Spyware / Malware / Virus Removal

[Resolved] Slooowww computer, keeps freezing - can't get it cleane

55 min read

Looking for the outcome? Ask AI

Patrick's Mom Topic Starter

Post #1March 1, 2010, 7:46 PM UTC

My computer is a mess! I can't get it to stop freezing up - and it is very slow. Faster when not connected to the internet. I've used many clean-up programs - nothing is cleaning it up. I used Advanced Uninstaller to get rid of programs that we don't use anymore - and clean up the registry - and defragged the hard drive.

I'm hoping someone here can guide me - or tell me to wipe this computer clean and start over. I have a good back-up, so all would not be lost if I scrap this computer. This infection seems to be on this desktop as well as my netbook - But the netbook dumped completely and I had to start from fresh - had a carbonite back-up for it, and it seems OK now.

I've completed all the steps in the self help post - Malwarebytes took many tries, as the PC kept freezing. Some of the logs are empty. Here is a copy of the last time it ran successfully.

Malwarebytes' Anti-Malware 1.44
Database version: 3793
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/25/2010 5:30:37 PM
mbam-log-2010-02-25 (17-30-37).txt

Scan type: Quick Scan
Objects scanned: 182419
Time elapsed: 4 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

BUT – since this has been going on for over a week – here is the oldest MBAM file that shows the infections that were cleaned off on 2-16:

Malwarebytes' Anti-Malware 1.42
Database version: 3292
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/16/2010 2:37:28 PM
mbam-log-2010-02-16 (14-37-28).txt

Scan type: Quick Scan
Objects scanned: 165779
Time elapsed: 29 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\SYSTEM32\lowsec (Stolen.data) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\SYSTEM32\lowsec\local.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\lowsec\user.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.Malwarebytes' Anti-Malware 1.42
Database version: 3292
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/16/2010 2:37:28 PM
mbam-log-2010-02-16 (14-37-28).txt

Scan type: Quick Scan
Objects scanned: 165779
Time elapsed: 29 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\SYSTEM32\lowsec (Stolen.data) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\SYSTEM32\lowsec\local.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\lowsec\user.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.

I did not successfully complete the GMER scan – the scan ran for 13 ½ hours – I finally chose stop and copied what it had saved so far. Previously, when I let it run overnight, it froze the computer and I lost the log. I figured this was better than nothing.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-28 23:47:39
Windows 5.1.2600 Service Pack 3
Running: mcn91lzz.exe; Driver: C:\DOCUME~1\SARABY~1\LOCALS~1\Temp\pxryquog.sys

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \WINDOWS\system32\hal.dll[ntoskrnl.exe!IoReadPartitionTable] [F7718A9C] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT \WINDOWS\system32\hal.dll[ntoskrnl.exe!IoWritePartitionTable] [F7718C50] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT ftdisk.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F7718B72] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT dmio.sys[ntoskrnl.exe!IoWritePartitionTableEx] [F7718C70] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT dmio.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F7718B72] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT PartMgr.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F7718B72] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoReadPartitionTable] [F7718A9C] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F7718B72] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoWritePartitionTableEx] [F7718C70] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)

—- Threads - GMER 1.0.15 —-

Thread System [4:248] 89FA3EAB

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs@\x00b8f3\5m\5\x2018|\1\ImageUploader4.ocx 1
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 …
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 …
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 …
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 …
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 …
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 …
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 …
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC …
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 …
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 …
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xF8 0x31 0x0F 0xA9 …
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F …

—- EOF - GMER 1.0.15 —-

Here is dds.txt:

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 9:38:39.42 on Fri 02/26/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1208 [GMT -6:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\NetDrive\wdService.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\NetDrive\netdrive.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Documents and Settings\Sara Byron\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://member.square-enix.com/na/
mSearch Bar =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\4608\SiteAdv.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: AIM Search: {40d41a8b-d79b-43d7-99a7-9ee0f344c385} -
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
mRun: [WebDriveTray] c:\program files\netdrive\netdrive.exe /trayicon
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [pdfFactory Dispatcher v2] "c:\windows\system32\spool\drivers\w32x86\3\fppdis2a.exe" /source=HKLM
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\saraby~1\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\Hotsync.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\1.0.150\SSScheduler.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe
IE: &AIM Search - c:\program files\aim toolbar\AIMBar.dll/aimsearch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
LSP: c:\program files\common files\is3\anti-spyware\iS3lsp.dll
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1212589685328
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124298262359
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\4608\SiteAdv.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\saraby~1\applic~1\mozilla\firefox\profiles\sayrjs30.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.ravelry.com/account/login|https://webauth.att.net/auth/webmail/login?action=Login&url=http%3A%2F%2Fwebmail.att.net%2Fwmc%2Fv%2Fwm%2F49B4A62800082B1E00002C2F2223070362%2F%3Fcmd%3DList%26sid%3Dc0|http://www.voy.com/33031/|http://central.hinsdale86.org/Daily%20Announcements/Forms/AllItems.aspx|http://mail.google.com/mail/?source=navclient-ff&zx=1w0tkde3j7rys&shva=1#inbox|http://www.facebook.com/login.php?v=1.0&api_key=e004be66908863e93f45ec5853daecba&next=%3Faction%3Dseal%26id%3D856664843%26skip%3D856664843&canvas|http://www.atlasquest.com/people/profile.html|http://www.hcbands.org/|http://www.fiberfarm.com/blog
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\documents and settings\madeleine jeffers\application data\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\sara byron\application data\mozilla\plugins\npPxPlay.dll
FF - plugin: c:\progra~1\palm\packag~1\NPInstal.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npImgCtl.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{016DF527-9AF7-4BC2-BD9E-34D05F7A1F70}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{01C06508-0C57-4082-A738-6B2F9A5A59CD}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{02FF4F54-FD1C-44B1-84E3-603B1AE8DC72}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{0317A91C-C779-4581-83B9-AAD99BA50BA9}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{0E4C258E-281E-4520-B75D-263F2967BA55}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{0EAF2F58-4C1E-4A1E-8DD2-8B76F49B1CF6}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{1699CADF-FD0A-4E01-B400-8B9F8799A35A}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{199741E1-C634-43E8-AA10-F13C1C982335}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{2616CA37-8B21-47E1-AA81-BB2F902A4892}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{442AC648-BF2F-49F6-9AC4-B0DBC63D01D8}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{4530B6AC-E069-4F99-8611-6121446C7AEE}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{492939E7-9203-4D7B-9B75-757CF91EED05}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{617F406A-8430-4AB3-94A6-6F5EBC5EB7C3}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{61E9AA48-00AE-4808-A5F9-B72ED13AE6FE}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{6542FD09-F5BE-4FFE-8C76-B4FB34BC9FA6}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{709B382F-0B93-48D4-BAE9-5CCA5170DCC2}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{722A931A-C51F-4DC3-AE99-456CA2051925}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{74DC7346-30E0-4832-82AF-49FDD7F5AA07}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{873772F7-2E43-47C1-85E4-139A43F84170}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{87C40D07-D704-470C-9748-F103DD18BEA5}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{8972C2BA-2D6E-4541-AFE6-F930DC9F7175}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{8B7CCFFE-86CA-456D-ABA9-5FF094F56C17}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{920BA538-E00D-439E-B8D6-EBB288B9606F}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{9538F178-3B16-466C-B1EF-777E63103B41}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{9645AE60-A3F1-438A-9B0D-0F76F66C9511}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{964BFDA6-8FCA-44B7-9DF7-BD6757FFF558}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{99E483E4-AD71-4743-9F7F-9AFD206A4862}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{9A44BA76-7229-4EF4-8278-ADBD4FFEB8B2}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{9CB5361A-982E-40C2-B062-01C14B4A614D}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{A372AF5B-DB78-4E14-B880-24930934415A}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{A4877708-C36F-417B-A7DF-6DE65211C3CB}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{A61B8474-456C-4D55-A36A-FBB03B23A3B3}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{B6FF86AF-1A35-4252-967A-DDE1F5B2E368}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{B89501EF-C474-4290-A994-334057467790}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{BCD115C6-8493-4802-80A4-1A902E50A63B}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{C579F7C3-2288-4432-9AB7-C319BEB20EA9}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{C7323893-177D-4BA2-8726-A4B9A8DBF535}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{CBCCEB08-9904-4D8C-9E70-AEB75453EDDA}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{CDCB005E-4729-4BCC-8DFF-2C12C6FB8CE6}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{DC993398-01C8-464D-AF8D-47CDE7DDEE11}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{E3D3C967-77CF-4857-A104-0C5168045EC8}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{E8FC9FCE-B152-481B-816C-794628625FEC}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{EEFC096A-6E90-48A7-A322-2ABBB47FF89C}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{F0A004A0-BF6F-44BD-9979-5935A9F954BE}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 MDPMGRNT;MDPMGRNT;c:\windows\system32\drivers\MDPMGRNT.SYS [2005-7-20 24320]
R0 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [2008-10-8 49664]
R1 MDFSYSNT;MDFSYSNT;c:\windows\system32\drivers\MDFSYSNT.SYS [2006-9-13 213888]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2006-10-20 214664]
R2 DVDAccss;DVDAccss;c:\windows\system32\drivers\DVDAccss.sys [2008-12-3 29156]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-11-10 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2006-10-20 144704]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-4-10 24652]
R2 WebDriveFSD;WebDrive File System Driver;c:\program files\netdrive\rffsd.sys [2005-9-23 67032]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2006-10-20 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2006-10-20 35272]
R3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2006-10-20 34248]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys –> c:\program files\superantispyware\SASKUTIL.sys [?]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2004-10-27 26144]
S3 lac97inf;lac97inf;\??\c:\docume~1\saraby~1\locals~1\temp\lac97inf.sys –> c:\docume~1\saraby~1\locals~1\temp\lac97inf.sys [?]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2006-10-20 40552]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2006-2-16 4096]
S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2006-10-20 606736]
S4 RFNP32;WebDrive Provider; [x]

