[Resolved] "Do you really want close" message/Multiple popup

Hi,

I am getting a message popping up "Do you really want close?", am getting script errors and the desktop is in active desktop recovery mode. Before Active Desktop Recovery turned on, there were multiple search windows popping up without me doing anything. The computer is also running slow. I have followed the steps in "Are You infected". Malwarebytes found around 30 infections on my first scan and removed them, but still having problems. The Malwarebytes log included here shows no infections. Here are my MBAM, Gmer and DDS logs.

Malwarebytes' Anti-Malware 1.44
Database version: 3588
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/18/2010 9:40:23 AM
mbam-log-2010-01-18 (09-40-23).txt

Scan type: Quick Scan
Objects scanned: 120344
Time elapsed: 11 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-18 00:10:57
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\CRISTI~1\LOCALS~1\Temp\pxdiypog.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xF0B4F58C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwClose [0xF0B4FE0C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwConnectPort [0xF0B50922]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateEvent [0xF0B50E94]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateFile [0xF0B500EE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateKey [0xF0B4E436]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateMutant [0xF0B50D6C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xF0B4F192]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreatePort [0xF0B50C28]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSection [0xF0B4F34E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSemaphore [0xF0B50FC6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xF0B52C08]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateThread [0xF0B4FAAA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xF0B50CCA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xF0B525FA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteKey [0xF0B4E9FA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteValueKey [0xF0B4ED88]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xF0B50576]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDuplicateObject [0xF0B535CA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xF0B4EECA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xF0B4EF74]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwFsControlFile [0xF0B50382]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadDriver [0xF0B5268C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey [0xF0B4E412]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey2 [0xF0B4E424]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwMapViewOfSection [0xF0B52CBC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xF0B4F0C0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenEvent [0xF0B50F36]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenFile [0xF0B4FE8E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenKey [0xF0B4E5DC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenMutant [0xF0B50E04]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenProcess [0xF0B4F792]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSection [0xF0B52C32]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSemaphore [0xF0B51068]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenThread [0xF0B4F6B6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryKey [0xF0B4F01E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xF0B4EC46]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQuerySection [0xF0B52FD4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryValueKey [0xF0B4E896]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueueApcThread [0xF0B52922]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRenameKey [0xF0B4EB0E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplaceKey [0xF0B4E2B0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyPort [0xF0B513F2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xF0B512B8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xF0B5239A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRestoreKey [0xF0B55E2C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwResumeThread [0xF0B534AC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKey [0xF0B4E248]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSecureConnectPort [0xF0B5065C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetContextThread [0xF0B4FCC8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetInformationToken [0xF0B51C4A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSecurityObject [0xF0B52786]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSystemInformation [0xF0B53114]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetValueKey [0xF0B4E71E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendProcess [0xF0B531F8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendThread [0xF0B53320]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSystemDebugControl [0xF0B52526]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateProcess [0xF0B4F90A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateThread [0xF0B4F860]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xF0B52E8A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xF0B4F9EA]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

—- EOF - GMER 1.0.15 —-



DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 0:12:23.65 on Mon 01/18/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.26 [GMT -6:00]

AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\lxdvcoms.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X5400 Series\lxdvmon.exe
C:\Program Files\Lexmark X5400 Series\lxdvamon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Cristina Reyes\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.dell4me.com/myway
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
mSearchAssistant = hxxp://www.google.com
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\ievkbd.dll
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - No File
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [NBJ] "c:\program files\ahead\nero backitup\NBJ.exe"
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [lxdvmon.exe] "c:\program files\lexmark x5400 series\lxdvmon.exe"
mRun: [lxdvamon] "c:\program files\lexmark x5400 series\lxdvamon.exe"
mRun: [Lexmark X5400 Series Fax Server] "c:\program files\lexmark x5400 series\fm3032.exe" /s
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe"
uPolicies-system: DisableTaskMgr = 0
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: Yahoo! Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38018.7625347222
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: cbxuttt - cbxuttt.dll
Notify: gebaayy - gebaayy.dll
Notify: igfxcui - igfxsrvc.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: karna.dat,c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll

============= SERVICES / DRIVERS ===============

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
R1 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-9-1 128016]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2010-1-16 315408]
R2 AVP;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe [2009-10-20 340456]
R2 lxdv_device;lxdv_device;c:\windows\system32\lxdvcoms.exe -service –> c:\windows\system32\lxdvcoms.exe -service [?]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-9-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472]
S2 lxdvCATSCustConnectService;lxdvCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdvserv.exe [2008-8-28 98984]
S2 NAVAPEL;NAVAPEL;\??\c:\program files\symantec_client_security\symantec antivirus\navapel.sys –> c:\program files\symantec_client_security\symantec antivirus\NAVAPEL.SYS [?]
S3 NAVAP;NAVAP;\??\c:\progra~1\symant~1\symant~1\navap.sys –> c:\progra~1\symant~1\symant~1\NAVAP.sys [?]

