[Resolved] Not sure What is slowed pc down

goony133 Topic Starter

Post #1July 15, 2009, 2:20 PM UTC

My laptop is barely operating. The worst is browsers take many refreshes to load a page and this is same with IE8, Firefox, Chrome. Also email with thunderbird is hit and miss connecting to server. Running XP Pro SP3, 1 gig ram, 35% free space on HD, Trend micro Corporate. Connected withT. Started a few days ago. Has always taken 8 minutes to boot or more.
Thanks, Goony133
Here is the Hijack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:03:46 PM, on 7/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Common Files\OPC Foundation\OPCENUM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Documents and Settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\WINDOWS\TEMP\TS63E4.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot-S&D\SDHelper.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [WeatherWatcherLive] "C:\Program Files\Weather Watcher Live\ww.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Date on Taskbar 1.0.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?3083f09b7a1243ff9c67c3eb05ee9acb
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?3083f09b7a1243ff9c67c3eb05ee9acb
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot-S&D\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot-S&D\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://vm-virus:4343/officescan/console/Cl…ll/WinNTChk.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - https://vm-virus:4343/officescan/console/Cl…stall/setup.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://192.168.250.100/Citrix/MetaFrame/IC…ca32/wficat.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - https://vm-virus:4343/officescan/console/html/AtxEnc.cab
O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} (Scanner.SysScanner) - http://i.dell.com/images/global/js/scanner/SysProExe.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7FE26BE2-B923-4B41-9834-E84DA1CC1F96} (Maid Control) - http://vsp.closetmaid.com/vsp/cmaidctl_vsp…_downloader.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webcam.nl/AxisCamControl.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MOPAC-SSP.local
O17 - HKLM\Software\..\Telephony: DomainName = MOPAC-SSP.local
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O23 - Service: CSoft License Server - Macrovision Corporation - C:\Program Files\GeniusMechaniCS\CS License Server\lmgrd.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Update Service (gupdate1c9a346629ceecb) (gupdate1c9a346629ceecb) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Harmony - Rockwell Software Inc. - C:\PROGRA~1\ROCKWE~1\RSCOMMON\RSOBSERV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OPCEnum - Unknown owner - C:\Program Files\Common Files\OPC Foundation\OPCENUM.EXE
O23 - Service: RSLinx - Rockwell Software, Inc. - C:\PROGRA~1\ROCKWE~1\RSLINX\RSLINX.EXE
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

–
End of file - 10334 bytes

Tomk

Post #2July 20, 2009, 5:10 AM UTC

Hi goony133,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

goony133

Post #3July 20, 2009, 1:31 PM UTC

Thanks TOMK

The most noticable issue with the PC is the browser "cannot find page" result that I hit refresh several times up to 10 times to get a page to build and often the page has so many errors it is unreadable. This happend with all the browsers I have ( IE8, Firefox, Chrome, and Slimbrowser). Also I notice the programs loaded on the machine run more slowly but do not generate the errors I see with the browser or the Citrix login required to connect to a corporate server center.

Below are the logs you requested:

Malwarebytes' Anti-Malware 1.39
Database version: 2421
Windows 5.1.2600 Service Pack 3

7/20/2009 9:09:18 AM
mbam-log-2009-07-20 (09-09-18).txt

Scan type: Quick Scan
Objects scanned: 83770
Time elapsed: 11 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRV (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:19:36 AM, on 7/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Common Files\OPC Foundation\OPCENUM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\TEMP\LY996.EXE
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot-S&D\SDHelper.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [WeatherWatcherLive] "C:\Program Files\Weather Watcher Live\ww.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Date on Taskbar 1.0.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?3083f09b7a1243ff9c67c3eb05ee9acb
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?3083f09b7a1243ff9c67c3eb05ee9acb
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot-S&D\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot-S&D\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://vm-virus:4343/officescan/console/Cl…ll/WinNTChk.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - https://vm-virus:4343/officescan/console/Cl…stall/setup.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://192.168.250.100/Citrix/MetaFrame/IC…ca32/wficat.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - https://vm-virus:4343/officescan/console/html/AtxEnc.cab
O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} (Scanner.SysScanner) - http://i.dell.com/images/global/js/scanner/SysProExe.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7FE26BE2-B923-4B41-9834-E84DA1CC1F96} (Maid Control) - http://vsp.closetmaid.com/vsp/cmaidctl_vsp…_downloader.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webcam.nl/AxisCamControl.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MOPAC-SSP.local
O17 - HKLM\Software\..\Telephony: DomainName = MOPAC-SSP.local
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O23 - Service: CSoft License Server - Macrovision Corporation - C:\Program Files\GeniusMechaniCS\CS License Server\lmgrd.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Harmony - Rockwell Software Inc. - C:\PROGRA~1\ROCKWE~1\RSCOMMON\RSOBSERV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OPCEnum - Unknown owner - C:\Program Files\Common Files\OPC Foundation\OPCENUM.EXE
O23 - Service: RSLinx - Rockwell Software, Inc. - C:\PROGRA~1\ROCKWE~1\RSLINX\RSLINX.EXE
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

–
End of file - 9460 bytes
Thanks again

Tomk

Post #4July 20, 2009, 2:48 PM UTC

goony133,

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

goony133

Post #5July 20, 2009, 3:44 PM UTC

Back again, Here is the log combofix created. I have not used much since scan but it seems better.

ComboFix 09-07-19.04 - dave 07/20/2009 11:10.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.681 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: Trend Micro OfficeScan Enterprise Client Firewall *disabled* {7C080F1B-75C9-49A9-8130-A169D1F06125}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\autorun.inf
c:\program files\Common
c:\program files\installer\.lock
c:\windows\Installer\16f3011.msi
c:\windows\system32\dbxDgrevCheck.dll
c:\windows\system32\p4
c:\windows\system32\pc.dll
c:\windows\system32\s5
c:\windows\system32\z6

.
((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 )))))))))))))))))))))))))))))))
.

