[Resolved] Search engine redirects

About three years ago I began training at WTT (then Tom Coyote) but serious business problems meant I had to stop as I did not have time to focus on training (much to my regret). I also trained around the same time at MRU. I learned a lot during training and thought that at least I knew enough to keep myself secure. Apparently not.

(I have posted this problem in MRU as well. I know that is not protocol but given the time of year, the backlog and the apparent widespread nature of my problem I decided to post to both. As soon as any response is received on one site I will post in the other to let them know.)

I have the search engine redirect problem which, judging by posts on the various malware sites, has become widespread. It started a few of days ago when the browser window went blank, Avira threw up a virus warning, and the pc had to be restarted. On restart System Commander warned me that a 'value changed since last boot'. I clicked 'ignore' (so the warning repeats on each reboot), which allowed me to start the pc. I can post the SC warning info if required.

I can start the browser and reach Google and enter a search query. The results page populates but mostly (although not always) when a link is clicked it is redirected to an advertising site, sometimes to 'free-spyware-scanner.biz with the tab saying 'windows security' - which is (presumably) a rogue virus scanning site that wants me to agree to a scan and won't let me close the box (I have to close the browser).

While the redirection (which takes a little time) is happening, the bottom of the browser shows waiting for…something with 'hochu-spat.com/index.php?do=' or two or three alternatives, followed by the clicked link site address for a bit, before that is replaced with the name of the site to which I am redirected.

I don't know where this came from. The most recent downloads have been iTouch (logitech keyboard key mapper), PC Suite (Sony pc-phone synch software which I did have on the pc but which stopped working so I uninstalled it and downloaded it again), and the latest XP update.

I previously had Spy-bot SD with Teatimer and IE Resident but removed that yesterday in case the immunise data was interfering with anything; and Windows Defender, which I also removed yesterday, leaving just the Avira suite.

I have run SUPERAntiSpyware and scanned with Spy-bot before removing it, and used the Panda online scan. They found nothing. Avira scan finds nothing.

I am connected via Virgin cable using a Belkin router.

I have changed my name in the logs to read Surreal.

Whether or not they are connected to my problem, I would appreciate info on what c:\windows\system32\TempInst.exe and c:\windows\DelMR.bat are. They appear in the DDS log suspiciously about the time I think I caught the infection. I cannot find any info on these (Jotti scans come up with nothing).

Thanks for your help.
+++

I have followed the instructions re preparation with the exception of SysRestorePoint.exe which would not run, telling me that I needed to install v2 of .Net Framework. However, DDS text shows a system restore point set today.

I ran MBAM and it hangs after Remove Selected and has to be closed, so it does not open a text log. However, when I restart MBAM the infections found are all listed under the Quarantine tab.



GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-23 13:38:02
Windows 5.1.2600 Service Pack 3
Running: mvqrt8m0.exe; Driver: C:\DOCUME~1\Surreal~1\LOCALS~1\Temp\fwldapod.sys


—- System - GMER 1.0.15 —-

SSDT F7C95326 ZwCreateKey
SSDT F7C9531C ZwCreateThread
SSDT F7C9532B ZwDeleteKey
SSDT F7C95335 ZwDeleteValueKey
SSDT F7C9533A ZwLoadKey
SSDT F7C95308 ZwOpenProcess
SSDT F7C9530D ZwOpenThread
SSDT F7C95344 ZwReplaceKey
SSDT F7C9533F ZwRestoreKey
SSDT F7C95330 ZwSetValueKey
SSDT F7C95317 ZwTerminateProcess
SSDT F7C95312 ZwWriteVirtualMemory

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\Tcp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 snapman.sys (Acronis Snapshot API/Acronis)

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 86E1D548
Device \Driver\atapi \Device\Ide\IdePort0 86E1D548
Device \Driver\atapi \Device\Ide\IdePort1 86E1D548
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e 86E1D548

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume5 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume6 snapman.sys (Acronis Snapshot API/Acronis)

Device \Driver\usbhub \Device\00000083 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\00000084 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\00000085 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\00000086 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\00000088 hcmon.sys (VMware USB monitor/VMware, Inc.)

