[Resolved] Combo Fix Not available

I have some sort of malware that is redirecting my internet searches and giving me exe. corrupt file notices. I have run checkdisk 6 or 7 times and always goes back to same problem even though nothing shows up on chkdisk. I was running AVG 9 free and it did finally give me notice that a trojan was running after about 4 days. the log i downloaded is as follows, any help is appreciated. thanks ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/12/09 18:18 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP2 ================================================== Drivers ——————- Name: downloads[1].sys Image Path: C:\Windows\system32\drivers\downloads[1].sys Address: 0xB2B89000 Size: 49152 File Visible: No Signed: - Status: - Name: dump_dumpata.sys Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys Address: 0x90F40000 Size: 45056 File Visible: No Signed: - Status: - Name: dump_msahci.sys Image Path: C:\Windows\System32\Drivers\dump_msahci.sys Address: 0x90F4B000 Size: 40960 File Visible: No Signed: - Status: - Processes ——————- Path: System PID: 4 Status: Locked to the Windows API! Path: C:\Windows\System32\audiodg.exe PID: 1484 Status: Locked to the Windows API! ==EOF== DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 18:10:41.79 on Wed 12/09/2009 Internet Explorer: 8.0.6001.18828 BrowserJavaVersion: 1.6.0_17 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3002.1561 [GMT -8:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\Windows\system32\lsm.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\SMINST\BLService.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\AVG\AVG9\avgemc.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\16.0.0.125\InstStub.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Windows\system32\taskeng.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\AVG\AVG9\avgtray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Microsoft Money\System\Money Express.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\wermgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe c:\Program Files\MSN\Toolbar\3.0.0541.0\msntask.exe C:\Program Files\Windows Live\Toolbar\wltuser.exe C:\Program Files\AVG\AVG9\avgscanx.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\svchost.exe -k swprv C:\Program Files\Microsoft Money\System\urlmap.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\DllHost.exe C:\Users\THOMAS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0DENYVR\dds[1].scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.0.0.125\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.0.0.125\IPSBHO.DLL BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: {fdd3b846-8d59-4ffb-8758-209b6ad74acc} - c:\program files\microsoft money\system\mnyviewer.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.0.0.125\coIEPlg.dll TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe uRun: [MoneyAgent] "c:\program files\microsoft money\system\Money Express.exe" uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5" mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter" mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0" mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0" mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0" mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe" mRun: [MoneyStartUp10.0] "c:\program files\microsoft money\system\Activation.exe" mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe" mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} - c:\program files\microsoft money\system\mnyviewer.dll Trusted Zone: turbotax.com DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2009\HelpAsyncPluggableProtocol.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll Notify: igfxcui - igfxdev.dll AppInit_DLLs: avgrsstx.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-6-28 333192] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-6-28 28424] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-6-28 360584] R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-11-7 906520] R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-11-7 285392] R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [2009-4-22 115560] R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2009-4-22 365952] R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-4-22 193840] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-29 112128] S2 gupdate1ca17d77c1ff8b0;Google Update Service (gupdate1ca17d77c1ff8b0);c:\program files\google\update\GoogleUpdate.exe [2009-8-7 133104] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-7-4 55280] S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360] =============== Created Last 30 ================ 2009-12-02 20:09:20 0 d—–w- c:\programdata\Office Genuine Advantage 2009-12-02 20:09:15 0 d—–w- c:\users\thomas\Office Genuine Advantage 2009-11-30 15:25:10 196663277 —-a-w- c:\windows\MEMORY.DMP 2009-11-26 17:09:05 2048 —-a-w- c:\windows\system32\tzres.dll 2009-11-25 15:17:21 1401856 —-a-w- c:\windows\system32\msxml6.dll 2009-11-25 15:17:19 1248768 —-a-w- c:\windows\system32\msxml3.dll 2009-11-25 15:17:14 714240 —-a-w- c:\windows\system32\timedate.cpl 2009-11-20 05:20:48 3063561 —-a-w- c:\programdata\MobileTV.exe 2009-11-20 05:20:47 2989660 —-a-w- c:\programdata\DVD.exe 2009-11-20 05:20:47 2864396 —-a-w- c:\programdata\MPV.exe 2009-11-20 05:20:46 2331174 —-a-w- c:\programdata\Karaoke.exe 2009-11-20 05:20:46 2231606 —-a-w- c:\programdata\Games.exe 2009-11-20 05:20:45 0 d—–w- c:\programdata\ENU 2009-11-18 16:01:50 0 d—–w- c:\program files\Windows Portable Devices 2009-11-18 16:01:41 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf 2009-11-18 15:27:23 92672 —-a-w- c:\windows\system32\UIAnimation.dll 2009-11-18 15:27:22 3023360 —-a-w- c:\windows\system32\UIRibbon.dll 2009-11-18 15:27:22 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll 2009-11-18 15:25:58 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll 2009-11-18 15:24:19 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll 2009-11-18 15:24:19 4096 —-a-w- c:\windows\system32\oleaccrc.dll 2009-11-18 15:24:19 234496 —-a-w- c:\windows\system32\oleacc.dll 2009-11-11 15:19:06 2036736 —-a-w- c:\windows\system32\win32k.sys 2009-11-11 15:18:56 355328 —-a-w- c:\windows\system32\WSDApi.dll ==================== Find3M ==================== 2009-12-04 04:05:21 536 —-a-w- c:\users\thomas\appdata\roaming\wklnhst.dat 2009-12-01 06:56:48 86016 —-a-w- c:\windows\inf\infstor.dat 2009-12-01 06:56:48 51200 —-a-w- c:\windows\inf\infpub.dat 2009-12-01 06:56:48 143360 —-a-w- c:\windows\inf\infstrng.dat 2009-11-18 16:01:46 665600 —-a-w- c:\windows\inf\drvindex.dat 2009-11-09 17:21:34 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2009-11-07 17:06:43 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2009-11-07 17:06:39 12464 —-a-w- c:\windows\system32\avgrsstx.dll 2009-11-03 04:42:06 195456 ——w- c:\windows\system32\MpSigStub.exe 2009-10-11 12:17:27 411368 —-a-w- c:\windows\system32\deploytk.dll 2009-10-01 01:02:17 2537472 —-a-w- c:\windows\system32\wpdshext.dll 2009-10-01 01:02:05 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe 2009-10-01 01:02:04 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll 2009-10-01 01:02:02 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll 2009-10-01 01:02:00 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll 2009-10-01 01:01:59 546816 —-a-w- c:\windows\system32\wpd_ci.dll 2009-10-01 01:01:59 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll 2009-10-01 01:01:56 350208 —-a-w- c:\windows\system32\WPDSp.dll 2009-10-01 01:01:56 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll 2009-10-01 01:01:56 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll 2009-10-01 01:01:54 81920 —-a-w- c:\windows\system32\wpdbusenum.dll 2009-09-25 02:10:10 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll 2009-09-25 02:07:08 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2009-09-25 02:04:32 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2009-09-25 01:49:22 1554432 —-a-w- c:\windows\system32\xpsservices.dll 2009-09-25 01:48:08 351232 —-a-w- c:\windows\system32\XpsPrint.dll 2009-09-25 01:38:29 847360 —-a-w- c:\windows\system32\OpcServices.dll 2009-09-25 01:36:13 280064 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2009-09-25 01:35:31 135680 —-a-w- c:\windows\system32\XpsRasterService.dll 2009-09-25 01:33:25 195584 —-a-w- c:\windows\system32\dxdiagn.dll 2009-09-25 01:33:15 829440 —-a-w- c:\windows\system32\d3d10warp.dll 2009-09-25 01:33:01 369664 —-a-w- c:\windows\system32\WMPhoto.dll 2009-09-25 01:32:59 252928 —-a-w- c:\windows\system32\dxdiag.exe 2009-09-25 01:31:53 519680 —-a-w- c:\windows\system32\d3d11.dll 2009-09-25 01:31:26 486912 —-a-w- c:\windows\system32\d3d10level9.dll 2009-09-25 01:31:21 161280 —-a-w- c:\windows\system32\d3d10_1.dll 2009-09-25 01:31:19 218112 —-a-w- c:\windows\system32\d3d10_1core.dll 2009-09-25 01:31:16 1030144 —-a-w- c:\windows\system32\d3d10.dll 2009-09-25 01:31:15 828928 —-a-w- c:\windows\system32\d2d1.dll 2009-09-25 01:30:23 481792 —-a-w- c:\windows\system32\dxgi.dll 2009-09-25 01:30:23 190464 —-a-w- c:\windows\system32\d3d10core.dll 2009-09-25 01:27:04 793088 —-a-w- c:\windows\system32\FntCache.dll 2009-09-25 01:27:04 37888 —-a-w- c:\windows\system32\cdd.dll 2009-09-25 01:27:04 1064448 —-a-w- c:\windows\system32\DWrite.dll 2009-09-24 22:54:55 258048 —-a-w- c:\windows\system32\winspool.drv 2009-09-24 22:54:53 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe 2009-09-24 22:54:52 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll 2008-01-21 02:43:21 174 –sha-w- c:\program files\desktop.ini 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-06-29 20:42:55 16384 –sha-w- c:\windows\temp\cookies\index.dat 2009-06-29 20:42:55 16384 –sha-w- c:\windows\temp\history\history.ie5\index.dat 2009-06-29 20:42:55 32768 –sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat 2009-04-22 14:18:14 8192 –sha-w- c:\windows\users\default\NTUSER.DAT ============= FINISH: 18:11:35.34 ===============