=============== Created Last 30 ================

2010-02-25 10:29 –d—– c:\program files\common files\Innovative Solutions
2010-02-25 10:29 47,984 a——- c:\windows\system32\AdvUninstCPL.cpl
2010-02-25 10:29 –d—– c:\docume~1\alluse~1\applic~1\Innovative Solutions
2010-02-15 16:31 -cd-h— c:\windows\ie8
2010-02-03 09:24 –d—– c:\program files\iTunes

==================== Find3M ====================

2010-02-25 15:26 128,728 a——- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-01-07 16:07 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-12-31 10:50 353,792 a——- c:\windows\system32\drivers\srv.sys
2009-12-31 10:50 353,792 ——– c:\windows\system32\dllcache\srv.sys
2009-12-21 07:19 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe
2009-12-16 12:43 343,040 a——- c:\windows\system32\mspaint.exe
2009-12-16 12:43 343,040 ——– c:\windows\system32\dllcache\mspaint.exe
2009-12-14 01:08 33,280 a——- c:\windows\system32\csrsrv.dll
2009-12-14 01:08 33,280 ——– c:\windows\system32\dllcache\csrsrv.dll
2009-12-11 02:38 69,120 ——– c:\windows\system32\dllcache\iecompat.dll
2009-12-08 23:53 726,528 a——- c:\windows\system32\dllcache\jscript.dll
2009-12-08 13:27 2,189,184 ——– c:\windows\system32\dllcache\ntoskrnl.exe
2009-12-08 13:26 2,145,280 a——- c:\windows\system32\ntoskrnl.exe
2009-12-08 13:26 2,145,280 ——– c:\windows\system32\dllcache\ntkrnlmp.exe
2009-12-08 12:43 2,023,936 a——- c:\windows\system32\ntkrnlpa.exe
2009-12-08 12:43 2,023,936 ——– c:\windows\system32\dllcache\ntkrpamp.exe
2009-12-08 12:43 2,066,048 ——– c:\windows\system32\dllcache\ntkrnlpa.exe
2009-12-04 12:22 455,424 ——– c:\windows\system32\dllcache\mrxsmb.sys
2009-12-01 17:00 20 —-h— c:\docume~1\alluse~1\applic~1\PKP_DLds.DAT
2009-12-01 17:00 20 —-h— c:\docume~1\alluse~1\applic~1\PKP_DLec.DAT
2004-10-23 23:19 41 ——– c:\docume~1\saraby~1\applic~1\tvmcwrd.dll
2003-08-27 14:19 36,963 ac—r– c:\program files\common files\SM1updtr.dll
2008-10-12 00:50 144 a–sh— c:\windows\system32\4232985852.dat
2009-04-27 06:58 49,152 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009042720090428\index.dat
2009-04-28 03:43 49,152 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009042820090429\index.dat
2009-05-03 19:36 49,152 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009050320090504\index.dat