AttachedDevice \Driver\Tcpip \Device\Udp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\RawIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device \Driver\usbuhci \Device\USBFDO-0 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-1 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-2 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-3 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbehci \Device\USBFDO-4 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBPDO-0 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBPDO-1 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBPDO-2 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBPDO-3 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbehci \Device\USBPDO-4 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\USBPDO-6 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\USBPDO-7 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\00000082 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\Fastfat \Fat A8991D20

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher@TracesProcessed 279

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior; <– ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 62: copy of MBR

—- EOF - GMER 1.0.15 —-



DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 13:39:53.62 on 23/12/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.426 [GMT 0:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {11638345-E4FC-4BEE-BB73-EC754659C5F6}
FW: Avira Firewall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Avira\AntiVir Desktop\sched.exe
E:\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
E:\Avira\AntiVir Desktop\avmailc.exe
E:\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
E:\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\Explorer.EXE
E:\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
E:\VMware\VMware Workstation\vmware-tray.exe
E:\VMware\VMware Workstation\hqtray.exe
E:\Acronis\TrueImageMonitor.exe
C:\WINDOWS\system32\igfxpers.exe
E:\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Surreal\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uStart Page = about:blank
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - e:\adobe\adobe acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - e:\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - e:\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: FlashFXP Helper for Internet Explorer: {e5a1691b-d188-4419-ad02-90002030b8ee} - e:\flashfxp\IEFlash.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - e:\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: Copernic Desktop Search 2: {968631b6-4729-440d-9bf4-251f5593ec9a} - e:\copernic desktop search 2\copernic desktop search 2\DesktopSearchBand201013011.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - e:\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: Copernic Desktop Search 2: {968631b6-4729-440d-9bf4-251f5593ec9a} - e:\copernic desktop search 2\copernic desktop search 2\DesktopSearchBand201013011.dll
EB: Copernic Desktop Search 2: {9c3fca1f-99e3-48f2-a7f4-dd3931b2f99a} - e:\copernic desktop search 2\copernic desktop search 2\DesktopSearchBand201013011.dll
uRun: [Copernic Desktop Search 2] "e:\copernic desktop search 2\copernic desktop search 2\DesktopSearchService.exe" /tray
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [AdobeVersionCue] e:\adobe\adobe version cue\controlpanel\VersionCueTray.exe
mRun: [vmware-tray] e:\vmware\vmware workstation\vmware-tray.exe
mRun: [VMware hqtray] "e:\vmware\vmware workstation\hqtray.exe"
mRun: [Acronis True Image Monitor] "e:\acronis\TrueImageMonitor.exe"
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [avgnt] "e:\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "e:\adobe reader 9\reader\Reader_sl.exe"
mRun: [zBrowser Launcher] e:\logitech\itouch\iTouch.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mRun: [PC Suite for Smartphones] "e:\sony ericsson\mobile4\application launcher\Application Launcher.exe" /startoptions
mRunOnce: [Malwarebytes' Anti-Malware] e:\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - e:\adobe\adobe acrobat 6.0\distillr\acrotray.exe
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - e:\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - e:\skype\toolbars\internet explorer\SkypeIEPlugin.dll
LSP: e:\avira\antivir desktop\avsda.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/3/d/83d1fe15-fe0f-4bdf-b09c-4e3c49808ec7/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1162996119580
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1162998267156
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - e:\windows ce services\aatp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - e:\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - e:\superantispyware\SASSEH.DLL
SecurityProviders: rpasspc.dll, msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-12-21 28552]
R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [2009-4-16 97608]
R1 avgio;avgio;e:\avira\antivir desktop\avgio.sys [2009-4-16 11608]
R1 SASDIFSV;SASDIFSV;e:\superantispyware\sasdifsv.sys [2009-12-16 9968]
R1 SASKUTIL;SASKUTIL;e:\superantispyware\SASKUTIL.SYS [2009-12-16 74480]
R2 AntiVirFirewallService;Avira Firewall;e:\avira\antivir desktop\avfwsvc.exe [2009-4-16 388865]
R2 AntiVirMailService;Avira AntiVir MailGuard;e:\avira\antivir desktop\avmailc.exe [2009-4-16 194817]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;e:\avira\antivir desktop\sched.exe [2009-4-16 108289]
R2 AntiVirService;Avira AntiVir Guard;e:\avira\antivir desktop\avguard.exe [2009-4-16 185089]
R2 AntiVirWebService;Avira AntiVir WebGuard;e:\avira\antivir desktop\avwebgrd.exe [2009-4-16 434945]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-16 56816]
R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [2006-1-12 13696]
R2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [2006-1-12 13568]
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [2009-4-16 69632]
S2 P32LOAD;Intel® AnyPoint® 3240 USB Modem Firmware Loader;c:\windows\system32\drivers\p31usbld.sys [2006-11-8 18906]
S2 WinMBR;System Commander 7 MBR check;c:\sc\WINMBR.EXE [2006-11-9 32768]
S3 PRO3200P;Intel® USB ADSL Modem;c:\windows\system32\drivers\p32d2kp.sys [2002-4-27 530785]
S3 SASENUM;SASENUM;e:\superantispyware\SASENUM.SYS [2009-12-16 7408]
S3 Wudfext;Wudfext; [x]