=============== Created Last 30 ================

2010-01-16 22:56 –dsh— c:\documents and settings\cristina reyes\PrivacIE
2010-01-16 22:51 –dsh— c:\documents and settings\cristina reyes\IETldCache
2010-01-16 21:39 12,800 ——– c:\windows\system32\dllcache\xpshims.dll
2010-01-16 21:39 11,069,952 ——– c:\windows\system32\dllcache\ieframe.dll
2010-01-16 21:39 1,985,536 ——– c:\windows\system32\dllcache\iertutil.dll
2010-01-16 21:39 594,432 ——– c:\windows\system32\dllcache\msfeeds.dll
2010-01-16 21:39 246,272 ——– c:\windows\system32\dllcache\ieproxy.dll
2010-01-16 21:39 55,296 ——– c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-16 21:39 –d—– c:\windows\ie8updates
2010-01-16 21:39 92,160 ——– c:\windows\system32\dllcache\iecompat.dll
2010-01-16 21:35 -cd-h— c:\windows\ie8
2010-01-16 20:55 –d—– c:\program files\MSXML 4.0
2010-01-16 20:45 272,128 ——– c:\windows\system32\dllcache\bthport.sys
2010-01-16 20:44 471,552 ——– c:\windows\system32\dllcache\aclayers.dll
2010-01-16 20:44 1,089,593 ——– c:\windows\system32\dllcache\ntprint.cat
2010-01-16 20:42 203,136 ——– c:\windows\system32\dllcache\rmcast.sys
2010-01-16 20:42 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys
2010-01-16 20:42 333,952 ——– c:\windows\system32\dllcache\srv.sys
2010-01-16 20:42 331,776 ——– c:\windows\system32\dllcache\msadce.dll
2010-01-16 20:42 1,315,328 ——– c:\windows\system32\dllcache\msoe.dll
2010-01-16 20:41 691,712 ——– c:\windows\system32\dllcache\inetcomm.dll
2010-01-16 20:39 2,145,280 ——– c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-16 20:39 2,023,936 ——– c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-16 20:39 2,066,048 ——– c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-16 20:38 337,408 ——– c:\windows\system32\dllcache\netapi32.dll
2010-01-16 20:38 1,172,480 ——– c:\windows\system32\dllcache\msxml3.dll
2010-01-16 20:37 2,560 ——– c:\windows\system32\xpsp4res.dll
2010-01-16 20:37 1,206,508 ——– c:\windows\system32\dllcache\sysmain.sdb
2010-01-16 20:37 215,552 ——– c:\windows\system32\dllcache\wordpad.exe
2010-01-16 20:37 726,528 a——- c:\windows\system32\dllcache\jscript.dll
2010-01-16 19:49 108,059 a——- c:\windows\system32\drivers\klin.dat
2010-01-16 19:49 95,259 a——- c:\windows\system32\drivers\klick.dat
2010-01-16 19:39 –d—– c:\program files\Kaspersky Lab
2010-01-16 19:39 –d—– c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2010-01-16 18:06 –d—– c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
2010-01-16 17:57 –d—– c:\windows\system32\XPSViewer
2010-01-16 17:53 597,504 ——– c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-16 17:53 117,760 ——– c:\windows\system32\prntvpt.dll
2010-01-16 17:53 89,088 ——– c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-16 17:53 1,676,288 ——– c:\windows\system32\xpssvcs.dll
2010-01-16 17:53 1,676,288 ——– c:\windows\system32\dllcache\xpssvcs.dll
2010-01-16 17:53 575,488 ——– c:\windows\system32\xpsshhdr.dll
2010-01-16 17:53 575,488 ——– c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-16 17:53 –d—– C:\2b1d13dd4c042712ae8f9145
2010-01-16 14:49 –d—– c:\windows\system32\scripting
2010-01-16 14:49 –d—– c:\windows\l2schemas
2010-01-16 14:49 –d—– c:\windows\system32\en
2010-01-16 14:42 –d—– c:\windows\network diagnostic
2010-01-16 14:26 276,992 ——– c:\windows\system32\wmphoto.dll
2010-01-16 14:26 69,120 ——– c:\windows\system32\wlanapi.dll
2010-01-16 14:26 712,704 ——– c:\windows\system32\windowscodecs.dll
2010-01-16 14:26 346,112 ——– c:\windows\system32\windowscodecsext.dll
2010-01-16 14:26 53,248 ——– c:\windows\system32\tsgqec.dll
2010-01-16 14:26 50,688 ——– c:\windows\system32\tspkg.dll
2010-01-16 14:24 37,376 ——– c:\windows\system32\l2gpstore.dll
2010-01-16 13:27 –d—– c:\windows\system32\wbem\AutoRecover
2010-01-16 12:56 –d—– c:\windows\peernet
2010-01-16 12:56 –d—– c:\windows\provisioning
2010-01-16 12:52 –d—– c:\windows\ServicePackFiles
2010-01-16 12:42 –d—– c:\windows\EHome
2010-01-16 09:26 –d—– c:\docume~1\cristi~1\applic~1\Malwarebytes
2010-01-16 09:26 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-16 09:26 18,520 a——- c:\windows\system32\drivers\mbam.sys
2010-01-16 09:26 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-16 09:26 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-16 09:01 373 a——- c:\windows\system32\MRT.INI
2010-01-16 09:01 –d—– c:\windows\system32\MpEngineStore
2010-01-16 08:46 14,592 a——- c:\windows\system32\drivers\kbdhid.sys