Hello, thank you for your instructions. Please note after running combofix, i was not allowed access to any internet, computer icons that i tried. Said they were set for "deletion". then checkdisk ran automatically and noted some deleted files and reinstalled files as the computer rebooted.

Log is as follows:


ComboFix 09-12-09.04 - THOMAS 12/10/2009 7:08.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3002.1833 [GMT -8:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2006731069-4194233102-3759409975-500
c:\$recycle.bin\S-1-5-21-269143086-4138566716-204987309-500

.
((((((((((((((((((((((((( Files Created from 2009-11-10 to 2009-12-10 )))))))))))))))))))))))))))))))
.

2009-12-10 15:15 . 2009-12-10 15:15 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-12-10 15:05 . 2009-12-10 15:05 ——– d—–w- C:\32788R22FWJFW
2009-12-10 02:00 . 2009-12-10 02:01 ——– d—–w- c:\program files\ERUNT
2009-12-02 20:09 . 2009-12-02 20:09 ——– d—–w- c:\programdata\Office Genuine Advantage
2009-12-02 20:09 . 2009-12-02 20:09 ——– d—–w- c:\users\THOMAS\Office Genuine Advantage
2009-12-02 16:48 . 2009-12-02 16:48 869664 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\DownloadQB19\Patch\.update\.target\qbpatch.exe
2009-11-26 17:09 . 2009-10-29 09:17 2048 —-a-w- c:\windows\system32\tzres.dll
2009-11-25 15:17 . 2009-08-11 16:44 1401856 —-a-w- c:\windows\system32\msxml6.dll
2009-11-25 15:17 . 2009-08-11 16:44 1248768 —-a-w- c:\windows\system32\msxml3.dll
2009-11-20 05:20 . 2009-11-20 05:20 ——– d—–w- c:\users\THOMAS\AppData\Roaming\CyberLink
2009-11-20 05:20 . 2009-11-20 05:20 3063561 —-a-w- c:\programdata\MobileTV.exe
2009-11-20 05:20 . 2009-11-20 05:20 2989660 —-a-w- c:\programdata\DVD.exe
2009-11-20 05:20 . 2009-11-20 05:20 2864396 —-a-w- c:\programdata\MPV.exe
2009-11-20 05:20 . 2009-11-20 05:20 2331174 —-a-w- c:\programdata\Karaoke.exe
2009-11-20 05:20 . 2009-11-20 05:20 2231606 —-a-w- c:\programdata\Games.exe
2009-11-20 05:20 . 2009-11-20 05:20 ——– d—–w- c:\programdata\ENU
2009-11-20 05:20 . 2009-11-20 06:04 ——– d—–w- c:\users\THOMAS\AppData\Local\QuickPlay
2009-11-18 16:01 . 2009-11-18 16:01 ——– d—–w- c:\program files\Windows Portable Devices
2009-11-18 15:27 . 2009-09-10 02:00 92672 —-a-w- c:\windows\system32\UIAnimation.dll
2009-11-18 15:27 . 2009-09-10 02:01 3023360 —-a-w- c:\windows\system32\UIRibbon.dll
2009-11-18 15:27 . 2009-09-10 02:00 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll
2009-11-18 15:25 . 2009-10-01 01:01 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-11-18 15:25 . 2009-10-01 01:02 2537472 —-a-w- c:\windows\system32\wpdshext.dll
2009-11-18 15:25 . 2009-10-01 01:02 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2009-11-18 15:25 . 2009-10-01 01:02 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll
2009-11-18 15:25 . 2009-10-01 01:01 546816 —-a-w- c:\windows\system32\wpd_ci.dll
2009-11-18 15:25 . 2009-10-01 01:01 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-11-18 15:25 . 2009-10-01 01:01 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-11-18 15:25 . 2009-10-01 01:01 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-11-18 15:25 . 2009-10-01 01:01 350208 —-a-w- c:\windows\system32\WPDSp.dll
2009-11-18 15:24 . 2009-10-08 21:08 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll
2009-11-18 15:24 . 2009-10-08 21:08 234496 —-a-w- c:\windows\system32\oleacc.dll
2009-11-18 15:24 . 2009-10-08 21:07 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2009-11-13 14:58 . 2009-11-13 14:57 3963648 —-a-w- c:\programdata\avg9\update\backup\avgcorex.dll
2009-11-13 14:58 . 2009-11-13 14:57 497944 —-a-w- c:\programdata\avg9\update\backup\avgchjwx.dll
2009-11-11 15:19 . 2009-08-14 13:27 2036736 —-a-w- c:\windows\system32\win32k.sys
2009-11-11 15:18 . 2009-08-10 12:35 355328 —-a-w- c:\windows\system32\WSDApi.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-10 14:56 . 2009-04-22 14:57 ——– d—–w- c:\programdata\Microsoft Help
2009-12-09 04:25 . 2009-08-01 22:14 ——– d—–w- c:\program files\Common Files\L&H;
2009-12-08 02:44 . 2009-11-07 17:06 ——– d—–w- c:\programdata\avg9
2009-12-06 20:44 . 2009-07-02 03:32 3184 —-a-w- c:\programdata\Intuit\QuickBooks 2009\qbbackup.sys
2009-12-04 04:05 . 2009-07-02 03:50 536 —-a-w- c:\users\THOMAS\AppData\Roaming\wklnhst.dat
2009-12-01 15:50 . 2009-08-08 03:21 ——– d—–w- c:\program files\Google
2009-11-29 06:28 . 2009-04-22 15:14 ——– d—–w- c:\program files\Java
2009-11-25 15:17 . 2009-08-12 13:35 852784 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\dblgen11.dll
2009-11-25 15:17 . 2009-08-12 13:35 2168112 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\iAnywhere.Data.SQLAnywhere.dll
2009-11-25 15:17 . 2009-07-02 03:41 205576 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\IntuitSyncManagerPatch.exe
2009-11-25 15:17 . 2009-07-02 03:41 1087752 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\IntuitSyncManager.exe