2009-07-20 12:51 . 2009-07-20 12:51 3775175 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-16 12:29 . 2009-07-16 12:35 ——– d—–w- c:\documents and settings\Dave\Application Data\vlc
2009-07-15 14:07 . 2009-07-15 14:07 ——– d—–w- c:\program files\ERUNT
2009-07-14 13:24 . 2009-07-14 13:24 ——– d-sh–w- c:\documents and settings\Dave\IECompatCache
2009-07-10 14:43 . 2009-07-10 14:43 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-07-10 12:30 . 2009-07-10 12:30 ——– d—–w- c:\program files\Secunia
2009-06-24 07:00 . 2009-06-24 07:00 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-06-22 11:12 . 2009-06-22 11:12 152576 —-a-w- c:\documents and settings\Dave\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-20 15:17 . 2008-02-08 13:52 ——– d—–w- c:\program files\installer
2009-07-20 14:54 . 2009-03-10 14:02 ——– d—–w- c:\documents and settings\Dave\Application Data\SlimBrowser
2009-07-20 14:23 . 2006-09-22 16:42 ——– d—–w- c:\program files\Mozilla Thunderbird
2009-07-20 13:16 . 2008-03-18 13:01 ——– d—–w- c:\program files\DYMO Label
2009-07-20 12:51 . 2009-04-16 19:07 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 17:28 . 2009-04-02 18:53 117760 —-a-w- c:\documents and settings\Dave\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-17 17:23 . 2008-02-14 18:42 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-16 11:05 . 2006-04-28 12:59 43496 —-a-w- c:\documents and settings\Dave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-14 13:59 . 2008-11-26 15:10 ——– d—–w- c:\program files\OpenOffice.org 2.4
2009-07-14 13:40 . 2008-02-11 18:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-14 12:22 . 2006-04-19 20:10 ——– d—–w- c:\program files\Google
2009-07-13 17:36 . 2009-04-16 19:07 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-04-16 19:07 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-01 12:31 . 2009-03-10 14:02 ——– d—–w- c:\program files\SlimBrowser
2009-06-30 15:40 . 2006-04-19 11:50 ——– d—–w- c:\program files\Weather Watcher
2009-06-22 11:17 . 2006-04-04 20:18 ——– d—–w- c:\program files\Java
2009-06-18 16:22 . 2007-11-07 16:08 1 —-a-w- c:\documents and settings\Dave\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-06-18 16:21 . 2007-11-07 16:07 ——– d—–w- c:\documents and settings\Dave\Application Data\OpenOffice.org2
2009-06-17 12:20 . 2009-06-17 12:20 12648 —-a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-16 14:36 . 2002-06-25 19:28 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2002-06-25 19:06 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 13:52 . 2009-06-12 13:49 ——– d—–w- c:\program files\QuickTime
2009-06-12 13:48 . 2006-05-23 19:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-03 19:09 . 2002-06-25 19:22 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-06-03 11:29 . 2009-04-02 16:54 ——– d—–w- c:\program files\Karen's Power Tools
2009-06-03 11:28 . 2009-05-06 17:59 ——– d—–w- c:\program files\Coupons
2009-05-21 15:33 . 2008-11-26 15:51 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-05-13 05:15 . 2004-01-08 20:23 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2002-06-25 19:12 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:\windows\system32\GPhotos.scr
2009-04-29 14:46 . 2006-04-04 20:13 6021 —-a-w- c:\windows\mozver.dat
2008-07-29 14:57 . 2008-07-29 14:57 243204 —-a-w- c:\program files\unlocker1.8.7.exe
2007-10-18 22:30 . 2007-10-18 22:30 584 —-a-w- c:\program files\Solid Edge 2D Drafting V20.pdf
2007-10-18 22:30 . 2007-10-18 22:30 2399804 —-a-w- c:\program files\Solid Edge 2D Drafting V20.msi
2007-10-18 22:30 . 2007-10-18 22:30 2092 —-a-w- c:\program files\Setup.ini
2007-10-18 22:30 . 2007-10-18 22:30 4817168 —-a-w- c:\program files\COM_SE~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 3905516 —-a-w- c:\program files\System~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 259870 —-a-w- c:\program files\EXECUT~2.cab
2007-10-18 22:30 . 2007-10-18 22:30 85011 —-a-w- c:\program files\Schema~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 5252 —-a-w- c:\program files\ReadmeSE.cab
2007-10-18 22:30 . 2007-10-18 22:30 5642420 —-a-w- c:\program files\ADDINS.cab
2007-10-18 22:30 . 2007-10-18 22:30 147 —-a-w- c:\program files\English.cab
2007-10-18 22:30 . 2007-10-18 22:30 145 —-a-w- c:\program files\Metric.cab
2007-10-18 22:30 . 2007-10-18 22:30 7473696 —-a-w- c:\program files\ResDLLs.cab
2007-10-18 22:29 . 2007-10-18 22:29 83 —-a-w- c:\program files\PROGRA~1.cab
2007-10-18 22:29 . 2007-10-18 22:29 118058 —-a-w- c:\program files\Tutor.cab
2007-10-18 22:29 . 2007-10-18 22:29 181706135 —-a-w- c:\program files\DLLS.cab
2007-10-18 22:27 . 2007-10-18 22:27 787848 —-a-w- c:\program files\Fonts.cab
2007-10-18 22:27 . 2007-10-18 22:27 6927 —-a-w- c:\program files\EXECUT~1.cab
2007-10-18 22:27 . 2007-10-18 22:27 631871 —-a-w- c:\program files\TYPELIBS.cab
2007-10-18 22:27 . 2007-10-18 22:27 5518781 —-a-w- c:\program files\HelpFi~1.cab
2007-10-18 22:27 . 2007-10-18 22:27 881219 —-a-w- c:\program files\Templa~1.cab
2007-10-18 22:26 . 2007-10-18 22:26 220242 —-a-w- c:\program files\Tutori~1.cab
2007-10-18 22:26 . 2007-10-18 22:26 21392 —-a-w- c:\program files\Readme.htm
2007-10-08 14:44 . 2007-10-08 14:44 813568 —-a-w- c:\program files\Sentinel System Driver 5.41.1 (32-bit).msi
2007-10-08 14:44 . 2007-10-08 14:44 421350 —-a-w- c:\program files\Data1.cab
2006-04-21 19:32 . 2006-04-21 19:32 50176 -c–a-w- c:\program files\csh.dll
2006-04-21 19:32 . 2006-04-21 19:32 1761280 —-a-w- c:\program files\Patternview.exe
2005-11-14 08:26 . 2005-11-14 08:26 1001472 —-a-w- c:\program files\ISScript1150.Msi
2005-11-14 04:49 . 2005-11-14 04:49 5693 —-a-w- c:\program files\0x0409.ini
2005-11-14 04:44 . 2005-11-14 04:44 1822520 —-a-w- c:\program files\instmsiw.exe
2005-11-14 04:44 . 2005-11-14 04:44 1708856 —-a-w- c:\program files\instmsia.exe
2009-06-24 13:26 . 2008-09-04 14:02 137208 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-08-16 22:42 . 2008-08-16 22:42 13112 —-a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 22:42 . 2008-08-16 22:42 70456 —-a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 22:42 . 2008-08-16 22:42 91448 —-a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 22:42 . 2008-08-16 22:42 20800 —-a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 22:43 . 2008-08-16 22:43 206136 —-a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 22:42 . 2008-08-16 22:42 31032 —-a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 22:42 . 2008-08-16 22:42 40248 —-a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 13:41 . 2008-05-21 13:41 479232 —-a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 13:41 . 2008-05-21 13:41 548864 —-a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 13:41 . 2008-05-21 13:41 626688 —-a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 18:58 . 2008-06-05 18:58 648504 —-a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 22:42 . 2008-08-16 22:42 23864 —-a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
2008-03-11 18:05 . 2008-03-11 18:05 608 –sha-w- c:\windows\system32\winzvprt5.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-01-23 1028096]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\OfficeScan Client\pccntmon.exe" [2008-09-11 356429]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\Dave\Start Menu\Programs\Startup\
Date on Taskbar 1.0.exe [2008-12-12 28672]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-07-01 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-01-15 12:23 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD LT Startup Accelerator.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoCAD LT Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD LT Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Utility.lnk]
backup=c:\windows\pss\Belkin Wireless Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DataViz Inc Messenger.lnk]
backup=c:\windows\pss\DataViz Inc Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR Smart Wizard.lnk.disabled]
backup=c:\windows\pss\NETGEAR Smart Wizard.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UCLA Cisco VPN Client.lnk]
backup=c:\windows\pss\UCLA Cisco VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dave^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Dave\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dave^Start Menu^Programs^Startup^Secunia PSI.lnk]
path=c:\documents and settings\Dave\Start Menu\Programs\Startup\Secunia PSI.lnk
backup=c:\windows\pss\Secunia PSI.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Drmupgds
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherWatcher
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"hpqcxs08"=3 (0x3)
"gusvc"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)
"Eventlog"=2 (0x2)
"dnWhoDisp"=3 (0x3)
"ACS"=2 (0x2)
"aawservice"=2 (0x2)
"gupdate1c9a346629ceecb"=2 (0x2)
"clr_optimization_v2.0.50727_32"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Rockwell Software\\RSLINX\\RSLINX.EXE"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [10/10/2006 2:53 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 1:39 PM 55024]
R1 VirtualBackplane;A-B Virtual Backplane;c:\windows\system32\drivers\virtualbackplane.sys [2/17/2003 2:49 PM 63508]
R2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\OfficeScan Client\TmXPFlt.sys [8/16/2008 3:00 AM 225296]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\OfficeScan Client\tmpreflt.sys [8/16/2008 3:00 AM 36368]
S2 CSoft License Server;CSoft License Server;c:\program files\GeniusMechaniCS\CS License Server\lmgrd.exe [11/2/2006 11:56 AM 815104]
S3 ABKTCX;Rockwell Software 1784-KTC(X) Driver;c:\windows\system32\drivers\abktcx.sys [2/17/2003 2:49 PM 71448]
S3 BLKWGN;Belkin Wireless G Notebook Card Service;c:\windows\system32\DRIVERS\BLKWGN.sys –> c:\windows\system32\DRIVERS\BLKWGN.sys [?]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2/20/2008 8:35 AM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2/20/2008 8:35 AM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2/20/2008 8:35 AM 42112]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2/20/2008 8:35 AM 23680]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\drivers\netr73.sys [12/29/2006 1:49 AM 247808]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 AM 12648]
S3 RS_SS_NT;RSLinx S-S SD/SD2 Device Driver;c:\windows\system32\RS_SS_NT.SYS [2/17/2003 2:49 PM 142592]
S3 RsiKtControl;RsiKtControl;c:\windows\system32\RSIKT.SYS [2/17/2003 2:49 PM 30166]
S3 RSSERIAL;RSLinx Serial Driver;c:\windows\system32\rsserial.sys [2/17/2003 2:49 PM 155440]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 6:51 PM 4096]
S3 SDTHOOK;SDTHOOK;c:\windows\system32\drivers\SDTHOOK.SYS [2/5/2008 4:34 PM 44928]
S3 wlanndi5;wlanndi5 NDIS Protocol Driver;c:\windows\system32\wlanndi5.sys [4/21/2004 5:51 PM 16384]
S4 gupdate1c9a346629ceecb;Google Update Service (gupdate1c9a346629ceecb);c:\program files\Google\Update\GoogleUpdate.exe [3/12/2009 3:11 PM 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2008-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2008-05-15 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 19:54]