==================== Find3M ====================

2010-01-16 14:54 78,879 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-11-21 09:51 471,552 a——- c:\windows\apppatch\aclayers.dll
2009-10-29 01:45 916,480 a——- c:\windows\system32\wininet.dll
2009-10-29 01:45 916,480 ——– c:\windows\system32\dllcache\wininet.dll
2009-10-29 01:45 5,940,736 ——– c:\windows\system32\dllcache\mshtml.dll
2009-10-29 01:45 1,208,832 ——– c:\windows\system32\dllcache\urlmon.dll
2009-10-29 01:45 206,848 ——– c:\windows\system32\dllcache\occache.dll
2009-10-29 01:45 25,600 ——– c:\windows\system32\dllcache\jsproxy.dll
2009-10-29 01:45 184,320 ——– c:\windows\system32\dllcache\iepeers.dll
2009-10-29 01:45 387,584 ——– c:\windows\system32\dllcache\iedkcs32.dll
2009-10-28 23:38 1,509,888 ——– c:\windows\system32\dllcache\shdocvw.dll
2009-10-28 08:40 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe
2009-10-20 23:38 75,776 a——- c:\windows\system32\strmfilt.dll
2009-10-20 23:38 25,088 a——- c:\windows\system32\httpapi.dll
2009-10-20 23:38 75,776 ——– c:\windows\system32\dllcache\strmfilt.dll
2009-10-20 23:38 25,088 ——– c:\windows\system32\dllcache\httpapi.dll
2009-10-20 19:34 219,664 a——- c:\windows\system32\klogon.dll
2009-10-20 10:20 265,728 ——– c:\windows\system32\dllcache\http.sys
2007-04-13 21:16 800,272 ac—— c:\documents and settings\cristina reyes\ppctl.dll
2007-04-13 13:22 102 ac—— c:\docume~1\cristi~1\applic~1\Dxcuknwrd.dll
2007-04-13 13:19 76 ac—— c:\docume~1\cristi~1\applic~1\Dxcdmns.dll
2007-04-06 13:27 139,264 ac—— c:\program files\common files\hopese.dll
2003-07-25 11:38 132,096 ac—— c:\program files\common files\PCSBoff.exe
2007-04-13 16:48 1,391,967 -c-sh— c:\windows\system32\cfhkj.bak1

============= FINISH: 0:13:56.25 ===============

Howdy,

The computer is behaving quite well. I haven't encountered any of the previously described problems. Here are the logs.