=============== Created Last 30 ================

2009-12-21 19:01:18 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2009-12-21 19:01:08 0 d—–w- c:\program files\Panda Security
2009-12-20 11:38:00 0 d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-12-20 11:37:49 0 d—–w- c:\docume~1\Surreal~1\applic~1\SUPERAntiSpyware.com
2009-12-19 16:51:28 91264 —-a-r- c:\windows\system32\drivers\zebrsce.sys
2009-12-19 16:51:18 14848 —-a-r- c:\windows\system32\drivers\zebrmdfl.sys
2009-12-19 16:51:18 109568 —-a-r- c:\windows\system32\drivers\zebrmdm.sys
2009-12-19 16:51:10 12160 —-a-r- c:\windows\system32\drivers\zebrcmnt.sys
2009-12-19 16:51:10 12160 —-a-r- c:\windows\system32\drivers\zebrcm.sys
2009-12-19 16:51:10 109568 —-a-r- c:\windows\system32\drivers\zebrmdmc.sys
2009-12-19 16:51:05 83200 —-a-r- c:\windows\system32\drivers\zebrbus.sys
2009-12-19 16:39:23 63360 —-a-r- c:\windows\system32\drivers\zebrceb.sys
2009-12-19 16:39:23 12160 —-a-r- c:\windows\system32\drivers\zebrwhnt.sys
2009-12-19 16:39:23 12160 —-a-r- c:\windows\system32\drivers\zebrwh.sys
2009-12-19 16:39:17 0 d—–w- c:\program files\Sony Ericsson
2009-12-19 16:37:52 288 —-a-w- c:\windows\mrinstu.iss
2009-12-19 16:37:45 0 d—–w- c:\program files\Intuwave
2009-12-19 16:37:36 0 d—–w- c:\program files\Symbian
2009-12-19 16:36:48 0 d—–w- c:\program files\common files\Sony Ericsson Shared
2009-12-19 16:36:48 0 d—–w- c:\docume~1\alluse~1\applic~1\Sony Ericsson
2009-12-19 16:36:39 0 d—–w- c:\docume~1\alluse~1\applic~1\Teleca
2009-12-19 16:36:29 0 d—–w- c:\program files\MSXML 6.0
2009-12-19 11:58:17 0 d—–w- c:\docume~1\Surreal~1\applic~1\Malwarebytes
2009-12-19 11:58:12 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-19 11:58:09 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-12-19 11:58:08 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-19 08:50:36 5750784 —-a-w- c:\windows\system32\TempInst.exe
2009-12-18 20:35:04 146 —-a-w- c:\windows\DelMR.bat
2009-12-18 17:45:04 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2009-12-15 18:53:21 25214 —-a-r- c:\windows\system32\memorystick.ico
2009-12-09 19:18:03 0 d—–w- c:\documents and settings\Surreal\.netbeans
2009-12-06 15:38:04 12953 ——w- c:\windows\system32\drivers\itchfltr.sys
2009-12-06 15:37:58 37887 ——w- c:\windows\system32\drivers\Lhidusb.sys
2009-12-06 15:37:58 14095 —-a-w- c:\windows\system32\drivers\LCcfltr.sys
2009-12-06 15:37:53 0 d—–w- c:\program files\common files\Logitech
2009-12-06 15:37:52 54784 —-a-w- c:\windows\system32\MSVCI70.DLL
2009-12-04 09:14:34 0 d—–w- c:\program files\Windows Media Connect 2
2009-11-27 14:57:46 1248 —-a-w- c:\windows\system32\vscfdx.dll
2009-11-27 14:57:37 44 —-a-w- c:\windows\batchrec.ini

==================== Find3M ====================

2009-12-07 13:46:24 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-02 20:42:06 195456 ——w- c:\windows\system32\MpSigStub.exe
2009-10-28 14:40:47 173056 ——w- c:\windows\system32\dllcache\ie4uinit.exe
2009-10-21 05:38:36 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38:36 75776 ——w- c:\windows\system32\dllcache\strmfilt.dll
2009-10-21 05:38:36 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38:36 25088 ——w- c:\windows\system32\dllcache\httpapi.dll
2009-10-20 16:20:16 265728 ——w- c:\windows\system32\dllcache\http.sys
2009-10-13 10:30:16 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-13 10:30:16 270336 ——w- c:\windows\system32\dllcache\oakley.dll
2009-10-12 13:38:19 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38:19 149504 ——w- c:\windows\system32\dllcache\rastls.dll
2009-10-12 13:38:18 79872 —-a-w- c:\windows\system32\raschap.dll
2009-10-12 13:38:18 79872 ——w- c:\windows\system32\dllcache\raschap.dll

============= FINISH: 13:40:04.10 ===============



UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 08/11/2006 13:59:20
System Uptime: 23/12/2009 07:24:56 (6 hours ago)