============= FINISH: 9:41:00.42 ===============
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 9:38:39.42 on Fri 02/26/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1208 [GMT -6:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\NetDrive\wdService.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\NetDrive\netdrive.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Documents and Settings\Sara Byron\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://member.square-enix.com/na/
mSearch Bar =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\4608\SiteAdv.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: AIM Search: {40d41a8b-d79b-43d7-99a7-9ee0f344c385} -
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
mRun: [WebDriveTray] c:\program files\netdrive\netdrive.exe /trayicon
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [pdfFactory Dispatcher v2] "c:\windows\system32\spool\drivers\w32x86\3\fppdis2a.exe" /source=HKLM
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\saraby~1\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\Hotsync.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\1.0.150\SSScheduler.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe
IE: &AIM Search - c:\program files\aim toolbar\AIMBar.dll/aimsearch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
LSP: c:\program files\common files\is3\anti-spyware\iS3lsp.dll
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1212589685328
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124298262359
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\4608\SiteAdv.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\saraby~1\applic~1\mozilla\firefox\profiles\sayrjs30.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.ravelry.com/account/login|https://webauth.att.net/auth/webmail/login?action=Login&url=http%3A%2F%2Fwebmail.att.net%2Fwmc%2Fv%2Fwm%2F49B4A62800082B1E00002C2F2223070362%2F%3Fcmd%3DList%26sid%3Dc0|http://www.voy.com/33031/|http://central.hinsdale86.org/Daily%20Announcements/Forms/AllItems.aspx|http://mail.google.com/mail/?source=navclient-ff&zx=1w0tkde3j7rys&shva=1#inbox|http://www.facebook.com/login.php?v=1.0&api_key=e004be66908863e93f45ec5853daecba&next=%3Faction%3Dseal%26id%3D856664843%26skip%3D856664843&canvas|http://www.atlasquest.com/people/profile.html|http://www.hcbands.org/|http://www.fiberfarm.com/blog
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\documents and settings\madeleine jeffers\application data\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\sara byron\application data\mozilla\plugins\npPxPlay.dll
FF - plugin: c:\progra~1\palm\packag~1\NPInstal.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npImgCtl.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{016DF527-9AF7-4BC2-BD9E-34D05F7A1F70}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{01C06508-0C57-4082-A738-6B2F9A5A59CD}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{02FF4F54-FD1C-44B1-84E3-603B1AE8DC72}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{0317A91C-C779-4581-83B9-AAD99BA50BA9}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{0E4C258E-281E-4520-B75D-263F2967BA55}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{0EAF2F58-4C1E-4A1E-8DD2-8B76F49B1CF6}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{1699CADF-FD0A-4E01-B400-8B9F8799A35A}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{199741E1-C634-43E8-AA10-F13C1C982335}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{2616CA37-8B21-47E1-AA81-BB2F902A4892}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{442AC648-BF2F-49F6-9AC4-B0DBC63D01D8}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{4530B6AC-E069-4F99-8611-6121446C7AEE}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{492939E7-9203-4D7B-9B75-757CF91EED05}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{617F406A-8430-4AB3-94A6-6F5EBC5EB7C3}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{61E9AA48-00AE-4808-A5F9-B72ED13AE6FE}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{6542FD09-F5BE-4FFE-8C76-B4FB34BC9FA6}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{709B382F-0B93-48D4-BAE9-5CCA5170DCC2}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{722A931A-C51F-4DC3-AE99-456CA2051925}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{74DC7346-30E0-4832-82AF-49FDD7F5AA07}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{873772F7-2E43-47C1-85E4-139A43F84170}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{87C40D07-D704-470C-9748-F103DD18BEA5}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{8972C2BA-2D6E-4541-AFE6-F930DC9F7175}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{8B7CCFFE-86CA-456D-ABA9-5FF094F56C17}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{920BA538-E00D-439E-B8D6-EBB288B9606F}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{9538F178-3B16-466C-B1EF-777E63103B41}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{9645AE60-A3F1-438A-9B0D-0F76F66C9511}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{964BFDA6-8FCA-44B7-9DF7-BD6757FFF558}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{99E483E4-AD71-4743-9F7F-9AFD206A4862}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{9A44BA76-7229-4EF4-8278-ADBD4FFEB8B2}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{9CB5361A-982E-40C2-B062-01C14B4A614D}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{A372AF5B-DB78-4E14-B880-24930934415A}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{A4877708-C36F-417B-A7DF-6DE65211C3CB}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{A61B8474-456C-4D55-A36A-FBB03B23A3B3}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{B6FF86AF-1A35-4252-967A-DDE1F5B2E368}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{B89501EF-C474-4290-A994-334057467790}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{BCD115C6-8493-4802-80A4-1A902E50A63B}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{C579F7C3-2288-4432-9AB7-C319BEB20EA9}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{C7323893-177D-4BA2-8726-A4B9A8DBF535}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{CBCCEB08-9904-4D8C-9E70-AEB75453EDDA}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{CDCB005E-4729-4BCC-8DFF-2C12C6FB8CE6}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{DC993398-01C8-464D-AF8D-47CDE7DDEE11}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{E3D3C967-77CF-4857-A104-0C5168045EC8}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{E8FC9FCE-B152-481B-816C-794628625FEC}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{EEFC096A-6E90-48A7-A322-2ABBB47FF89C}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program files\mozilla firefox\extensions\{F0A004A0-BF6F-44BD-9979-5935A9F954BE}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 MDPMGRNT;MDPMGRNT;c:\windows\system32\drivers\MDPMGRNT.SYS [2005-7-20 24320]
R0 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [2008-10-8 49664]
R1 MDFSYSNT;MDFSYSNT;c:\windows\system32\drivers\MDFSYSNT.SYS [2006-9-13 213888]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2006-10-20 214664]
R2 DVDAccss;DVDAccss;c:\windows\system32\drivers\DVDAccss.sys [2008-12-3 29156]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-11-10 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2006-10-20 144704]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-4-10 24652]
R2 WebDriveFSD;WebDrive File System Driver;c:\program files\netdrive\rffsd.sys [2005-9-23 67032]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2006-10-20 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2006-10-20 35272]
R3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2006-10-20 34248]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys –> c:\program files\superantispyware\SASKUTIL.sys [?]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2004-10-27 26144]
S3 lac97inf;lac97inf;\??\c:\docume~1\saraby~1\locals~1\temp\lac97inf.sys –> c:\docume~1\saraby~1\locals~1\temp\lac97inf.sys [?]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2006-10-20 40552]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2006-2-16 4096]
S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2006-10-20 606736]
S4 RFNP32;WebDrive Provider; [x]