ComboFix 10-01-20.03 - Cristina Reyes 01/20/2010 17:43:34.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.100 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Cristina Reyes\Application Data\Dxcdmns.dll
c:\documents and settings\Cristina Reyes\Application Data\Dxcuknwrd.dll
c:\program files\Dell\prokybortu.html
c:\temp\tn3
c:\windows\patch.exe
c:\windows\system32\bund1
c:\windows\system32\bund1\ClientBundle1.exe
c:\windows\system32\bund1\temp.txt
c:\windows\SYSTEM32\cfhkj.bak1
c:\windows\system32\cfhkj.ini
c:\windows\system32\micro1
c:\windows\system32\micro1\b9.exe
c:\windows\system32\o6.dat
c:\windows\system32\winpfz32.sys
c:\windows\vttc.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_CORE


((((((((((((((((((((((((( Files Created from 2009-12-21 to 2010-01-21 )))))))))))))))))))))))))))))))
.

2010-01-17 04:56 . 2010-01-17 04:56 ——– d-sh–w- c:\documents and settings\Cristina Reyes\PrivacIE
2010-01-17 04:51 . 2010-01-17 04:51 ——– d-sh–w- c:\documents and settings\Cristina Reyes\IETldCache
2010-01-17 03:39 . 2009-10-29 07:45 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2010-01-17 03:39 . 2009-10-29 07:45 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-17 03:39 . 2009-10-29 07:45 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-17 03:39 . 2009-10-29 07:45 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-17 03:39 . 2009-10-29 07:45 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2010-01-17 03:39 . 2009-10-29 07:45 11069952 ——w- c:\windows\system32\dllcache\ieframe.dll
2010-01-17 03:39 . 2010-01-17 22:10 ——– d—–w- c:\windows\ie8updates
2010-01-17 03:39 . 2009-10-02 04:44 92160 ——w- c:\windows\system32\dllcache\iecompat.dll
2010-01-17 03:35 . 2010-01-17 03:38 ——– dc-h–w- c:\windows\ie8
2010-01-17 02:55 . 2010-01-17 02:55 ——– d—–w- c:\program files\MSXML 4.0
2010-01-17 02:45 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2010-01-17 02:44 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2010-01-17 02:43 . 2009-10-15 16:28 81920 ——w- c:\windows\system32\dllcache\fontsub.dll
2010-01-17 02:43 . 2009-10-15 16:28 119808 ——w- c:\windows\system32\dllcache\t2embed.dll
2010-01-17 02:43 . 2009-03-06 14:22 284160 ——w- c:\windows\system32\dllcache\pdh.dll
2010-01-17 02:43 . 2009-02-09 12:10 401408 ——w- c:\windows\system32\dllcache\rpcss.dll
2010-01-17 02:43 . 2009-02-06 11:11 110592 ——w- c:\windows\system32\dllcache\services.exe
2010-01-17 02:43 . 2009-02-09 12:10 473600 ——w- c:\windows\system32\dllcache\fastprox.dll
2010-01-17 02:43 . 2009-02-06 10:10 227840 ——w- c:\windows\system32\dllcache\wmiprvse.exe
2010-01-17 02:43 . 2009-02-09 12:10 617472 ——w- c:\windows\system32\dllcache\advapi32.dll
2010-01-17 02:43 . 2009-02-09 12:10 453120 ——w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-17 02:43 . 2009-02-09 12:10 714752 ——w- c:\windows\system32\dllcache\ntdll.dll
2010-01-17 02:43 . 2009-06-21 21:44 153088 ——w- c:\windows\system32\dllcache\triedit.dll
2010-01-17 02:42 . 2008-05-08 14:02 203136 ——w- c:\windows\system32\dllcache\rmcast.sys
2010-01-17 02:42 . 2008-10-24 11:21 455296 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-17 02:42 . 2008-12-11 10:57 333952 ——w- c:\windows\system32\dllcache\srv.sys
2010-01-17 02:42 . 2008-05-01 14:33 331776 ——w- c:\windows\system32\dllcache\msadce.dll
2010-01-17 02:42 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2010-01-17 02:41 . 2008-04-11 19:04 691712 ——w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-17 02:39 . 2009-08-04 15:13 2145280 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-17 02:39 . 2009-08-04 14:20 2023936 ——w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-17 02:39 . 2009-08-04 14:20 2066048 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-17 02:38 . 2008-10-15 16:34 337408 ——w- c:\windows\system32\dllcache\netapi32.dll
2010-01-17 02:38 . 2009-07-31 04:35 1172480 ——w- c:\windows\system32\dllcache\msxml3.dll
2010-01-17 02:37 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-01-17 02:37 . 2008-04-21 12:08 215552 ——w- c:\windows\system32\dllcache\wordpad.exe
2010-01-17 02:37 . 2009-06-22 06:44 726528 —-a-w- c:\windows\system32\dllcache\jscript.dll
2010-01-17 02:17 . 2010-01-17 02:17 80400 —-a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-01-17 02:17 . 2010-01-17 02:17 80400 —-a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-01-17 01:49 . 2010-01-17 01:49 95259 —-a-w- c:\windows\system32\drivers\klick.dat
2010-01-17 01:49 . 2010-01-17 01:49 108059 —-a-w- c:\windows\system32\drivers\klin.dat
2010-01-17 01:39 . 2010-01-21 00:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-01-17 01:39 . 2010-01-17 01:39 ——– d—–w- c:\program files\Kaspersky Lab
2010-01-17 00:06 . 2010-01-17 00:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-01-16 23:57 . 2010-01-16 23:57 ——– d—–w- c:\windows\system32\XPSViewer
2010-01-16 23:57 . 2010-01-16 23:57 ——– d—–w- c:\program files\MSBuild
2010-01-16 23:56 . 2010-01-16 23:56 ——– d—–w- c:\program files\Reference Assemblies
2010-01-16 23:55 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-01-16 23:53 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-16 23:53 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-01-16 23:53 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-01-16 23:53 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-16 23:53 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-01-16 23:53 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-16 23:53 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-01-16 23:53 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2010-01-16 23:53 . 2010-01-16 23:55 ——– d—–w- C:\2b1d13dd4c042712ae8f9145