Motherboard: Dell Inc. | | 0HC918
Processor: Intel® Pentium® 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 12 GiB total, 1.051 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 20 GiB total, 11.375 GiB free.
F: is FIXED (NTFS) - 71 GiB total, 13.511 GiB free.
G: is FIXED (NTFS) - 12 GiB total, 11.715 GiB free.
H: is FIXED (NTFS) - 16 GiB total, 1.621 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP658: 20/12/2009 10:26:19 - System Checkpoint
RP659: 20/12/2009 11:15:38 - Removed EverNote 2
RP660: 20/12/2009 11:37:48 - Installed SUPERAntiSpyware Free Edition
RP661: 20/12/2009 15:45:03 - Removed Windows Defender
RP662: 21/12/2009 21:53:32 - System Checkpoint
RP663: 23/12/2009 07:40:33 - System Checkpoint

==== Installed Programs ======================


Acronis True Image
Adobe Acrobat - Reader 6.0.2 Update
Adobe Acrobat 6.0.1 Professional
Adobe Acrobat and Reader 6.0.3 Update
Adobe Acrobat and Reader 6.0.4 Update
Adobe Acrobat and Reader 6.0.5 Update
Adobe Acrobat and Reader 6.0.6 Update
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Creative Suite
Adobe Flash Player 10 ActiveX
Adobe PageMaker Plug-in Pack
Adobe Reader 9.2
Adobe Shockwave Player
Adobe SVG Viewer 3.0
Any Video Converter 2.6.2
Auto Mailer
Avira Premium Security Suite
Belarc Advisor 7.2
CDCheck
CleanUp!
CodeTwo OutlookExport
ColorPic
Comparator Fast
Compatibility Pack for the 2007 Office system
CompuServe 4.0.2
Copernic Desktop Search 2
Core FTP Lite 1.3b
Dell Network Assistant
ERUNT 1.1j
FlashFXP v3
FreeMind
Google Toolbar for Internet Explorer
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
HJTHotkey 3.054
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Intel® AnyPoint® Modem
Intel® Graphics Media Accelerator Driver
Intel® PRO Network Connections Drivers
Intel® Processor ID Utility
Intel® PROSet for Wired Connections
J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java™ 6 Update 7
Kernel for Outlook ver 7.07.01
LeechGet 2006 Version 2.0
LG USB Drive 2.9
Logitech iTouch Software
Malwarebytes' Anti-Malware
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 SR-1 Disc 2
Microsoft Office 2000 SR-1 Professional
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual Keyboard
MiraScan V4.03
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NetMeter 1.1.3
Nikon View 6
OMCI
Open Workbench
OpenAL
Paint Shop Pro 7 ESD
Panda ActiveScan 2.0
Partition Commander
PC Inspector File Recovery
PC Suite for Sony Ericsson
PowerDVD 5.7
RealPlayer
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
SetFileDate 2.0
SimpleOCR 3.1
Skype web features
Skype™ 4.1
Sony Ericsson Symbian 9 Drivers
SpamBayes 1.0.4
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
Superscape Viscape Universal
SyncBack
TAS Book-Keeper
ThinkingRock-2.2.1
TimeReporter Windows CE Edition (Remove Only)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Virtual Key
VMware Workstation
WebFldrs XP
Windows CE Services 2.2 (Remove Only)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
WinZip
Yahoo! Messenger

==== Event Viewer Messages From Past Week ========

19/12/2009 16:15:11, error: Removable Storage Service [111] - RSM could not load media in drive Drive 0 of library LG USB Drive USB Device.
18/12/2009 20:58:48, error: Service Control Manager [7031] - The Avira AntiVir WebGuard service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
18/12/2009 18:53:30, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service Iap with arguments "-Service" in order to run the server: {B0C61A79-0870-4BE4-9153-9CCAF422E31F}
18/12/2009 18:41:11, error: Service Control Manager [7034] - The Wireless Adapter Configurator service terminated unexpectedly. It has done this 1 time(s).
18/12/2009 18:40:26, error: Service Control Manager [7000] - The Intel® AnyPoint® 3240 USB Modem Firmware Loader service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
18/12/2009 07:26:08, error: Service Control Manager [7001] - The Avira AntiVir WebGuard service depends on the Avira AntiVir Guard service which failed to start because of the following error: The operation completed successfully.
18/12/2009 07:26:08, error: Service Control Manager [7001] - The Avira AntiVir MailGuard service depends on the Avira AntiVir Guard service which failed to start because of the following error: The operation completed successfully.
17/12/2009 12:39:02, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

==== End Of File ===========================

Hi Ken and many thanks…the Christmas holiday isn't the best time to catch a virus!

I downloaded MBAM again from your link, reinstalled it and ran the scan. As before, it finds five problems (registry) but after clicking Remove Selected the prog stalls while dealing with one of the two FirewallDisableNotify registry data and then goes to 'Not responding'. I close and restart it and the five problems are shown in the quarantine tab, but I do not get any text log.