=============== Created Last 30 ================

2010-02-25 10:29 –d—– c:\program files\common files\Innovative Solutions
2010-02-25 10:29 47,984 a——- c:\windows\system32\AdvUninstCPL.cpl
2010-02-25 10:29 –d—– c:\docume~1\alluse~1\applic~1\Innovative Solutions
2010-02-15 16:31 -cd-h— c:\windows\ie8
2010-02-03 09:24 –d—– c:\program files\iTunes

==================== Find3M ====================

2010-02-25 15:26 128,728 a——- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-01-07 16:07 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-12-31 10:50 353,792 a——- c:\windows\system32\drivers\srv.sys
2009-12-31 10:50 353,792 ——– c:\windows\system32\dllcache\srv.sys
2009-12-21 07:19 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe
2009-12-16 12:43 343,040 a——- c:\windows\system32\mspaint.exe
2009-12-16 12:43 343,040 ——– c:\windows\system32\dllcache\mspaint.exe
2009-12-14 01:08 33,280 a——- c:\windows\system32\csrsrv.dll
2009-12-14 01:08 33,280 ——– c:\windows\system32\dllcache\csrsrv.dll
2009-12-11 02:38 69,120 ——– c:\windows\system32\dllcache\iecompat.dll
2009-12-08 23:53 726,528 a——- c:\windows\system32\dllcache\jscript.dll
2009-12-08 13:27 2,189,184 ——– c:\windows\system32\dllcache\ntoskrnl.exe
2009-12-08 13:26 2,145,280 a——- c:\windows\system32\ntoskrnl.exe
2009-12-08 13:26 2,145,280 ——– c:\windows\system32\dllcache\ntkrnlmp.exe
2009-12-08 12:43 2,023,936 a——- c:\windows\system32\ntkrnlpa.exe
2009-12-08 12:43 2,023,936 ——– c:\windows\system32\dllcache\ntkrpamp.exe
2009-12-08 12:43 2,066,048 ——– c:\windows\system32\dllcache\ntkrnlpa.exe
2009-12-04 12:22 455,424 ——– c:\windows\system32\dllcache\mrxsmb.sys
2009-12-01 17:00 20 —-h— c:\docume~1\alluse~1\applic~1\PKP_DLds.DAT
2009-12-01 17:00 20 —-h— c:\docume~1\alluse~1\applic~1\PKP_DLec.DAT
2004-10-23 23:19 41 ——– c:\docume~1\saraby~1\applic~1\tvmcwrd.dll
2003-08-27 14:19 36,963 ac—r– c:\program files\common files\SM1updtr.dll
2008-10-12 00:50 144 a–sh— c:\windows\system32\4232985852.dat
2009-04-27 06:58 49,152 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009042720090428\index.dat
2009-04-28 03:43 49,152 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009042820090429\index.dat
2009-05-03 19:36 49,152 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009050320090504\index.dat

============= FINISH: 9:41:00.42 ===============

I do have an attach.txt, if you need it.
I would appreciate any help that you can offer – Thank you very much.

CatByte

Post #2March 2, 2010, 12:36 AM UTC

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Patrick's Mom

Post #3March 2, 2010, 2:07 AM UTC

OK - Thanks! I did the steps you requested, and here is a copy of the log:

ComboFix 10-03-01.01 - Sara Byron 03/01/2010 19:37:02.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1441 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1315939165-527412278-1429928585-1000
c:\program files\Common
c:\program files\Mozilla Firefox\extensions\{016DF527-9AF7-4BC2-BD9E-34D05F7A1F70}
c:\program files\Mozilla Firefox\extensions\{016DF527-9AF7-4BC2-BD9E-34D05F7A1F70}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{016DF527-9AF7-4BC2-BD9E-34D05F7A1F70}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{016DF527-9AF7-4BC2-BD9E-34D05F7A1F70}\install.rdf
c:\program files\Mozilla Firefox\extensions\{01C06508-0C57-4082-A738-6B2F9A5A59CD}
c:\program files\Mozilla Firefox\extensions\{01C06508-0C57-4082-A738-6B2F9A5A59CD}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{01C06508-0C57-4082-A738-6B2F9A5A59CD}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{01C06508-0C57-4082-A738-6B2F9A5A59CD}\install.rdf
c:\program files\Mozilla Firefox\extensions\{02FF4F54-FD1C-44B1-84E3-603B1AE8DC72}
c:\program files\Mozilla Firefox\extensions\{02FF4F54-FD1C-44B1-84E3-603B1AE8DC72}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{02FF4F54-FD1C-44B1-84E3-603B1AE8DC72}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{02FF4F54-FD1C-44B1-84E3-603B1AE8DC72}\install.rdf
c:\program files\Mozilla Firefox\extensions\{0317A91C-C779-4581-83B9-AAD99BA50BA9}
c:\program files\Mozilla Firefox\extensions\{0317A91C-C779-4581-83B9-AAD99BA50BA9}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{0317A91C-C779-4581-83B9-AAD99BA50BA9}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{0317A91C-C779-4581-83B9-AAD99BA50BA9}\install.rdf
c:\program files\Mozilla Firefox\extensions\{0E4C258E-281E-4520-B75D-263F2967BA55}
c:\program files\Mozilla Firefox\extensions\{0E4C258E-281E-4520-B75D-263F2967BA55}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{0E4C258E-281E-4520-B75D-263F2967BA55}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{0E4C258E-281E-4520-B75D-263F2967BA55}\install.rdf
c:\program files\Mozilla Firefox\extensions\{0EAF2F58-4C1E-4A1E-8DD2-8B76F49B1CF6}
c:\program files\Mozilla Firefox\extensions\{0EAF2F58-4C1E-4A1E-8DD2-8B76F49B1CF6}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{0EAF2F58-4C1E-4A1E-8DD2-8B76F49B1CF6}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{0EAF2F58-4C1E-4A1E-8DD2-8B76F49B1CF6}\install.rdf
c:\program files\Mozilla Firefox\extensions\{1699CADF-FD0A-4E01-B400-8B9F8799A35A}
c:\program files\Mozilla Firefox\extensions\{1699CADF-FD0A-4E01-B400-8B9F8799A35A}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{1699CADF-FD0A-4E01-B400-8B9F8799A35A}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{1699CADF-FD0A-4E01-B400-8B9F8799A35A}\install.rdf
c:\program files\Mozilla Firefox\extensions\{199741E1-C634-43E8-AA10-F13C1C982335}
c:\program files\Mozilla Firefox\extensions\{199741E1-C634-43E8-AA10-F13C1C982335}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{199741E1-C634-43E8-AA10-F13C1C982335}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{199741E1-C634-43E8-AA10-F13C1C982335}\install.rdf
c:\program files\Mozilla Firefox\extensions\{2616CA37-8B21-47E1-AA81-BB2F902A4892}
c:\program files\Mozilla Firefox\extensions\{2616CA37-8B21-47E1-AA81-BB2F902A4892}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{2616CA37-8B21-47E1-AA81-BB2F902A4892}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{2616CA37-8B21-47E1-AA81-BB2F902A4892}\install.rdf
c:\program files\Mozilla Firefox\extensions\{442AC648-BF2F-49F6-9AC4-B0DBC63D01D8}
c:\program files\Mozilla Firefox\extensions\{442AC648-BF2F-49F6-9AC4-B0DBC63D01D8}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{442AC648-BF2F-49F6-9AC4-B0DBC63D01D8}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{442AC648-BF2F-49F6-9AC4-B0DBC63D01D8}\install.rdf
c:\program files\Mozilla Firefox\extensions\{4530B6AC-E069-4F99-8611-6121446C7AEE}
c:\program files\Mozilla Firefox\extensions\{4530B6AC-E069-4F99-8611-6121446C7AEE}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{4530B6AC-E069-4F99-8611-6121446C7AEE}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{4530B6AC-E069-4F99-8611-6121446C7AEE}\install.rdf
c:\program files\Mozilla Firefox\extensions\{492939E7-9203-4D7B-9B75-757CF91EED05}
c:\program files\Mozilla Firefox\extensions\{492939E7-9203-4D7B-9B75-757CF91EED05}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{492939E7-9203-4D7B-9B75-757CF91EED05}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{492939E7-9203-4D7B-9B75-757CF91EED05}\install.rdf