2010-01-16 20:49 . 2010-01-16 20:49 ——– d—–w- c:\windows\system32\scripting
2010-01-16 20:49 . 2010-01-16 20:49 ——– d—–w- c:\windows\l2schemas
2010-01-16 20:49 . 2010-01-16 20:49 ——– d—–w- c:\windows\system32\en
2010-01-16 20:26 . 2008-04-14 00:12 276992 ——w- c:\windows\system32\wmphoto.dll
2010-01-16 20:26 . 2008-04-14 00:12 69120 ——w- c:\windows\system32\wlanapi.dll
2010-01-16 20:26 . 2008-04-14 00:12 712704 ——w- c:\windows\system32\windowscodecs.dll
2010-01-16 20:26 . 2008-04-14 00:12 346112 ——w- c:\windows\system32\windowscodecsext.dll
2010-01-16 20:26 . 2008-04-14 00:12 53248 ——w- c:\windows\system32\tsgqec.dll
2010-01-16 20:26 . 2008-04-14 00:12 50688 ——w- c:\windows\system32\tspkg.dll
2010-01-16 20:24 . 2008-04-14 00:11 37376 ——w- c:\windows\system32\l2gpstore.dll
2010-01-16 19:27 . 2010-01-17 00:00 ——– d—–w- c:\windows\system32\wbem\AutoRecover
2010-01-16 18:56 . 2010-01-16 20:49 ——– d—–w- c:\windows\peernet
2010-01-16 18:56 . 2010-01-16 18:56 ——– d—–w- c:\windows\provisioning
2010-01-16 18:52 . 2010-01-16 20:50 ——– d—–w- c:\windows\ServicePackFiles
2010-01-16 18:42 . 2010-01-16 20:34 ——– d—–w- c:\windows\EHome
2010-01-16 15:26 . 2010-01-16 15:26 ——– d—–w- c:\documents and settings\Cristina Reyes\Application Data\Malwarebytes
2010-01-16 15:26 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-16 15:26 . 2010-01-16 15:26 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-16 15:26 . 2010-01-16 15:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-16 15:26 . 2010-01-07 22:07 18520 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-16 15:23 . 2010-01-16 15:23 ——– d—–w- c:\program files\ERUNT
2010-01-16 15:01 . 2010-01-16 15:01 ——– d—–w- c:\windows\system32\MpEngineStore
2010-01-16 14:46 . 2008-04-13 18:39 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-20 23:55 . 2004-01-12 20:44 ——– d—–w- c:\program files\Dell
2010-01-17 00:02 . 2004-01-17 19:39 89776 -c–a-w- c:\documents and settings\Cristina Reyes\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-29 07:45 . 2006-06-23 16:33 916480 —-a-w- c:\windows\system32\wininet.dll
2007-04-06 19:27 . 2007-04-06 19:27 139264 -c–a-w- c:\program files\Common Files\hopese.dll
2003-07-25 17:38 . 2004-03-25 17:33 132096 -c–a-w- c:\program files\Common Files\PCSBoff.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-12 1961984]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-13 517768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-07-22 98304]
"lxdvmon.exe"="c:\program files\Lexmark X5400 Series\lxdvmon.exe" [2007-11-02 455336]
"lxdvamon"="c:\program files\Lexmark X5400 Series\lxdvamon.exe" [2007-11-02 25256]
"Lexmark X5400 Series Fax Server"="c:\program files\Lexmark X5400 Series\fm3032.exe" [2007-11-02 307880]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2009-10-21 340456]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion (2).lnk]
backup=c:\windows\pss\AOL Companion (2).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
backup=c:\windows\pss\AOL Companion.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Cristina Reyes^Start Menu^Programs^Startup^Webshots.lnk]
backup=c:\windows\pss\Webshots.lnkStartup
path=c:\documents and settings\Cristina Reyes\Start Menu\Programs\Startup\Webshots.lnk
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pure Networks Port Magic
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
2003-08-29 09:59 122880 -c–a-w- c:\windows\BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 16:09 460784 -c–a-w- c:\program files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2003-08-06 07:04 114741 -c–a-w- c:\windows\SYSTEM32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
2003-08-13 16:27 28672 -c–a-w- c:\windows\SYSTEM32\DSentry.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2003-04-07 06:07 114688 -c–a-w- c:\windows\SYSTEM32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2003-04-07 06:19 155648 -c–a-w- c:\windows\SYSTEM32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 16:50 155648 -c–a-w- c:\windows\SYSTEM32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2004-07-22 21:25 98304 -c–a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2006-04-05 18:20 26112 -c–a-w- c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
2003-02-13 07:01 155648 -c–a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"vsmon"=2 (0x2)
"DSBrokerService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Lexmark X5400 Series\\lxdvmon.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\SYSTEM32\DRIVERS\klbg.sys [10/14/2009 8:18 PM 36880]
R2 lxdv_device;lxdv_device;c:\windows\System32\lxdvcoms.exe -service –> c:\windows\System32\lxdvcoms.exe -service [?]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\SYSTEM32\DRIVERS\klim5.sys [9/14/2009 1:42 PM 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\SYSTEM32\DRIVERS\klmouflt.sys [10/2/2009 6:39 PM 19472]
S2 lxdvCATSCustConnectService;lxdvCATSCustConnectService;c:\windows\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdvserv.exe [8/28/2008 5:13 PM 98984]