I'm an idiot because I realise you probably wanted me to run HJT before downloading and running ComboFix. I didn't, so the HJT report is post Combofix. Sorry about that.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:40:13, on 24/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Avira\AntiVir Desktop\sched.exe
E:\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
E:\Avira\AntiVir Desktop\avmailc.exe
E:\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\svchost.exe
E:\VMware\VMware Workstation\vmware-authd.exe
E:\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
E:\VMware\VMware Workstation\vmware-tray.exe
E:\VMware\VMware Workstation\hqtray.exe
E:\Acronis\TrueImageMonitor.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
E:\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
E:\Copernic Desktop Search 2\Copernic Desktop Search 2\DesktopSearchService.exe
E:\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\BT Business Hub\Wireless Configuration\WirelessDaemon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HJTv2\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - E:\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - E:\FlashFXP\IEFlash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - E:\Copernic Desktop Search 2\Copernic Desktop Search 2\DesktopSearchBand201013011.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [AdobeVersionCue] E:\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [vmware-tray] E:\VMware\VMware Workstation\vmware-tray.exe
O4 - HKLM\..\Run: [VMware hqtray] "E:\VMware\VMware Workstation\hqtray.exe"
O4 - HKLM\..\Run: [Acronis True Image Monitor] "E:\Acronis\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avgnt] "E:\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\adobe reader 9\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] E:\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "E:\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [Copernic Desktop Search 2] "E:\Copernic Desktop Search 2\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - E:\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - E:\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - E:\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162996119580
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1162998267156
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - E:\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - E:\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Avira Firewall (AntiVirFirewallService) - Avira GmbH - E:\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - E:\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - E:\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - E:\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - E:\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - E:\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - E:\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: System Commander 7 MBR check (WinMBR) - Unknown owner - C:\SC\WINMBR.EXE
O23 - Service: Wireless Adapter Configurator - Unknown owner - C:\Program Files\BT Business Hub\Wireless Configuration\WirelessDaemon.exe

–
End of file - 9675 bytes



ComboFix 09-12-24.02 - Surreal 24/12/2009 18:23:15.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.664 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {11638345-E4FC-4BEE-BB73-EC754659C5F6}
FW: Avira Firewall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\winhelp.ini

.
original MBR restored successfully !
.
((((((((((((((((((((((((( Files Created from 2009-11-24 to 2009-12-24 )))))))))))))))))))))))))))))))
.