2009-01-15 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-04-07 22:58]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-12 19:11]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-436374069-682003330-1118Core.job
- c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-02 11:24]

2008-02-12 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot-S&D\SpybotSD.exe [2008-02-08 18:45]

2009-01-22 c:\windows\Tasks\WebReg officejet 6300 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 10:09]

2009-07-17 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-25 02:18]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-WeatherWatcherLive - c:\program files\Weather Watcher Live\ww.exe
Notify-AutorunsDisabled - awtrqpm.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?3083f09b7a1243ff9c67c3eb05ee9acb
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?3083f09b7a1243ff9c67c3eb05ee9acb
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\fcal7ii2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
FF - component: c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\fcal7ii2.default\extensions\[removed]\components\statusbarEx.dll
FF - plugin: c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-20 11:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Preview\s*& `}*Æ0 *! ¡*¥* ¡*]
"IDSLD"="s‡‹ƒ…Š|uŠ‘"

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(900)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1708)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Trend Micro\OfficeScan Client\NTRtScan.exe
c:\program files\Common Files\OPC Foundation\OPCENUM.EXE
c:\program files\Trend Micro\OfficeScan Client\TmListen.exe
c:\program files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
c:\windows\Temp\CLCE60.EXE
c:\progra~1\MICROS~3\rapimgr.exe
.
**************************************************************************
.
Completion time: 2009-07-20 11:39 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-20 15:39

Pre-Run: 10,474,848,256 bytes free
Post-Run: 10,339,024,896 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

373 — E O F — 2009-07-17 19:22

Tomk

Post #6July 20, 2009, 4:15 PM UTC

goony133.

That's looking better. This scan will take forever.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

goony133

Post #7July 21, 2009, 11:02 AM UTC

The Kaspersky scan had to run after I left bnut did find some items. Here is the scanfile, Idid nothing to try to delete them yet. Goony133 ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Tuesday, July 21, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Monday, July 20, 2009 18:32:30 Records in database: 2500941 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 77038 Threat name: 2 Infected objects: 5 Suspicious objects: 0 Duration of the scan: 04:21:57 File name / Threat name / Threats count C:\Documents and Settings\Dave\Application Data\Thunderbird\Profiles\uu5vblxh.default\spambayes_data\_pop3proxyspam.mbox Infected: Trojan-Downloader.Win32.Mutant.cv 1 C:\WINDOWS\system32\TmEncryptTemp.000 Infected: Trojan.Win32.Monder.gen 1 C:\WINDOWS\system32\TmEncryptTemp.001 Infected: Trojan.Win32.Monder.gen 1 C:\WINDOWS\system32\TmEncryptTemp.002 Infected: Trojan.Win32.Monder.gen 1 C:\WINDOWS\system32\TmEncryptTemp.003 Infected: Trojan.Win32.Monder.gen 1 The selected area was scanned.

Tomk

Post #8July 21, 2009, 1:53 PM UTC

goony133,

You have contaminated email but it appears to be in your spam folder. Please empty your spam folder and then empty your deleted email folder.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
C:\WINDOWS\system32\TmEncryptTemp.000 
C:\WINDOWS\system32\TmEncryptTemp.001 
C:\WINDOWS\system32\TmEncryptTemp.002 
C:\WINDOWS\system32\TmEncryptTemp.003

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

goony133

Post #9July 21, 2009, 2:35 PM UTC

I've typed this three times now. each time I try to send the bnrowser cannot connect. I deleted the junk,etc and ran the scan. the combnofix wanted to update to newer version. I declined.

ComboFix 09-07-19.04 - dave 07/21/2009 10:05.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.638 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dave\Desktop\CFScript.txt
FW: Trend Micro OfficeScan Enterprise Client Firewall *disabled* {7C080F1B-75C9-49A9-8130-A169D1F06125}

FILE ::
"c:\windows\system32\TmEncryptTemp.000"
"c:\windows\system32\TmEncryptTemp.001"
"c:\windows\system32\TmEncryptTemp.002"
"c:\windows\system32\TmEncryptTemp.003"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\TmEncryptTemp.000
c:\windows\system32\TmEncryptTemp.001
c:\windows\system32\TmEncryptTemp.002
c:\windows\system32\TmEncryptTemp.003

.
((((((((((((((((((((((((( Files Created from 2009-06-21 to 2009-07-21 )))))))))))))))))))))))))))))))
.

