.0.143 31.6.6568 2009-06-19 5.76 -
ClamAV 0.95.1 9487 2009-06-19 0.00 -
Comodo 3.9 1374 2009-06-19 0.81 -
CP Secure 1.1.0.715 2009.06.20 2009-06-20 10.26 -
Dr.Web 4.44.0.9170 2009.06.19 2009-06-19 4.73 -
F-Prot 4.4.4.56 20090619 2009-06-19 1.12 -
F-Secure 5.51.6100 2009.06.19.02 2009-06-19 5.99 -
Fortinet 2.81-3.117 10.514 2009-06-19 0.16 -
GData 19.5922/19.368 20090619 2009-06-19 4.32 -
ViRobot 20090619 2009.06.19 2009-06-19 0.43 -
Ikarus T3.1.01.59 2009.06.19.72893 2009-06-19 3.26 -
JiangMin 11.0.706 2009.06.19 2009-06-19 2.24 -
Kaspersky 5.5.10 2009.06.19 2009-06-19 0.02 -
KingSoft 2009.2.5.15 2009.6.19.21 2009-06-19 0.49 -
McAfee 5.3.00 5651 2009-06-19 3.03 -
Microsoft 1.4803 2009.06.19 2009-06-19 4.78 -
mks_vir 2.01 2009.06.19 2009-06-19 3.15 -
Norman 6.01.09 6.01.00 2009-06-19 4.00 -
Panda 9.05.01 2009.06.19 2009-06-19 1.67 -
Trend Micro 8.700-1004 6.208.06 2009-06-19 0.02 -
Quick Heal 10.00 2009.06.19 2009-06-19 1.17 -
Rising 20.0 21.34.44.00 2009-06-19 0.26 -
Sophos 2.87.1 4.42 2009-06-20 2.52 -
Sunbelt 5198 5198 2009-06-19 0.83 -
Symantec 1.3.0.24 20090619.004 2009-06-19 0.35 -
nProtect 20090619.01 4366732 2009-06-19 5.47 -
The Hacker 6.3.4.3 v00348 2009-06-17 0.60 -
VBA32 3.12.10.7 20090618.1511 2009-06-18 1.99 -
VirusBuster 4.5.11.10 10.107.18/1647938 2009-06-19 1.99 -


VirSCAN.org Scanned Report :
Scanned time : 2009/06/19 17:22:37 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : {B400C221-1896-4500-B0B3-94FC46A96273}.dat
File Size : 32 byte
File Type : data
MD5 : 2389c9781ebd88fc52fb9fd3d192656b
SHA1 : 308ac122ee40ba10454ab960a3605153d2b3e911
Online report : http://virscan.org/report/70428a04cc2e31ae…3694cedb1f.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.1 20090619170318 2009-06-19 2.30 -
AhnLab V3 2009.06.20.00 2009.06.20 2009-06-20 0.73 -
AntiVir 8.2.0.193 7.1.4.117 2009-06-19 0.47 -
Antiy 2.0.18 2.0.18. 0002-18-00 0.12 -
Arcavir 2009 200906191229 2009-06-19 0.03 -
Authentium 5.1.1 200906191759 2009-06-19 1.13 -
AVAST! 4.7.4 090618-0 2009-06-18 0.00 -
AVG 8.5.286 270.12.81/2188 2009-06-20 3.37 -
BitDefender 7.81008.3439163 7.26075 2009-06-20 3.10 -
CA (VET) 9.0.0.143 31.6.6568 2009-06-19 5.04 -
ClamAV 0.95.1 9487 2009-06-19 0.00 -
Comodo 3.9 1374 2009-06-19 0.74 -
CP Secure 1.1.0.715 2009.06.20 2009-06-20 10.46 -
Dr.Web 4.44.0.9170 2009.06.19 2009-06-19 4.72 -
F-Prot 4.4.4.56 20090619 2009-06-19 1.12 -
F-Secure 5.51.6100 2009.06.19.02 2009-06-19 1.50 -
Fortinet 2.81-3.117 10.514 2009-06-19 0.15 -
GData 19.5922/19.368 20090619 2009-06-19 4.89 -
ViRobot 20090619 2009.06.19 2009-06-19 0.44 -
Ikarus T3.1.01.59 2009.06.19.72893 2009-06-19 3.32 -
JiangMin 11.0.706 2009.06.19 2009-06-19 2.23 -
Kaspersky 5.5.10 2009.06.19 2009-06-19 0.02 -
KingSoft 2009.2.5.15 2009.6.19.21 2009-06-19 0.50 -
McAfee 5.3.00 5651 2009-06-19 3.11 -
Microsoft 1.4803 2009.06.19 2009-06-19 4.80 -
mks_vir 2.01 2009.06.19 2009-06-19 3.13 -
Norman 6.01.09 6.01.00 2009-06-19 4.01 -
Panda 9.05.01 2009.06.19 2009-06-19 1.91 -
Trend Micro 8.700-1004 6.208.06 2009-06-19 0.02 -
Quick Heal 10.00 2009.06.19 2009-06-19 1.21 -
Rising 20.0 21.34.44.00 2009-06-19 0.27 -
Sophos 2.87.1 4.42 2009-06-20 2.52 -
Sunbelt 5198 5198 2009-06-19 0.84 -
Symantec 1.3.0.24 20090619.004 2009-06-19 0.21 -
nProtect 20090619.01 4366732 2009-06-19 5.66 -
The Hacker 6.3.4.3 v00348 2009-06-17 0.60 -
VBA32 3.12.10.7 20090618.1511 2009-06-18 1.99 -
VirusBuster 4.5.11.10 10.107.18/1647938 2009-06-19 2.03 -