2009-12-23 13:09 . 2009-12-23 13:09 ——– d—–w- c:\program files\ERUNT
2009-12-21 19:01 . 2009-06-30 09:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2009-12-21 19:01 . 2009-12-21 19:01 ——– d—–w- c:\program files\Panda Security
2009-12-20 11:39 . 2009-12-20 11:39 52224 —-a-w- c:\documents and settings\Surreal\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2009-12-20 11:39 . 2009-12-20 11:39 117760 —-a-w- c:\documents and settings\Surreal\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-20 11:38 . 2009-12-20 11:38 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-12-20 11:37 . 2009-12-20 11:37 ——– d—–w- c:\documents and settings\Surreal\Application Data\SUPERAntiSpyware.com
2009-12-19 16:51 . 2008-01-15 11:44 91264 —-a-r- c:\windows\system32\drivers\zebrsce.sys
2009-12-19 16:51 . 2008-01-15 11:44 109568 —-a-r- c:\windows\system32\drivers\zebrmdm.sys
2009-12-19 16:51 . 2008-01-15 11:44 14848 —-a-r- c:\windows\system32\drivers\zebrmdfl.sys
2009-12-19 16:51 . 2008-01-15 11:44 109568 —-a-r- c:\windows\system32\drivers\zebrmdmc.sys
2009-12-19 16:51 . 2008-01-15 11:44 12160 —-a-r- c:\windows\system32\drivers\zebrcmnt.sys
2009-12-19 16:51 . 2008-01-15 11:44 12160 —-a-r- c:\windows\system32\drivers\zebrcm.sys
2009-12-19 16:51 . 2008-01-15 11:44 83200 —-a-r- c:\windows\system32\drivers\zebrbus.sys
2009-12-19 16:39 . 2008-01-15 11:44 12160 —-a-r- c:\windows\system32\drivers\zebrwhnt.sys
2009-12-19 16:39 . 2008-01-15 11:44 12160 —-a-r- c:\windows\system32\drivers\zebrwh.sys
2009-12-19 16:39 . 2008-01-15 11:44 63360 —-a-r- c:\windows\system32\drivers\zebrceb.sys
2009-12-19 16:39 . 2009-12-19 16:39 ——– d—–w- c:\program files\Sony Ericsson
2009-12-19 16:38 . 2009-12-19 16:38 ——– d—–w- c:\documents and settings\Surreal\Local Settings\Application Data\Sony Ericsson
2009-12-19 16:37 . 2009-12-19 16:37 ——– d—–w- c:\program files\Intuwave
2009-12-19 16:37 . 2009-12-19 16:37 ——– d—–w- c:\program files\Symbian
2009-12-19 16:36 . 2009-12-19 16:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Sony Ericsson
2009-12-19 16:36 . 2009-12-19 16:37 ——– d—–w- c:\program files\Common Files\Sony Ericsson Shared
2009-12-19 16:36 . 2009-12-19 16:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Teleca
2009-12-19 16:36 . 2009-12-19 16:36 ——– d—–w- c:\program files\MSXML 6.0
2009-12-19 11:58 . 2009-12-19 11:58 ——– d—–w- c:\documents and settings\Surreal\Application Data\Malwarebytes
2009-12-19 11:58 . 2009-12-03 16:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-19 11:58 . 2009-12-19 11:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-19 11:58 . 2009-12-03 16:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-19 08:50 . 2006-08-01 08:53 5750784 —-a-w- c:\windows\system32\TempInst.exe
2009-12-18 20:35 . 2009-12-18 20:35 146 —-a-w- c:\windows\DelMR.bat
2009-12-18 17:45 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2009-12-18 16:21 . 2009-12-18 16:21 ——– d—–w- c:\documents and settings\HelpAssistant\WINDOWS
2009-12-18 16:21 . 2009-12-18 16:21 ——– d—–w- c:\documents and settings\HelpAssistant\UserData
2009-12-18 16:21 . 2009-12-20 16:36 ——– d—–w- c:\documents and settings\HelpAssistant\PrivacIE
2009-12-18 16:18 . 2009-12-24 09:19 ——– d—–w- c:\documents and settings\HelpAssistant\IECompatCache
2009-12-18 16:18 . 2009-12-20 16:35 ——– d—–w- c:\documents and settings\HelpAssistant\IETldCache
2009-12-18 16:18 . 2007-07-16 14:36 557056 —-a-w- c:\documents and settings\HelpAssistant\GoToAssist_phone__319_en.exe
2009-12-18 16:18 . 2009-12-18 16:18 ——– d—–w- c:\documents and settings\HelpAssistant\Contacts
2009-12-18 16:13 . 2009-12-18 16:13 ——– d—–w- c:\documents and settings\HelpAssistant\.netbeans
2009-12-18 16:13 . 2009-12-18 16:13 ——– d—–w- c:\documents and settings\HelpAssistant\.freemind
2009-12-09 19:18 . 2009-12-09 19:18 ——– d—–w- c:\documents and settings\Surreal\.netbeans
2009-12-06 15:38 . 2004-03-10 13:42 12953 ——w- c:\windows\system32\drivers\itchfltr.sys
2009-12-06 15:37 . 2004-03-03 09:50 37887 ——w- c:\windows\system32\drivers\Lhidusb.sys
2009-12-06 15:37 . 2004-03-03 09:50 14095 —-a-w- c:\windows\system32\drivers\LCcfltr.sys
2009-12-06 15:37 . 2009-12-06 15:37 ——– d—–w- c:\program files\Common Files\Logitech
2009-12-06 15:37 . 2002-01-05 04:38 54784 —-a-w- c:\windows\system32\MSVCI70.DLL
2009-12-04 09:14 . 2009-12-04 09:14 ——– d—–w- c:\program files\Windows Media Connect 2
2009-12-04 09:12 . 2009-12-04 09:13 ——– d—–w- c:\windows\system32\drivers\UMDF
2009-11-27 14:57 . 2002-08-28 00:00 1248 —-a-w- c:\windows\system32\vscfdx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-24 18:30 . 2007-01-24 14:03 ——– d—–w- c:\documents and settings\All Users\Application Data\VMware
2009-12-24 18:30 . 2007-01-24 14:15 ——– d—–w- c:\documents and settings\Surreal\Application Data\VMware
2009-12-24 18:29 . 2007-01-24 14:05 ——– d—–w- c:\documents and settings\LocalService\Application Data\VMware
2009-12-20 15:36 . 2006-11-15 15:20 ——– d—–w- c:\documents and settings\Surreal\Application Data\Lavasoft
2009-12-20 11:36 . 2006-11-10 10:01 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-20 11:15 . 2006-10-13 09:19 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-19 16:37 . 2006-11-16 16:07 ——– d—–w- c:\program files\Common Files\Teleca Shared
2009-12-19 08:47 . 2006-11-10 09:49 ——– d—–w- c:\documents and settings\Surreal\Application Data\Skype
2009-12-17 16:02 . 2009-11-19 18:22 ——– d—–w- c:\documents and settings\Surreal\Application Data\skypePM
2009-12-09 19:17 . 2007-07-22 15:11 ——– d—–w- c:\documents and settings\Surreal\Application Data\.thinkingrock
2009-12-07 13:46 . 2009-04-16 11:40 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-03 11:49 . 2009-11-22 14:56 ——– d—–w- c:\documents and settings\Surreal\Application Data\Auto Mailer
2009-11-23 13:15 . 2009-11-23 13:14 ——– d—–w- c:\documents and settings\Surreal\Application Data\C2OutlookExport
2009-11-23 08:56 . 2009-11-23 08:56 72704 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\RemoteControl.dll
2009-11-23 08:56 . 2009-11-23 08:56 613888 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\sound\WMASoundPlugin.dll
2009-11-23 08:56 . 2009-11-23 08:56 5439488 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\PamelaPCR.exe
2009-11-23 08:56 . 2009-11-23 08:56 53760 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\zlib.dll
2009-11-23 08:56 . 2009-11-23 08:56 444928 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\sound\SystemMP3SoundPlugin.dll
2009-11-23 08:56 . 2009-11-23 08:56 1603072 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\sound\VorbisOGGSoundPlugin.dll
2009-11-23 08:56 . 2009-11-23 08:56 630272 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\CrashRpt.dll
2009-11-23 08:56 . 2009-11-23 08:56 489984 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\dbghelp.dll
2009-11-23 08:56 . 2009-11-23 08:56 1495040 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\lng.dll
2009-11-23 08:56 . 2009-11-23 08:56 1138688 —-a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\903CB56BA52F42478957BE8314837A86\libeay32.dll
2009-11-22 14:30 . 2006-11-08 14:13 75440 —-a-w- c:\documents and settings\Surreal\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-21 15:51 . 2004-08-11 16:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-19 18:22 . 2009-11-19 18:22 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-11-19 17:51 . 2009-11-19 17:51 ——– d—–w- c:\program files\Common Files\Skype
2009-11-19 17:51 . 2007-02-17 08:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-11-17 13:58 . 2006-11-13 13:55 ——– d—–w- c:\program files\Common Files\Adobe
2009-11-02 20:42 . 2009-10-03 08:00 195456 ——w- c:\windows\system32\MpSigStub.exe
2009-10-29 07:45 . 2004-08-11 16:00 916480 —-a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-11 16:00 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-11 16:00 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 22:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-11 16:00 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-11 16:00 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-11 16:00 79872 —-a-w- c:\windows\system32\raschap.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Copernic Desktop Search 2"="e:\copernic desktop search 2\Copernic Desktop Search 2\DesktopSearchService.exe" [2007-08-01 1514016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeVersionCue"="e:\adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-13 1732608]
"vmware-tray"="e:\vmware\VMware Workstation\vmware-tray.exe" [2007-05-01 68400]
"VMware hqtray"="e:\vmware\VMware Workstation\hqtray.exe" [2007-05-01 56112]
"Acronis True Image Monitor"="e:\acronis\TrueImageMonitor.exe" [2008-10-17 500561]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"avgnt"="e:\avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="e:\adobe reader 9\Reader\Reader_sl.exe" [2009-10-03 35696]
"zBrowser Launcher"="e:\logitech\iTouch\iTouch.exe" [2004-03-18 892928]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2008-10-17 65536]
"PC Suite for Smartphones"="e:\sony ericsson\Mobile4\Application Launcher\Application Launcher.exe" [2007-12-25 548864]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 36040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - e:\adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 217194]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\superantispyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 —-a-w- e:\superantispyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders rpasspc.dll, msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 12:08 935288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSL Connection Manager]
2002-05-10 18:30 65536 —-a-w- c:\program files\Intel\DSLSetup\PRODSL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-12-09 19:29 49152 ——w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LG Drive]
2006-07-28 20:31 1015808 —-a-w- e:\lg usb\LG_Drive.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
2005-07-12 18:05 1117184 —-a-w- c:\program files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Net-It Launcher]
1998-02-05 19:16 24576 —-a-w- c:\windows\system32\NILaunch.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"e:\\Skype\\Plugin Manager\\skypePM.exe"=
"e:\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"3246:TCP"= 3246:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"2879:TCP"= 2879:TCP:Services
"3582:TCP"= 3582:TCP:Services