2009-11-18 16:01 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2009-11-18 16:01 . 2009-11-18 16:01 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-12 11:19 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-11-09 17:21 . 2009-06-29 03:50 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-07 17:06 . 2009-06-29 03:50 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-07 17:06 . 2009-06-29 03:50 28424 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-11-07 17:06 . 2009-06-29 03:50 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2009-11-07 17:06 . 2009-06-29 03:50 ——– d—–w- c:\program files\AVG
2009-11-06 15:59 . 2009-08-12 13:35 496944 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\mlrsa10.dll
2009-11-06 15:59 . 2009-08-12 13:35 570672 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\mlhttps10.dll
2009-11-06 15:59 . 2009-08-12 13:35 296240 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\mlsock10.dll
2009-11-06 15:59 . 2009-08-12 13:35 263472 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\mlcrsa10.dll
2009-11-06 15:59 . 2009-08-12 13:35 1152304 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dbtool10.dll
2009-11-06 15:59 . 2009-08-12 13:35 787760 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dblgen10.dll
2009-11-06 15:59 . 2009-08-12 13:35 763184 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dblib10.dll
2009-11-06 15:59 . 2009-08-12 13:35 423216 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dbmlsync.exe
2009-11-06 15:59 . 2009-08-12 13:35 398640 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dbcon10.dll
2009-11-03 04:42 . 2009-10-03 14:35 195456 ——w- c:\windows\system32\MpSigStub.exe
2009-10-11 12:17 . 2009-10-10 15:39 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-10-01 01:02 . 2009-11-18 15:26 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-01 01:02 . 2009-11-18 15:26 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01 . 2009-11-18 15:26 81920 —-a-w- c:\windows\system32\wpdbusenum.dll
2009-09-25 02:10 . 2009-11-18 15:26 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07 . 2009-11-18 15:26 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04 . 2009-11-18 15:26 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49 . 2009-11-18 15:26 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2009-09-25 01:48 . 2009-11-18 15:26 351232 —-a-w- c:\windows\system32\XpsPrint.dll
2009-09-25 01:38 . 2009-11-18 15:26 847360 —-a-w- c:\windows\system32\OpcServices.dll
2009-09-25 01:36 . 2009-11-18 15:26 280064 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35 . 2009-11-18 15:26 135680 —-a-w- c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33 . 2009-11-18 15:26 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2009-09-25 01:33 . 2009-11-18 15:26 829440 —-a-w- c:\windows\system32\d3d10warp.dll
2009-09-25 01:33 . 2009-11-18 15:26 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2009-09-25 01:32 . 2009-11-18 15:26 252928 —-a-w- c:\windows\system32\dxdiag.exe
2009-09-25 01:31 . 2009-11-18 15:26 519680 —-a-w- c:\windows\system32\d3d11.dll
2009-09-25 01:31 . 2009-11-18 15:26 486912 —-a-w- c:\windows\system32\d3d10level9.dll
2009-09-25 01:31 . 2009-11-18 15:26 161280 —-a-w- c:\windows\system32\d3d10_1.dll
2009-09-25 01:31 . 2009-11-18 15:26 218112 —-a-w- c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31 . 2009-11-18 15:26 1030144 —-a-w- c:\windows\system32\d3d10.dll
2009-09-25 01:31 . 2009-11-18 15:26 828928 —-a-w- c:\windows\system32\d2d1.dll
2009-09-25 01:30 . 2009-11-18 15:26 481792 —-a-w- c:\windows\system32\dxgi.dll
2009-09-25 01:30 . 2009-11-18 15:26 190464 —-a-w- c:\windows\system32\d3d10core.dll
2009-09-25 01:27 . 2009-11-18 15:26 634880 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27 . 2009-11-18 15:26 37888 —-a-w- c:\windows\system32\cdd.dll
2009-09-25 01:27 . 2009-11-18 15:26 793088 —-a-w- c:\windows\system32\FntCache.dll
2009-09-25 01:27 . 2009-11-18 15:26 1064448 —-a-w- c:\windows\system32\DWrite.dll
2009-09-24 22:54 . 2009-11-18 15:26 258048 —-a-w- c:\windows\system32\winspool.drv
2009-09-24 22:54 . 2009-11-18 15:26 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54 . 2009-11-18 15:26 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2009-09-14 09:29 . 2009-10-14 13:54 144896 —-a-w- c:\windows\system32\drivers\srv2.sys
2009-04-22 14:18 . 2009-04-22 14:09 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden" [X]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN" [X]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe -quiet" [X]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 184376]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe -hide" [X]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup" [X]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-10 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-10 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-10 145944]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-11-15 218408]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"MoneyStartUp10.0"="c:\program files\Microsoft Money\System\Activation.exe" [2001-07-25 241714]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2009-03-11 468264]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-13 2020120]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-7-16 984352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:ac,a8,59,9e,3f,18,ca,01