2009-07-20 12:51 . 2009-07-20 12:51 3775175 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-16 12:29 . 2009-07-16 12:35 ——– d—–w- c:\documents and settings\Dave\Application Data\vlc
2009-07-15 14:07 . 2009-07-15 14:07 ——– d—–w- c:\program files\ERUNT
2009-07-14 13:24 . 2009-07-14 13:24 ——– d-sh–w- c:\documents and settings\Dave\IECompatCache
2009-07-10 14:43 . 2009-07-10 14:43 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-07-10 12:30 . 2009-07-10 12:30 ——– d—–w- c:\program files\Secunia
2009-06-24 07:00 . 2009-06-24 07:00 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-06-22 11:12 . 2009-06-22 11:12 152576 —-a-w- c:\documents and settings\Dave\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 12:46 . 2006-09-22 16:42 ——– d—–w- c:\program files\Mozilla Thunderbird
2009-07-21 11:41 . 2009-03-10 14:02 ——– d—–w- c:\documents and settings\Dave\Application Data\SlimBrowser
2009-07-20 17:09 . 2008-03-18 13:01 ——– d—–w- c:\program files\DYMO Label
2009-07-20 15:17 . 2008-02-08 13:52 ——– d—–w- c:\program files\installer
2009-07-20 12:51 . 2009-04-16 19:07 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 17:28 . 2009-04-02 18:53 117760 —-a-w- c:\documents and settings\Dave\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-17 17:23 . 2008-02-14 18:42 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-16 11:05 . 2006-04-28 12:59 43496 —-a-w- c:\documents and settings\Dave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-14 13:59 . 2008-11-26 15:10 ——– d—–w- c:\program files\OpenOffice.org 2.4
2009-07-14 13:40 . 2008-02-11 18:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-14 12:22 . 2006-04-19 20:10 ——– d—–w- c:\program files\Google
2009-07-13 17:36 . 2009-04-16 19:07 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-04-16 19:07 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-01 12:31 . 2009-03-10 14:02 ——– d—–w- c:\program files\SlimBrowser
2009-06-30 15:40 . 2006-04-19 11:50 ——– d—–w- c:\program files\Weather Watcher
2009-06-22 11:17 . 2006-04-04 20:18 ——– d—–w- c:\program files\Java
2009-06-18 16:22 . 2007-11-07 16:08 1 —-a-w- c:\documents and settings\Dave\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-06-18 16:21 . 2007-11-07 16:07 ——– d—–w- c:\documents and settings\Dave\Application Data\OpenOffice.org2
2009-06-17 12:20 . 2009-06-17 12:20 12648 —-a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-16 14:36 . 2002-06-25 19:28 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2002-06-25 19:06 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 13:52 . 2009-06-12 13:49 ——– d—–w- c:\program files\QuickTime
2009-06-12 13:48 . 2006-05-23 19:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-03 19:09 . 2002-06-25 19:22 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-06-03 11:29 . 2009-04-02 16:54 ——– d—–w- c:\program files\Karen's Power Tools
2009-06-03 11:28 . 2009-05-06 17:59 ——– d—–w- c:\program files\Coupons
2009-05-21 15:33 . 2008-11-26 15:51 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-05-13 05:15 . 2004-01-08 20:23 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2002-06-25 19:12 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:\windows\system32\GPhotos.scr
2009-04-29 14:46 . 2006-04-04 20:13 6021 —-a-w- c:\windows\mozver.dat
2008-07-29 14:57 . 2008-07-29 14:57 243204 —-a-w- c:\program files\unlocker1.8.7.exe
2007-10-18 22:30 . 2007-10-18 22:30 584 —-a-w- c:\program files\Solid Edge 2D Drafting V20.pdf
2007-10-18 22:30 . 2007-10-18 22:30 2399804 —-a-w- c:\program files\Solid Edge 2D Drafting V20.msi
2007-10-18 22:30 . 2007-10-18 22:30 2092 —-a-w- c:\program files\Setup.ini
2007-10-18 22:30 . 2007-10-18 22:30 4817168 —-a-w- c:\program files\COM_SE~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 3905516 —-a-w- c:\program files\System~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 259870 —-a-w- c:\program files\EXECUT~2.cab
2007-10-18 22:30 . 2007-10-18 22:30 85011 —-a-w- c:\program files\Schema~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 5252 —-a-w- c:\program files\ReadmeSE.cab
2007-10-18 22:30 . 2007-10-18 22:30 5642420 —-a-w- c:\program files\ADDINS.cab
2007-10-18 22:30 . 2007-10-18 22:30 147 —-a-w- c:\program files\English.cab
2007-10-18 22:30 . 2007-10-18 22:30 145 —-a-w- c:\program files\Metric.cab
2007-10-18 22:30 . 2007-10-18 22:30 7473696 —-a-w- c:\program files\ResDLLs.cab
2007-10-18 22:29 . 2007-10-18 22:29 83 —-a-w- c:\program files\PROGRA~1.cab
2007-10-18 22:29 . 2007-10-18 22:29 118058 —-a-w- c:\program files\Tutor.cab
2007-10-18 22:29 . 2007-10-18 22:29 181706135 —-a-w- c:\program files\DLLS.cab
2007-10-18 22:27 . 2007-10-18 22:27 787848 —-a-w- c:\program files\Fonts.cab
2007-10-18 22:27 . 2007-10-18 22:27 6927 —-a-w- c:\program files\EXECUT~1.cab
2007-10-18 22:27 . 2007-10-18 22:27 631871 —-a-w- c:\program files\TYPELIBS.cab
2007-10-18 22:27 . 2007-10-18 22:27 5518781 —-a-w- c:\program files\HelpFi~1.cab
2007-10-18 22:27 . 2007-10-18 22:27 881219 —-a-w- c:\program files\Templa~1.cab
2007-10-18 22:26 . 2007-10-18 22:26 220242 —-a-w- c:\program files\Tutori~1.cab
2007-10-18 22:26 . 2007-10-18 22:26 21392 —-a-w- c:\program files\Readme.htm
2007-10-08 14:44 . 2007-10-08 14:44 813568 —-a-w- c:\program files\Sentinel System Driver 5.41.1 (32-bit).msi
2007-10-08 14:44 . 2007-10-08 14:44 421350 —-a-w- c:\program files\Data1.cab
2006-04-21 19:32 . 2006-04-21 19:32 50176 -c–a-w- c:\program files\csh.dll
2006-04-21 19:32 . 2006-04-21 19:32 1761280 —-a-w- c:\program files\Patternview.exe
2005-11-14 08:26 . 2005-11-14 08:26 1001472 —-a-w- c:\program files\ISScript1150.Msi
2005-11-14 04:49 . 2005-11-14 04:49 5693 —-a-w- c:\program files\0x0409.ini
2005-11-14 04:44 . 2005-11-14 04:44 1822520 —-a-w- c:\program files\instmsiw.exe
2005-11-14 04:44 . 2005-11-14 04:44 1708856 —-a-w- c:\program files\instmsia.exe
2009-06-24 13:26 . 2008-09-04 14:02 137208 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-08-16 22:42 . 2008-08-16 22:42 13112 —-a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 22:42 . 2008-08-16 22:42 70456 —-a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 22:42 . 2008-08-16 22:42 91448 —-a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 22:42 . 2008-08-16 22:42 20800 —-a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 22:43 . 2008-08-16 22:43 206136 —-a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 22:42 . 2008-08-16 22:42 31032 —-a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 22:42 . 2008-08-16 22:42 40248 —-a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 13:41 . 2008-05-21 13:41 479232 —-a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 13:41 . 2008-05-21 13:41 548864 —-a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 13:41 . 2008-05-21 13:41 626688 —-a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 18:58 . 2008-06-05 18:58 648504 —-a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 22:42 . 2008-08-16 22:42 23864 —-a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
2008-03-11 18:05 . 2008-03-11 18:05 608 –sha-w- c:\windows\system32\winzvprt5.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-07-20_15.29.51 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-01-23 1028096]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\OfficeScan Client\pccntmon.exe" [2008-09-11 356429]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\Dave\Start Menu\Programs\Startup\
Date on Taskbar 1.0.exe [2008-12-12 28672]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-07-01 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-01-15 12:23 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD LT Startup Accelerator.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoCAD LT Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD LT Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Utility.lnk]
backup=c:\windows\pss\Belkin Wireless Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DataViz Inc Messenger.lnk]
backup=c:\windows\pss\DataViz Inc Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR Smart Wizard.lnk.disabled]
backup=c:\windows\pss\NETGEAR Smart Wizard.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UCLA Cisco VPN Client.lnk]
backup=c:\windows\pss\UCLA Cisco VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dave^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Dave\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dave^Start Menu^Programs^Startup^Secunia PSI.lnk]
path=c:\documents and settings\Dave\Start Menu\Programs\Startup\Secunia PSI.lnk
backup=c:\windows\pss\Secunia PSI.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"hpqcxs08"=3 (0x3)
"gusvc"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)
"Eventlog"=2 (0x2)
"dnWhoDisp"=3 (0x3)
"ACS"=2 (0x2)
"aawservice"=2 (0x2)
"gupdate1c9a346629ceecb"=2 (0x2)
"clr_optimization_v2.0.50727_32"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Rockwell Software\\RSLINX\\RSLINX.EXE"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [10/10/2006 2:53 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 1:39 PM 55024]
R1 VirtualBackplane;A-B Virtual Backplane;c:\windows\system32\drivers\virtualbackplane.sys [2/17/2003 2:49 PM 63508]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\OfficeScan Client\tmpreflt.sys [8/16/2008 3:00 AM 36368]
S2 CSoft License Server;CSoft License Server;c:\program files\GeniusMechaniCS\CS License Server\lmgrd.exe [11/2/2006 11:56 AM 815104]
S2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\OfficeScan Client\TmXPFlt.sys [8/16/2008 3:00 AM 225296]
S3 ABKTCX;Rockwell Software 1784-KTC(X) Driver;c:\windows\system32\drivers\abktcx.sys [2/17/2003 2:49 PM 71448]
S3 BLKWGN;Belkin Wireless G Notebook Card Service;c:\windows\system32\DRIVERS\BLKWGN.sys –> c:\windows\system32\DRIVERS\BLKWGN.sys [?]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2/20/2008 8:35 AM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2/20/2008 8:35 AM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2/20/2008 8:35 AM 42112]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2/20/2008 8:35 AM 23680]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\drivers\netr73.sys [12/29/2006 1:49 AM 247808]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 AM 12648]
S3 RS_SS_NT;RSLinx S-S SD/SD2 Device Driver;c:\windows\system32\RS_SS_NT.SYS [2/17/2003 2:49 PM 142592]
S3 RsiKtControl;RsiKtControl;c:\windows\system32\RSIKT.SYS [2/17/2003 2:49 PM 30166]
S3 RSSERIAL;RSLinx Serial Driver;c:\windows\system32\rsserial.sys [2/17/2003 2:49 PM 155440]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 6:51 PM 4096]
S3 SDTHOOK;SDTHOOK;c:\windows\system32\drivers\SDTHOOK.SYS [2/5/2008 4:34 PM 44928]
S3 wlanndi5;wlanndi5 NDIS Protocol Driver;c:\windows\system32\wlanndi5.sys [4/21/2004 5:51 PM 16384]
S4 gupdate1c9a346629ceecb;Google Update Service (gupdate1c9a346629ceecb);c:\program files\Google\Update\GoogleUpdate.exe [3/12/2009 3:11 PM 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2008-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2008-05-15 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 19:54]