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [21/12/2009 19:01 28552]
R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [16/04/2009 11:40 97608]
R1 SASDIFSV;SASDIFSV;e:\superantispyware\sasdifsv.sys [16/12/2009 16:26 9968]
R1 SASKUTIL;SASKUTIL;e:\superantispyware\SASKUTIL.SYS [16/12/2009 16:26 74480]
R2 AntiVirFirewallService;Avira Firewall;e:\avira\AntiVir Desktop\avfwsvc.exe [16/04/2009 11:40 388865]
R2 AntiVirMailService;Avira AntiVir MailGuard;e:\avira\AntiVir Desktop\avmailc.exe [16/04/2009 11:40 194817]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;e:\avira\AntiVir Desktop\sched.exe [16/04/2009 11:40 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;e:\avira\AntiVir Desktop\avwebgrd.exe [16/04/2009 11:40 434945]
R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [12/01/2006 21:27 13696]
R2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [12/01/2006 21:29 13568]
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [16/04/2009 11:40 69632]
S2 P32LOAD;Intel® AnyPoint® 3240 USB Modem Firmware Loader;c:\windows\system32\drivers\p31usbld.sys [08/11/2006 14:16 18906]
S2 WinMBR;System Commander 7 MBR check;c:\sc\WINMBR.EXE [09/11/2006 13:21 32768]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [19/12/2009 11:58 38224]
S3 PRO3200P;Intel® USB ADSL Modem;c:\windows\system32\drivers\p32d2kp.sys [27/04/2002 03:23 530785]
S3 SASENUM;SASENUM;e:\superantispyware\SASENUM.SYS [16/12/2009 16:27 7408]
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
LSP: e:\avira\AntiVir Desktop\avsda.dll
.
- - - - ORPHANS REMOVED - - - -