c:\program files\Mozilla Firefox\extensions\{617F406A-8430-4AB3-94A6-6F5EBC5EB7C3}
c:\program files\Mozilla Firefox\extensions\{617F406A-8430-4AB3-94A6-6F5EBC5EB7C3}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{617F406A-8430-4AB3-94A6-6F5EBC5EB7C3}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{617F406A-8430-4AB3-94A6-6F5EBC5EB7C3}\install.rdf
c:\program files\Mozilla Firefox\extensions\{61E9AA48-00AE-4808-A5F9-B72ED13AE6FE}
c:\program files\Mozilla Firefox\extensions\{61E9AA48-00AE-4808-A5F9-B72ED13AE6FE}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{61E9AA48-00AE-4808-A5F9-B72ED13AE6FE}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{61E9AA48-00AE-4808-A5F9-B72ED13AE6FE}\install.rdf
c:\program files\Mozilla Firefox\extensions\{6542FD09-F5BE-4FFE-8C76-B4FB34BC9FA6}
c:\program files\Mozilla Firefox\extensions\{6542FD09-F5BE-4FFE-8C76-B4FB34BC9FA6}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{6542FD09-F5BE-4FFE-8C76-B4FB34BC9FA6}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{6542FD09-F5BE-4FFE-8C76-B4FB34BC9FA6}\install.rdf
c:\program files\Mozilla Firefox\extensions\{709B382F-0B93-48D4-BAE9-5CCA5170DCC2}
c:\program files\Mozilla Firefox\extensions\{709B382F-0B93-48D4-BAE9-5CCA5170DCC2}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{709B382F-0B93-48D4-BAE9-5CCA5170DCC2}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{709B382F-0B93-48D4-BAE9-5CCA5170DCC2}\install.rdf
c:\program files\Mozilla Firefox\extensions\{722A931A-C51F-4DC3-AE99-456CA2051925}
c:\program files\Mozilla Firefox\extensions\{722A931A-C51F-4DC3-AE99-456CA2051925}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{722A931A-C51F-4DC3-AE99-456CA2051925}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{722A931A-C51F-4DC3-AE99-456CA2051925}\install.rdf
c:\program files\Mozilla Firefox\extensions\{74DC7346-30E0-4832-82AF-49FDD7F5AA07}
c:\program files\Mozilla Firefox\extensions\{74DC7346-30E0-4832-82AF-49FDD7F5AA07}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{74DC7346-30E0-4832-82AF-49FDD7F5AA07}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{74DC7346-30E0-4832-82AF-49FDD7F5AA07}\install.rdf
c:\program files\Mozilla Firefox\extensions\{873772F7-2E43-47C1-85E4-139A43F84170}
c:\program files\Mozilla Firefox\extensions\{873772F7-2E43-47C1-85E4-139A43F84170}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{873772F7-2E43-47C1-85E4-139A43F84170}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{873772F7-2E43-47C1-85E4-139A43F84170}\install.rdf
c:\program files\Mozilla Firefox\extensions\{87C40D07-D704-470C-9748-F103DD18BEA5}
c:\program files\Mozilla Firefox\extensions\{87C40D07-D704-470C-9748-F103DD18BEA5}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{87C40D07-D704-470C-9748-F103DD18BEA5}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{87C40D07-D704-470C-9748-F103DD18BEA5}\install.rdf
c:\program files\Mozilla Firefox\extensions\{8972C2BA-2D6E-4541-AFE6-F930DC9F7175}
c:\program files\Mozilla Firefox\extensions\{8972C2BA-2D6E-4541-AFE6-F930DC9F7175}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8972C2BA-2D6E-4541-AFE6-F930DC9F7175}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{8972C2BA-2D6E-4541-AFE6-F930DC9F7175}\install.rdf
c:\program files\Mozilla Firefox\extensions\{8B7CCFFE-86CA-456D-ABA9-5FF094F56C17}
c:\program files\Mozilla Firefox\extensions\{8B7CCFFE-86CA-456D-ABA9-5FF094F56C17}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8B7CCFFE-86CA-456D-ABA9-5FF094F56C17}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{8B7CCFFE-86CA-456D-ABA9-5FF094F56C17}\install.rdf
c:\program files\Mozilla Firefox\extensions\{920BA538-E00D-439E-B8D6-EBB288B9606F}
c:\program files\Mozilla Firefox\extensions\{920BA538-E00D-439E-B8D6-EBB288B9606F}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{920BA538-E00D-439E-B8D6-EBB288B9606F}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{920BA538-E00D-439E-B8D6-EBB288B9606F}\install.rdf
c:\program files\Mozilla Firefox\extensions\{9538F178-3B16-466C-B1EF-777E63103B41}
c:\program files\Mozilla Firefox\extensions\{9538F178-3B16-466C-B1EF-777E63103B41}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{9538F178-3B16-466C-B1EF-777E63103B41}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{9538F178-3B16-466C-B1EF-777E63103B41}\install.rdf
c:\program files\Mozilla Firefox\extensions\{9645AE60-A3F1-438A-9B0D-0F76F66C9511}