2009-01-15 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-04-07 22:58]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-12 19:11]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-436374069-682003330-1118Core.job
- c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-02 11:24]

2008-02-12 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot-S&D\SpybotSD.exe [2008-02-08 18:45]

2009-01-22 c:\windows\Tasks\WebReg officejet 6300 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 10:09]

2009-07-21 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-25 02:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?3083f09b7a1243ff9c67c3eb05ee9acb
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?3083f09b7a1243ff9c67c3eb05ee9acb
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\fcal7ii2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
FF - component: c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\fcal7ii2.default\extensions\[removed]\components\statusbarEx.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-21 10:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Preview\s*& `}*Æ0 *! ¡*¥* ¡*]
"IDSLD"="s‡‹ƒ…Š|uŠ‘"

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(900)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2009-07-21 10:21
ComboFix-quarantined-files.txt 2009-07-21 14:20
ComboFix2.txt 2009-07-20 15:39

Pre-Run: 10,242,859,008 bytes free
Post-Run: 10,289,459,200 bytes free

335 — E O F — 2009-07-21 07:01

goony133

Post #10July 21, 2009, 2:36 PM UTC

I've typed this three times now. each time I try to send the bnrowser cannot connect. I deleted the junk,etc and ran the scan. the combnofix wanted to update to newer version. I declined.

ComboFix 09-07-19.04 - dave 07/21/2009 10:05.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.638 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dave\Desktop\CFScript.txt
FW: Trend Micro OfficeScan Enterprise Client Firewall *disabled* {7C080F1B-75C9-49A9-8130-A169D1F06125}

FILE ::
"c:\windows\system32\TmEncryptTemp.000"
"c:\windows\system32\TmEncryptTemp.001"
"c:\windows\system32\TmEncryptTemp.002"
"c:\windows\system32\TmEncryptTemp.003"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\TmEncryptTemp.000
c:\windows\system32\TmEncryptTemp.001
c:\windows\system32\TmEncryptTemp.002
c:\windows\system32\TmEncryptTemp.003

.
((((((((((((((((((((((((( Files Created from 2009-06-21 to 2009-07-21 )))))))))))))))))))))))))))))))
.