VirSCAN.org Scanned Report :
Scanned time : 2009/06/19 17:25:53 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : {31445233-96EC-4031-A87E-BDC362BD647D}.dat
File Size : 32 byte
File Type : data
MD5 : ec6392a8139b5bd7933b2d96cbd8e940
SHA1 : 90ad2e68eb9aaf8e72ce87a1829c06c52cc825ad
Online report : http://virscan.org/report/9ca75f2b71fca965…0234e2b8b8.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.1 20090619170318 2009-06-19 2.36 -
AhnLab V3 2009.06.20.00 2009.06.20 2009-06-20 0.77 -
AntiVir 8.2.0.193 7.1.4.117 2009-06-19 0.05 -
Antiy 2.0.18 2.0.18. 0002-18-00 0.12 -
Arcavir 2009 200906191229 2009-06-19 0.02 -
Authentium 5.1.1 200906191759 2009-06-19 1.11 -
AVAST! 4.7.4 090618-0 2009-06-18 0.00 -
AVG 8.5.286 270.12.81/2188 2009-06-20 3.68 -
BitDefender 7.81008.3439163 7.26075 2009-06-20 3.10 -
CA (VET) 9.0.0.143 31.6.6568 2009-06-19 8.59 -
ClamAV 0.95.1 9487 2009-06-19 0.00 -
Comodo 3.9 1374 2009-06-19 0.73 -
CP Secure 1.1.0.715 2009.06.20 2009-06-20 10.17 -
Dr.Web 4.44.0.9170 2009.06.19 2009-06-19 4.68 -
F-Prot 4.4.4.56 20090619 2009-06-19 1.15 -
F-Secure 5.51.6100 2009.06.19.02 2009-06-19 0.04 -
Fortinet 2.81-3.117 10.514 2009-06-19 0.15 -
GData 19.5922/19.368 20090619 2009-06-19 3.56 -
ViRobot 20090619 2009.06.19 2009-06-19 0.42 -
Ikarus T3.1.01.59 2009.06.19.72893 2009-06-19 3.26 -
JiangMin 11.0.706 2009.06.19 2009-06-19 2.13 -
Kaspersky 5.5.10 2009.06.19 2009-06-19 0.03 -
KingSoft 2009.2.5.15 2009.6.19.21 2009-06-19 0.49 -
McAfee 5.3.00 5651 2009-06-19 3.25 -
Microsoft 1.4803 2009.06.19 2009-06-19 5.27 -
mks_vir 2.01 2009.06.19 2009-06-19 3.34 -
Norman 6.01.09 6.01.00 2009-06-19 4.01 -
Panda 9.05.01 2009.06.19 2009-06-19 1.95 -
Trend Micro 8.700-1004 6.208.06 2009-06-19 0.02 -
Quick Heal 10.00 2009.06.19 2009-06-19 1.19 -
Rising 20.0 21.34.44.00 2009-06-19 0.31 -
Sophos 2.87.1 4.42 2009-06-20 2.63 -
Sunbelt 5198 5198 2009-06-19 0.97 -
Symantec 1.3.0.24 20090619.004 2009-06-19 0.26 -
nProtect 20090619.01 4366732 2009-06-19 5.79 -
The Hacker 6.3.4.3 v00348 2009-06-17 0.57 -
VBA32 3.12.10.7 20090618.1511 2009-06-18 2.06 -
VirusBuster 4.5.11.10 10.107.18/1647938 2009-06-19 1.99 -