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [6/28/2009 7:50 PM 333192]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [6/28/2009 7:50 PM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [11/7/2009 9:06 AM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/7/2009 9:06 AM 285392]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [4/22/2009 6:01 AM 115560]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [4/22/2009 7:17 AM 365952]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [4/22/2009 6:14 AM 193840]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\System32\drivers\IntcHdmi.sys [6/29/2008 6:52 AM 112128]
S2 gupdate1ca17d77c1ff8b0;Google Update Service (gupdate1ca17d77c1ff8b0);c:\program files\Google\Update\GoogleUpdate.exe [8/7/2009 7:22 PM 133104]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [1/20/2008 6:23 PM 21504]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [7/4/2009 8:00 AM 55280]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 5:08 PM 533360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-01-28 05:28 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=91&bd;=Pavilion&pf;=cnnb
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: turbotax.com
Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-10 07:16
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x85AF5618]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x82211d24
\Driver\ACPI -> acpi.sys @ 0x8069dd68
\Driver\atapi -> ataport.SYS @ 0x822e9a2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-12-10 07:19:34
ComboFix-quarantined-files.txt 2009-12-10 15:19

Pre-Run: 227,718,758,400 bytes free
Post-Run: 228,345,753,600 bytes free

- - End Of File - - F789A6EADFF2ED605FC8A17050825AF3