2009-07-20 12:51 . 2009-07-20 12:51 3775175 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-16 12:29 . 2009-07-16 12:35 ——– d—–w- c:\documents and settings\Dave\Application Data\vlc
2009-07-15 14:07 . 2009-07-15 14:07 ——– d—–w- c:\program files\ERUNT
2009-07-14 13:24 . 2009-07-14 13:24 ——– d-sh–w- c:\documents and settings\Dave\IECompatCache
2009-07-10 14:43 . 2009-07-10 14:43 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-07-10 12:30 . 2009-07-10 12:30 ——– d—–w- c:\program files\Secunia
2009-06-24 07:00 . 2009-06-24 07:00 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-06-22 11:12 . 2009-06-22 11:12 152576 —-a-w- c:\documents and settings\Dave\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 12:46 . 2006-09-22 16:42 ——– d—–w- c:\program files\Mozilla Thunderbird
2009-07-21 11:41 . 2009-03-10 14:02 ——– d—–w- c:\documents and settings\Dave\Application Data\SlimBrowser
2009-07-20 17:09 . 2008-03-18 13:01 ——– d—–w- c:\program files\DYMO Label
2009-07-20 15:17 . 2008-02-08 13:52 ——– d—–w- c:\program files\installer
2009-07-20 12:51 . 2009-04-16 19:07 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 17:28 . 2009-04-02 18:53 117760 —-a-w- c:\documents and settings\Dave\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-17 17:23 . 2008-02-14 18:42 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-16 11:05 . 2006-04-28 12:59 43496 —-a-w- c:\documents and settings\Dave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-14 13:59 . 2008-11-26 15:10 ——– d—–w- c:\program files\OpenOffice.org 2.4
2009-07-14 13:40 . 2008-02-11 18:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-14 12:22 . 2006-04-19 20:10 ——– d—–w- c:\program files\Google
2009-07-13 17:36 . 2009-04-16 19:07 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-04-16 19:07 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-01 12:31 . 2009-03-10 14:02 ——– d—–w- c:\program files\SlimBrowser
2009-06-30 15:40 . 2006-04-19 11:50 ——– d—–w- c:\program files\Weather Watcher
2009-06-22 11:17 . 2006-04-04 20:18 ——– d—–w- c:\program files\Java
2009-06-18 16:22 . 2007-11-07 16:08 1 —-a-w- c:\documents and settings\Dave\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-06-18 16:21 . 2007-11-07 16:07 ——– d—–w- c:\documents and settings\Dave\Application Data\OpenOffice.org2
2009-06-17 12:20 . 2009-06-17 12:20 12648 —-a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-16 14:36 . 2002-06-25 19:28 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2002-06-25 19:06 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 13:52 . 2009-06-12 13:49 ——– d—–w- c:\program files\QuickTime
2009-06-12 13:48 . 2006-05-23 19:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-03 19:09 . 2002-06-25 19:22 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-06-03 11:29 . 2009-04-02 16:54 ——– d—–w- c:\program files\Karen's Power Tools
2009-06-03 11:28 . 2009-05-06 17:59 ——– d—–w- c:\program files\Coupons
2009-05-21 15:33 . 2008-11-26 15:51 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-05-13 05:15 . 2004-01-08 20:23 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2002-06-25 19:12 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:\windows\system32\GPhotos.scr
2009-04-29 14:46 . 2006-04-04 20:13 6021 —-a-w- c:\windows\mozver.dat
2008-07-29 14:57 . 2008-07-29 14:57 243204 —-a-w- c:\program files\unlocker1.8.7.exe
2007-10-18 22:30 . 2007-10-18 22:30 584 —-a-w- c:\program files\Solid Edge 2D Drafting V20.pdf
2007-10-18 22:30 . 2007-10-18 22:30 2399804 —-a-w- c:\program files\Solid Edge 2D Drafting V20.msi
2007-10-18 22:30 . 2007-10-18 22:30 2092 —-a-w- c:\program files\Setup.ini
2007-10-18 22:30 . 2007-10-18 22:30 4817168 —-a-w- c:\program files\COM_SE~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 3905516 —-a-w- c:\program files\System~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 259870 —-a-w- c:\program files\EXECUT~2.cab
2007-10-18 22:30 . 2007-10-18 22:30 85011 —-a-w- c:\program files\Schema~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 5252 —-a-w- c:\program files\ReadmeSE.cab
2007-10-18 22:30 . 2007-10-18 22:30 5642420 —-a-w- c:\program files\ADDINS.cab
2007-10-18 22:30 . 2007-10-18 22:30 147 —-a-w- c:\program files\English.cab
2007-10-18 22:30 . 2007-10-18 22:30 145 —-a-w- c:\program files\Metric.cab
2007-10-18 22:30 . 2007-10-18 22:30 7473696 —-a-w- c:\program files\ResDLLs.cab
2007-10-18 22:29 . 2007-10-18 22:29 83 —-a-w- c:\program files\PROGRA~1.cab
2007-10-18 22:29 . 2007-10-18 22:29 118058 —-a-w- c:\program files\Tutor.cab
2007-10-18 22:29 . 2007-10-18 22:29 181706135 —-a-w- c:\program files\DLLS.cab
2007-10-18 22:27 . 2007-10-18 22:27 787848 —-a-w- c:\program files\Fonts.cab
2007-10-18 22:27 . 2007-10-18 22:27 6927 —-a-w- c:\program files\EXECUT~1.cab
2007-10-18 22:27 . 2007-10-18 22:27 631871 —-a-w- c:\program files\TYPELIBS.cab
2007-10-18 22:27 . 2007-10-18 22:27 5518781 —-a-w- c:\program files\HelpFi~1.cab
2007-10-18 22:27 . 2007-10-18 22:27 881219 —-a-w- c:\program files\Templa~1.cab
2007-10-18 22:26 . 2007-10-18 22:26 220242 —-a-w- c:\program files\Tutori~1.cab
2007-10-18 22:26 . 2007-10-18 22:26 21392 —-a-w- c:\program files\Readme.htm
2007-10-08 14:44 . 2007-10-08 14:44 813568 —-a-w- c:\program files\Sentinel System Driver 5.41.1 (32-bit).msi
2007-10-08 14:44 . 2007-10-08 14:44 421350 —-a-w- c:\program files\Data1.cab
2006-04-21 19:32 . 2006-04-21 19:32 50176 -c–a-w- c:\program files\csh.dll
2006-04-21 19:32 . 2006-04-21 19:32 1761280 —-a-w- c:\program files\Patternview.exe
2005-11-14 08:26 . 2005-11-14 08:26 1001472 —-a-w- c:\program files\ISScript1150.Msi
2005-11-14 04:49 . 2005-11-14 04:49 5693 —-a-w- c:\program files\0x0409.ini
2005-11-14 04:44 . 2005-11-14 04:44 1822520 —-a-w- c:\program files\instmsiw.exe
2005-11-14 04:44 . 2005-11-14 04:44 1708856 —-a-w- c:\program files\instmsia.exe
2009-06-24 13:26 . 2008-09-04 14:02 137208 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-08-16 22:42 . 2008-08-16 22:42 13112 —-a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 22:42 . 2008-08-16 22:42 70456 —-a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 22:42 . 2008-08-16 22:42 91448 —-a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 22:42 . 2008-08-16 22:42 20800 —-a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 22:43 . 2008-08-16 22:43 206136 —-a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 22:42 . 2008-08-16 22:42 31032 —-a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 22:42 . 2008-08-16 22:42 40248 —-a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 13:41 . 2008-05-21 13:41 479232 —-a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 13:41 . 2008-05-21 13:41 548864 —-a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 13:41 . 2008-05-21 13:41 626688 —-a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 18:58 . 2008-06-05 18:58 648504 —-a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 22:42 . 2008-08-16 22:42 23864 —-a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
2008-03-11 18:05 . 2008-03-11 18:05 608 –sha-w- c:\windows\system32\winzvprt5.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-07-20_15.29.51 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-01-23 1028096]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\OfficeScan Client\pccntmon.exe" [2008-09-11 356429]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\Dave\Start Menu\Programs\Startup\
Date on Taskbar 1.0.exe [2008-12-12 28672]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-07-01 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-01-15 12:23 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD LT Startup Accelerator.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoCAD LT Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD LT Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Utility.lnk]
backup=c:\windows\pss\Belkin Wireless Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DataViz Inc Messenger.lnk]
backup=c:\windows\pss\DataViz Inc Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR Smart Wizard.lnk.disabled]
backup=c:\windows\pss\NETGEAR Smart Wizard.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UCLA Cisco VPN Client.lnk]
backup=c:\windows\pss\UCLA Cisco VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dave^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Dave\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dave^Start Menu^Programs^Startup^Secunia PSI.lnk]
path=c:\documents and settings\Dave\Start Menu\Programs\Startup\Secunia PSI.lnk
backup=c:\windows\pss\Secunia PSI.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"hpqcxs08"=3 (0x3)
"gusvc"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)
"Eventlog"=2 (0x2)
"dnWhoDisp"=3 (0x3)
"ACS"=2 (0x2)
"aawservice"=2 (0x2)
"gupdate1c9a346629ceecb"=2 (0x2)
"clr_optimization_v2.0.50727_32"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Rockwell Software\\RSLINX\\RSLINX.EXE"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [10/10/2006 2:53 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 1:39 PM 55024]
R1 VirtualBackplane;A-B Virtual Backplane;c:\windows\system32\drivers\virtualbackplane.sys [2/17/2003 2:49 PM 63508]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\OfficeScan Client\tmpreflt.sys [8/16/2008 3:00 AM 36368]
S2 CSoft License Server;CSoft License Server;c:\program files\GeniusMechaniCS\CS License Server\lmgrd.exe [11/2/2006 11:56 AM 815104]
S2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\OfficeScan Client\TmXPFlt.sys [8/16/2008 3:00 AM 225296]
S3 ABKTCX;Rockwell Software 1784-KTC(X) Driver;c:\windows\system32\drivers\abktcx.sys [2/17/2003 2:49 PM 71448]
S3 BLKWGN;Belkin Wireless G Notebook Card Service;c:\windows\system32\DRIVERS\BLKWGN.sys –> c:\windows\system32\DRIVERS\BLKWGN.sys [?]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2/20/2008 8:35 AM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2/20/2008 8:35 AM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2/20/2008 8:35 AM 42112]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2/20/2008 8:35 AM 23680]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\drivers\netr73.sys [12/29/2006 1:49 AM 247808]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 AM 12648]
S3 RS_SS_NT;RSLinx S-S SD/SD2 Device Driver;c:\windows\system32\RS_SS_NT.SYS [2/17/2003 2:49 PM 142592]
S3 RsiKtControl;RsiKtControl;c:\windows\system32\RSIKT.SYS [2/17/2003 2:49 PM 30166]
S3 RSSERIAL;RSLinx Serial Driver;c:\windows\system32\rsserial.sys [2/17/2003 2:49 PM 155440]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 6:51 PM 4096]
S3 SDTHOOK;SDTHOOK;c:\windows\system32\drivers\SDTHOOK.SYS [2/5/2008 4:34 PM 44928]
S3 wlanndi5;wlanndi5 NDIS Protocol Driver;c:\windows\system32\wlanndi5.sys [4/21/2004 5:51 PM 16384]
S4 gupdate1c9a346629ceecb;Google Update Service (gupdate1c9a346629ceecb);c:\program files\Google\Update\GoogleUpdate.exe [3/12/2009 3:11 PM 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2008-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2008-05-15 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 19:54]

2009-01-15 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-04-07 22:58]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-12 19:11]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-436374069-682003330-1118Core.job
- c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-02 11:24]