Notify-WgaLogon - (no file)
MSConfigStartUp-SmcService - e:\sygate\SPF\smc.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-24 18:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1468)
e:\superantispyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'lsass.exe'(1524)
e:\avira\AntiVir Desktop\avsda.dll

- - - - - - - > 'explorer.exe'(1568)
c:\windows\system32\WININET.dll
e:\logitech\iTouch\iTchHk.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
e:\avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
e:\vmware\VMware Workstation\vmware-authd.exe
c:\program files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
c:\windows\system32\vmnat.exe
c:\program files\BT Business Hub\Wireless Configuration\WirelessDaemon.exe
c:\windows\system32\fxssvc.exe
c:\windows\system32\vmnetdhcp.exe
e:\avira\AntiVir Desktop\usrreq.exe
.
**************************************************************************
.
Completion time: 2009-12-24 18:34:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-24 18:34

Pre-Run: 922,697,728 bytes free
Post-Run: 951,853,056 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 0DFF3713DAA1CABC725664CA47A225A7

Hi Ken

Nothing quite says Christmas like egg nog. Equally, Christmas is the only time I ever drink egg nog. I hope you enjoyed yours and had a good Christmas.

I ran MBAM in safe mode and it found nothing, but this time it did produce a log, copy below. I ran HJT in normal mode, which I presume is what you wanted.

Malwarebytes' Anti-Malware 1.42
Database version: 3425
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

29/12/2009 12:05:05
mbam-log-2009-12-29 (12-05-05).txt

Scan type: Quick Scan
Objects scanned: 152626
Time elapsed: 3 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11:26, on 29/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Avira\AntiVir Desktop\sched.exe
E:\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
E:\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
E:\VMware\VMware Workstation\vmware-tray.exe
E:\VMware\VMware Workstation\hqtray.exe
E:\Acronis\TrueImageMonitor.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
E:\adobe reader 9\Reader\Reader_sl.exe
E:\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
E:\Copernic Desktop Search 2\Copernic Desktop Search 2\DesktopSearchService.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
E:\Avira\AntiVir Desktop\avmailc.exe
E:\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\svchost.exe
E:\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\BT Business Hub\Wireless Configuration\WirelessDaemon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
E:\HJTv2\HijackThis.exe
E:\Skype\Toolbars\Shared\SkypeNames.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - E:\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - E:\FlashFXP\IEFlash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - E:\Copernic Desktop Search 2\Copernic Desktop Search 2\DesktopSearchBand201013011.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [AdobeVersionCue] E:\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [vmware-tray] E:\VMware\VMware Workstation\vmware-tray.exe
O4 - HKLM\..\Run: [VMware hqtray] "E:\VMware\VMware Workstation\hqtray.exe"
O4 - HKLM\..\Run: [Acronis True Image Monitor] "E:\Acronis\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avgnt] "E:\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\adobe reader 9\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] E:\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "E:\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [Copernic Desktop Search 2] "E:\Copernic Desktop Search 2\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - E:\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - E:\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - E:\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162996119580
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1162998267156
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - E:\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - E:\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Avira Firewall (AntiVirFirewallService) - Avira GmbH - E:\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - E:\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - E:\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - E:\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - E:\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - E:\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - E:\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: System Commander 7 MBR check (WinMBR) - Unknown owner - C:\SC\WINMBR.EXE
O23 - Service: Wireless Adapter Configurator - Unknown owner - C:\Program Files\BT Business Hub\Wireless Configuration\WirelessDaemon.exe

–
End of file - 9740 bytes


Cheers…