— Other Services/Drivers In Memory —

*Deregistered* - IPVNMon
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Yahoo! Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
.
.
——- File Associations ——-
.
.
- - - - ORPHANS REMOVED - - - -

Notify-cbxuttt - cbxuttt.dll
Notify-gebaayy - gebaayy.dll
Notify-jkhfc - (no file)
MSConfigStartUp-bantool - c:\windows\SYSTEM32\micro1\b9.exe
MSConfigStartUp-CaAvTray - c:\program files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
MSConfigStartUp-CAVRID - c:\program files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-Dell AIO Printer A920 - c:\program files\Dell AIO Printer A920\dlbkbmgr.exe
MSConfigStartUp-mmtask - c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
MSConfigStartUp-MMTray - c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
MSConfigStartUp-osCheck - c:\program files\Norton AntiVirus\osCheck.exe
MSConfigStartUp-PCMService - c:\program files\Dell\Media Experience\PCMService.exe
MSConfigStartUp-QOELOADER - c:\program files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe
MSConfigStartUp-Zone Labs Client - c:\program files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-20 18:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3800)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\IME\SPGRMR.DLL
.
———————— Other Running Processes ————————
.
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\System32\lxdvcoms.exe
c:\windows\System32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-01-20 18:20:11 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-21 00:19

Pre-Run: 24,296,140,800 bytes free
Post-Run: 24,117,219,328 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 023AE8371CC763807AA0B14600AA8278



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:55:57 PM, on 1/20/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\lxdvcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X5400 Series\lxdvmon.exe
C:\Program Files\Lexmark X5400 Series\lxdvamon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [lxdvmon.exe] "C:\Program Files\Lexmark X5400 Series\lxdvmon.exe"
O4 - HKLM\..\Run: [lxdvamon] "C:\Program Files\Lexmark X5400 Series\lxdvamon.exe"
O4 - HKLM\..\Run: [Lexmark X5400 Series Fax Server] "C:\Program Files\Lexmark X5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxdvCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdvserv.exe
O23 - Service: lxdv_device - - C:\WINDOWS\System32\lxdvcoms.exe

–
End of file - 5396 bytes