2008-02-12 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot-S&D\SpybotSD.exe [2008-02-08 18:45]

2009-01-22 c:\windows\Tasks\WebReg officejet 6300 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 10:09]

2009-07-21 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-25 02:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?3083f09b7a1243ff9c67c3eb05ee9acb
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?3083f09b7a1243ff9c67c3eb05ee9acb
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\fcal7ii2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
FF - component: c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\fcal7ii2.default\extensions\[removed]\components\statusbarEx.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-21 10:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Preview\s*& `}*Æ0 *! ¡*¥* ¡*]
"IDSLD"="s‡‹ƒ…Š|uŠ‘"

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(900)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2009-07-21 10:21
ComboFix-quarantined-files.txt 2009-07-21 14:20
ComboFix2.txt 2009-07-20 15:39

Pre-Run: 10,242,859,008 bytes free
Post-Run: 10,289,459,200 bytes free

335 — E O F — 2009-07-21 07:01

Tomk

Post #11July 21, 2009, 3:30 PM UTC

goony133,

This time, please let ComboFix update itself.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
RegNull::
[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Preview\s*& `}*Æ0 *! ¡*¥* ¡*]
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

goony133

Post #12July 21, 2009, 4:22 PM UTC

OK updated combofix, here is the log. I am having trouble with verizon T1, Hope it's fixed.

ComboFix 09-07-20.05 - dave 07/21/2009 12:02.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.698 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dave\Desktop\cfscript.exe
FW: Trend Micro OfficeScan Enterprise Client Firewall *disabled* {7C080F1B-75C9-49A9-8130-A169D1F06125}
.

((((((((((((((((((((((((( Files Created from 2009-06-21 to 2009-07-21 )))))))))))))))))))))))))))))))
.

2009-07-20 12:51 . 2009-07-20 12:51 3775175 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-16 12:29 . 2009-07-16 12:35 ——– d—–w- c:\documents and settings\Dave\Application Data\vlc
2009-07-15 14:07 . 2009-07-15 14:07 ——– d—–w- c:\program files\ERUNT
2009-07-14 13:24 . 2009-07-14 13:24 ——– d-sh–w- c:\documents and settings\Dave\IECompatCache
2009-07-10 14:43 . 2009-07-10 14:43 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-07-10 12:30 . 2009-07-10 12:30 ——– d—–w- c:\program files\Secunia
2009-06-24 07:00 . 2009-06-24 07:00 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-06-22 11:12 . 2009-06-22 11:12 152576 —-a-w- c:\documents and settings\Dave\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 15:30 . 2009-03-10 14:02 ——– d—–w- c:\documents and settings\Dave\Application Data\SlimBrowser
2009-07-21 14:55 . 2006-09-22 16:42 ——– d—–w- c:\program files\Mozilla Thunderbird
2009-07-20 17:09 . 2008-03-18 13:01 ——– d—–w- c:\program files\DYMO Label
2009-07-20 15:17 . 2008-02-08 13:52 ——– d—–w- c:\program files\installer
2009-07-20 12:51 . 2009-04-16 19:07 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 17:28 . 2009-04-02 18:53 117760 —-a-w- c:\documents and settings\Dave\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-17 17:23 . 2008-02-14 18:42 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-16 11:05 . 2006-04-28 12:59 43496 —-a-w- c:\documents and settings\Dave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-14 13:59 . 2008-11-26 15:10 ——– d—–w- c:\program files\OpenOffice.org 2.4
2009-07-14 13:40 . 2008-02-11 18:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-14 12:22 . 2006-04-19 20:10 ——– d—–w- c:\program files\Google
2009-07-13 17:36 . 2009-04-16 19:07 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-04-16 19:07 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-01 12:31 . 2009-03-10 14:02 ——– d—–w- c:\program files\SlimBrowser
2009-06-30 15:40 . 2006-04-19 11:50 ——– d—–w- c:\program files\Weather Watcher
2009-06-22 11:17 . 2006-04-04 20:18 ——– d—–w- c:\program files\Java
2009-06-18 16:22 . 2007-11-07 16:08 1 —-a-w- c:\documents and settings\Dave\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-06-18 16:21 . 2007-11-07 16:07 ——– d—–w- c:\documents and settings\Dave\Application Data\OpenOffice.org2
2009-06-17 12:20 . 2009-06-17 12:20 12648 —-a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-16 14:36 . 2002-06-25 19:28 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2002-06-25 19:06 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 13:52 . 2009-06-12 13:49 ——– d—–w- c:\program files\QuickTime
2009-06-12 13:48 . 2006-05-23 19:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-03 19:09 . 2002-06-25 19:22 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-06-03 11:29 . 2009-04-02 16:54 ——– d—–w- c:\program files\Karen's Power Tools
2009-06-03 11:28 . 2009-05-06 17:59 ——– d—–w- c:\program files\Coupons
2009-05-21 15:33 . 2008-11-26 15:51 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-05-13 05:15 . 2004-01-08 20:23 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2002-06-25 19:12 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:\windows\system32\GPhotos.scr
2009-04-29 14:46 . 2006-04-04 20:13 6021 —-a-w- c:\windows\mozver.dat
2008-07-29 14:57 . 2008-07-29 14:57 243204 —-a-w- c:\program files\unlocker1.8.7.exe
2007-10-18 22:30 . 2007-10-18 22:30 584 —-a-w- c:\program files\Solid Edge 2D Drafting V20.pdf
2007-10-18 22:30 . 2007-10-18 22:30 2399804 —-a-w- c:\program files\Solid Edge 2D Drafting V20.msi
2007-10-18 22:30 . 2007-10-18 22:30 2092 —-a-w- c:\program files\Setup.ini
2007-10-18 22:30 . 2007-10-18 22:30 4817168 —-a-w- c:\program files\COM_SE~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 3905516 —-a-w- c:\program files\System~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 259870 —-a-w- c:\program files\EXECUT~2.cab
2007-10-18 22:30 . 2007-10-18 22:30 85011 —-a-w- c:\program files\Schema~1.cab
2007-10-18 22:30 . 2007-10-18 22:30 5252 —-a-w- c:\program files\ReadmeSE.cab
2007-10-18 22:30 . 2007-10-18 22:30 5642420 —-a-w- c:\program files\ADDINS.cab
2007-10-18 22:30 . 2007-10-18 22:30 147 —-a-w- c:\program files\English.cab
2007-10-18 22:30 . 2007-10-18 22:30 145 —-a-w- c:\program files\Metric.cab
2007-10-18 22:30 . 2007-10-18 22:30 7473696 —-a-w- c:\program files\ResDLLs.cab
2007-10-18 22:29 . 2007-10-18 22:29 83 —-a-w- c:\program files\PROGRA~1.cab
2007-10-18 22:29 . 2007-10-18 22:29 118058 —-a-w- c:\program files\Tutor.cab
2007-10-18 22:29 . 2007-10-18 22:29 181706135 —-a-w- c:\program files\DLLS.cab
2007-10-18 22:27 . 2007-10-18 22:27 787848 —-a-w- c:\program files\Fonts.cab
2007-10-18 22:27 . 2007-10-18 22:27 6927 —-a-w- c:\program files\EXECUT~1.cab
2007-10-18 22:27 . 2007-10-18 22:27 631871 —-a-w- c:\program files\TYPELIBS.cab
2007-10-18 22:27 . 2007-10-18 22:27 5518781 —-a-w- c:\program files\HelpFi~1.cab
2007-10-18 22:27 . 2007-10-18 22:27 881219 —-a-w- c:\program files\Templa~1.cab
2007-10-18 22:26 . 2007-10-18 22:26 220242 —-a-w- c:\program files\Tutori~1.cab
2007-10-18 22:26 . 2007-10-18 22:26 21392 —-a-w- c:\program files\Readme.htm
2007-10-08 14:44 . 2007-10-08 14:44 813568 —-a-w- c:\program files\Sentinel System Driver 5.41.1 (32-bit).msi
2007-10-08 14:44 . 2007-10-08 14:44 421350 —-a-w- c:\program files\Data1.cab
2006-04-21 19:32 . 2006-04-21 19:32 50176 -c–a-w- c:\program files\csh.dll
2006-04-21 19:32 . 2006-04-21 19:32 1761280 —-a-w- c:\program files\Patternview.exe
2005-11-14 08:26 . 2005-11-14 08:26 1001472 —-a-w- c:\program files\ISScript1150.Msi
2005-11-14 04:49 . 2005-11-14 04:49 5693 —-a-w- c:\program files\0x0409.ini
2005-11-14 04:44 . 2005-11-14 04:44 1822520 —-a-w- c:\program files\instmsiw.exe
2005-11-14 04:44 . 2005-11-14 04:44 1708856 —-a-w- c:\program files\instmsia.exe
2009-06-24 13:26 . 2008-09-04 14:02 137208 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-08-16 22:42 . 2008-08-16 22:42 13112 —-a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 22:42 . 2008-08-16 22:42 70456 —-a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 22:42 . 2008-08-16 22:42 91448 —-a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 22:42 . 2008-08-16 22:42 20800 —-a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 22:43 . 2008-08-16 22:43 206136 —-a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 22:42 . 2008-08-16 22:42 31032 —-a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 22:42 . 2008-08-16 22:42 40248 —-a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 13:41 . 2008-05-21 13:41 479232 —-a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 13:41 . 2008-05-21 13:41 548864 —-a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 13:41 . 2008-05-21 13:41 626688 —-a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 18:58 . 2008-06-05 18:58 648504 —-a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 22:42 . 2008-08-16 22:42 23864 —-a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
2008-03-11 18:05 . 2008-03-11 18:05 608 –sha-w- c:\windows\system32\winzvprt5.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-07-20_15.29.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-21 14:48 . 2009-07-21 14:48 16384 c:\windows\Temp\Perflib_Perfdata_198.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"WeatherWatcher"="c:\program files\Weather Watcher\ww.exe" [2008-01-23 1028096]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\OfficeScan Client\pccntmon.exe" [2008-09-11 356429]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\Dave\Start Menu\Programs\Startup\
Date on Taskbar 1.0.exe [2008-12-12 28672]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-07-01 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-01-15 12:23 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD LT Startup Accelerator.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoCAD LT Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD LT Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Utility.lnk]
backup=c:\windows\pss\Belkin Wireless Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DataViz Inc Messenger.lnk]
backup=c:\windows\pss\DataViz Inc Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR Smart Wizard.lnk.disabled]
backup=c:\windows\pss\NETGEAR Smart Wizard.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UCLA Cisco VPN Client.lnk]
backup=c:\windows\pss\UCLA Cisco VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dave^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Dave\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dave^Start Menu^Programs^Startup^Secunia PSI.lnk]
path=c:\documents and settings\Dave\Start Menu\Programs\Startup\Secunia PSI.lnk
backup=c:\windows\pss\Secunia PSI.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"hpqcxs08"=3 (0x3)
"gusvc"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)
"Eventlog"=2 (0x2)
"dnWhoDisp"=3 (0x3)
"ACS"=2 (0x2)
"aawservice"=2 (0x2)
"gupdate1c9a346629ceecb"=2 (0x2)
"clr_optimization_v2.0.50727_32"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Rockwell Software\\RSLINX\\RSLINX.EXE"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [10/10/2006 2:53 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 1:39 PM 55024]
R1 VirtualBackplane;A-B Virtual Backplane;c:\windows\system32\drivers\virtualbackplane.sys [2/17/2003 2:49 PM 63508]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\OfficeScan Client\tmpreflt.sys [8/16/2008 3:00 AM 36368]
S2 CSoft License Server;CSoft License Server;c:\program files\GeniusMechaniCS\CS License Server\lmgrd.exe [11/2/2006 11:56 AM 815104]
S2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\OfficeScan Client\TmXPFlt.sys [8/16/2008 3:00 AM 225296]
S3 ABKTCX;Rockwell Software 1784-KTC(X) Driver;c:\windows\system32\drivers\abktcx.sys [2/17/2003 2:49 PM 71448]
S3 BLKWGN;Belkin Wireless G Notebook Card Service;c:\windows\system32\DRIVERS\BLKWGN.sys –> c:\windows\system32\DRIVERS\BLKWGN.sys [?]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2/20/2008 8:35 AM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2/20/2008 8:35 AM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2/20/2008 8:35 AM 42112]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2/20/2008 8:35 AM 23680]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\drivers\netr73.sys [12/29/2006 1:49 AM 247808]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 AM 12648]
S3 RS_SS_NT;RSLinx S-S SD/SD2 Device Driver;c:\windows\system32\RS_SS_NT.SYS [2/17/2003 2:49 PM 142592]
S3 RsiKtControl;RsiKtControl;c:\windows\system32\RSIKT.SYS [2/17/2003 2:49 PM 30166]
S3 RSSERIAL;RSLinx Serial Driver;c:\windows\system32\rsserial.sys [2/17/2003 2:49 PM 155440]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 6:51 PM 4096]
S3 SDTHOOK;SDTHOOK;c:\windows\system32\drivers\SDTHOOK.SYS [2/5/2008 4:34 PM 44928]
S3 wlanndi5;wlanndi5 NDIS Protocol Driver;c:\windows\system32\wlanndi5.sys [4/21/2004 5:51 PM 16384]
S4 gupdate1c9a346629ceecb;Google Update Service (gupdate1c9a346629ceecb);c:\program files\Google\Update\GoogleUpdate.exe [3/12/2009 3:11 PM 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2008-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2008-05-15 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 19:54]