VirSCAN.org Scanned Report :
Scanned time : 2009/06/19 17:29:48 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : {6277328A-3BA5-49F8-816B-E13ADB0754D0}.dat
File Size : 32 byte
File Type : Non-ISO extended-ASCII text, with no line terminators
MD5 : 7a67dc11d279f62fbf94f33523fb121b
SHA1 : f515a0c6dfdbdf599d156eb1d9f3f684a5a5abe3
Online report : http://virscan.org/report/8b4ff1428b730cd9…0dd987df78.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.1 20090619170318 2009-06-19 40.13 -
AhnLab V3 2009.06.20.00 2009.06.20 2009-06-20 0.83 -
AntiVir 8.2.0.193 7.1.4.117 2009-06-19 0.17 -
Antiy 2.0.18 2.0.18. 0002-18-00 0.12 -
Arcavir 2009 200906191229 2009-06-19 0.02 -
Authentium 5.1.1 200906191759 2009-06-19 1.11 -
AVAST! 4.7.4 090618-0 2009-06-18 0.00 -
AVG 8.5.286 270.12.81/2188 2009-06-20 3.31 -
BitDefender 7.81008.3439163 7.26075 2009-06-20 3.10 -
CA (VET) 9.0.0.143 31.6.6568 2009-06-19 5.87 -
ClamAV 0.95.1 9487 2009-06-19 0.00 -
Comodo 3.9 1374 2009-06-19 0.73 -
CP Secure 1.1.0.715 2009.06.20 2009-06-20 10.30 -
Dr.Web 4.44.0.9170 2009.06.19 2009-06-19 4.71 -
F-Prot 4.4.4.56 20090619 2009-06-19 1.19 -
F-Secure 5.51.6100 2009.06.19.02 2009-06-19 0.06 -
Fortinet 2.81-3.117 10.514 2009-06-19 0.16 -
GData 19.5922/19.368 20090619 2009-06-19 4.53 -
ViRobot 20090619 2009.06.19 2009-06-19 0.41 -
Ikarus T3.1.01.59 2009.06.19.72893 2009-06-19 3.25 -
JiangMin 11.0.706 2009.06.19 2009-06-19 2.08 -
Kaspersky 5.5.10 2009.06.19 2009-06-19 0.02 -
KingSoft 2009.2.5.15 2009.6.19.21 2009-06-19 0.49 -
McAfee 5.3.00 5651 2009-06-19 3.02 -
Microsoft 1.4803 2009.06.19 2009-06-19 4.81 -
mks_vir 2.01 2009.06.19 2009-06-19 3.08 -
Norman 6.01.09 6.01.00 2009-06-19 4.01 -
Panda 9.05.01 2009.06.19 2009-06-19 2.02 -
Trend Micro 8.700-1004 6.208.06 2009-06-19 0.02 -
Quick Heal 10.00 2009.06.19 2009-06-19 1.23 -
Rising 20.0 21.34.44.00 2009-06-19 0.27 -
Sophos 2.87.1 4.42 2009-06-20 2.53 -
Sunbelt 5198 5198 2009-06-19 0.84 -
Symantec 1.3.0.24 20090619.004 2009-06-19 0.26 -
nProtect 20090619.01 4366732 2009-06-19 5.59 -
The Hacker 6.3.4.3 v00348 2009-06-17 0.61 -
VBA32 3.12.10.7 20090618.1511 2009-06-18 2.47 -
VirusBuster 4.5.11.10 10.107.18/1647938 2009-06-19 2.03 -

SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 17:37 on 19/06/2009 by Dan (Administrator - Elevation successful)

No Context: c:\documents and settings\All Users\Application Data\98178276 /s

-=End Of File=-

Malwarebytes' Anti-Malware 1.38
Database version: 2309
Windows 5.1.2600 Service Pack 2

6/19/2009 5:44:30 PM
mbam-log-2009-06-19 (17-44-30).txt

Scan type: Quick Scan
Objects scanned: 118306
Time elapsed: 4 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, June 19, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Friday, June 19, 2009 21:58:13
Records in database: 2367245
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan statistics:
Files scanned: 149604
Threat name: 14
Infected objects: 19
Suspicious objects: 0
Duration of the scan: 04:16:02


File name / Threat name / Threats count
C:\Documents and Settings\George\Desktop\movie.233.exe Infected: Trojan-Downloader.Win32.CodecPack.by 1
C:\Documents and Settings\George\Desktop\setup.exe Infected: Trojan-Downloader.Win32.Zlob.iuk 1
C:\Documents and Settings\George\Local Settings\Application Data\Mozilla\Firefox\Profiles\h25zejch.default\Cache(3)\56C5C188d01 Infected: Trojan-Downloader.Win32.Agent.biab 1
C:\Program Files\Norton AntiVirus\Quarantine\088C3DA9 Infected: Trojan.Java.ClassLoader.ap 1
C:\Program Files\Norton AntiVirus\Quarantine\2D6C0D02.wmf Infected: Exploit.Win32.IMG-WMF.v 1
C:\Program Files\Norton AntiVirus\Quarantine\39B43763 Infected: Trojan.Java.ClassLoader.ap 1
C:\Program Files\Norton AntiVirus\Quarantine\5D177323 Infected: Trojan.Java.ClassLoader.ap 1
D:\Games\Stuff\emule.exe Infected: not-a-virus:AdWare.Win32.VB.y 1
D:\Games\Stuff\emule.exe Infected: not-a-virus:AdWare.Win32.BHO.ba 1
D:\Games\Stuff\emule.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1
D:\Games\Stuff\tightvnc-1.2.9-setup.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h 1
D:\Games\Stuff\tightvnc-1.2.9-setup.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b 1
D:\Games\Stuff\torrent.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.ahh 1
D:\program files\MYIE2\Groups\missing.php Infected: not-a-virus:AdWare.Win32.SearchPage 1
D:\program files\TightVNC\VNCHooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b 1
D:\program files\TightVNC\WinVNC.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h 1
D:\program files\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
D:\program files\UltraVNC\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1
D:\program files\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1

The selected area was scanned.