2009-01-15 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-04-07 22:58]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-12 19:11]

2009-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-436374069-682003330-1118Core.job
- c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-02 11:24]

2008-02-12 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot-S&D\SpybotSD.exe [2008-02-08 18:45]

2009-01-22 c:\windows\Tasks\WebReg officejet 6300 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 10:09]

2009-07-21 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-25 02:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?3083f09b7a1243ff9c67c3eb05ee9acb
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?3083f09b7a1243ff9c67c3eb05ee9acb
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\fcal7ii2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
FF - component: c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\fcal7ii2.default\extensions\[removed]\components\statusbarEx.dll
FF - plugin: c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-21 12:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-436374069-682003330-1118\Software\Preview\s*& `}*Æ0 *! ¡*¥* ¡*]
"IDSLD"="s‡‹ƒ…Š|uŠ‘"

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(896)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1984)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-07-21 12:18
ComboFix-quarantined-files.txt 2009-07-21 16:17
ComboFix2.txt 2009-07-21 14:21
ComboFix3.txt 2009-07-20 15:39

Pre-Run: 10,156,417,024 bytes free
Post-Run: 10,244,268,032 bytes free

337 — E O F — 2009-07-21 07:01

Tomk

Post #13July 21, 2009, 4:49 PM UTC

goony133,

I'm just not finding anything more. It might be a problem with Verizon, might be some other issue, but I'm not seeing malware. I suggest that you seek more help from the Tech Team by posting in the Browser Forum. If you do that, please post a link there back to this thread so that they can see the logs you have provided.

Meanwhile, Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Please re-enable any security that was disabled.

Now to remove most of the tools that we have used in fixing your machine:

Make sure you have an Internet Connection.
Download OTC to your desktop and run it
A list of tool components used in the cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

goony133

Post #14July 21, 2009, 5:44 PM UTC

I think the T1 connection was partly a problem. I do thank you for your time and patience. The help is very much appreciated and I will run the suggested processes now. You would think with corporate edition of antivirus the protection would be better but then sometimes I'm my own worst enemy. Thanks, Goony133

Tomk

Post #15July 21, 2009, 5:46 PM UTC

goony133, You are welcome. Good Luck and Be Well.

✨ Ask AI

Ask AI