c:\program files\Mozilla Firefox\extensions\{9645AE60-A3F1-438A-9B0D-0F76F66C9511}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{9645AE60-A3F1-438A-9B0D-0F76F66C9511}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{9645AE60-A3F1-438A-9B0D-0F76F66C9511}\install.rdf
c:\program files\Mozilla Firefox\extensions\{964BFDA6-8FCA-44B7-9DF7-BD6757FFF558}
c:\program files\Mozilla Firefox\extensions\{964BFDA6-8FCA-44B7-9DF7-BD6757FFF558}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{964BFDA6-8FCA-44B7-9DF7-BD6757FFF558}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{964BFDA6-8FCA-44B7-9DF7-BD6757FFF558}\install.rdf
c:\program files\Mozilla Firefox\extensions\{99E483E4-AD71-4743-9F7F-9AFD206A4862}
c:\program files\Mozilla Firefox\extensions\{99E483E4-AD71-4743-9F7F-9AFD206A4862}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{99E483E4-AD71-4743-9F7F-9AFD206A4862}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{99E483E4-AD71-4743-9F7F-9AFD206A4862}\install.rdf
c:\program files\Mozilla Firefox\extensions\{9A44BA76-7229-4EF4-8278-ADBD4FFEB8B2}
c:\program files\Mozilla Firefox\extensions\{9A44BA76-7229-4EF4-8278-ADBD4FFEB8B2}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{9A44BA76-7229-4EF4-8278-ADBD4FFEB8B2}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{9A44BA76-7229-4EF4-8278-ADBD4FFEB8B2}\install.rdf
c:\program files\Mozilla Firefox\extensions\{9CB5361A-982E-40C2-B062-01C14B4A614D}
c:\program files\Mozilla Firefox\extensions\{9CB5361A-982E-40C2-B062-01C14B4A614D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{9CB5361A-982E-40C2-B062-01C14B4A614D}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{9CB5361A-982E-40C2-B062-01C14B4A614D}\install.rdf
c:\program files\Mozilla Firefox\extensions\{A372AF5B-DB78-4E14-B880-24930934415A}
c:\program files\Mozilla Firefox\extensions\{A372AF5B-DB78-4E14-B880-24930934415A}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{A372AF5B-DB78-4E14-B880-24930934415A}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{A372AF5B-DB78-4E14-B880-24930934415A}\install.rdf
c:\program files\Mozilla Firefox\extensions\{A4877708-C36F-417B-A7DF-6DE65211C3CB}
c:\program files\Mozilla Firefox\extensions\{A4877708-C36F-417B-A7DF-6DE65211C3CB}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{A4877708-C36F-417B-A7DF-6DE65211C3CB}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{A4877708-C36F-417B-A7DF-6DE65211C3CB}\install.rdf
c:\program files\Mozilla Firefox\extensions\{A61B8474-456C-4D55-A36A-FBB03B23A3B3}
c:\program files\Mozilla Firefox\extensions\{A61B8474-456C-4D55-A36A-FBB03B23A3B3}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{A61B8474-456C-4D55-A36A-FBB03B23A3B3}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{A61B8474-456C-4D55-A36A-FBB03B23A3B3}\install.rdf
c:\program files\Mozilla Firefox\extensions\{B6FF86AF-1A35-4252-967A-DDE1F5B2E368}
c:\program files\Mozilla Firefox\extensions\{B6FF86AF-1A35-4252-967A-DDE1F5B2E368}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{B6FF86AF-1A35-4252-967A-DDE1F5B2E368}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{B6FF86AF-1A35-4252-967A-DDE1F5B2E368}\install.rdf
c:\program files\Mozilla Firefox\extensions\{B89501EF-C474-4290-A994-334057467790}
c:\program files\Mozilla Firefox\extensions\{B89501EF-C474-4290-A994-334057467790}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{B89501EF-C474-4290-A994-334057467790}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{B89501EF-C474-4290-A994-334057467790}\install.rdf
c:\program files\Mozilla Firefox\extensions\{BCD115C6-8493-4802-80A4-1A902E50A63B}
c:\program files\Mozilla Firefox\extensions\{BCD115C6-8493-4802-80A4-1A902E50A63B}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{BCD115C6-8493-4802-80A4-1A902E50A63B}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{BCD115C6-8493-4802-80A4-1A902E50A63B}\install.rdf
c:\program files\Mozilla Firefox\extensions\{C579F7C3-2288-4432-9AB7-C319BEB20EA9}
c:\program files\Mozilla Firefox\extensions\{C579F7C3-2288-4432-9AB7-C319BEB20EA9}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{C579F7C3-2288-4432-9AB7-C319BEB20EA9}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{C579F7C3-2288-4432-9AB7-C319BEB20EA9}\install.rdf
c:\program files\Mozilla Firefox\extensions\{C7323893-177D-4BA2-8726-A4B9A8DBF535}
c:\program files\Mozilla Firefox\extensions\{C7323893-177D-4BA2-8726-A4B9A8DBF535}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{C7323893-177D-4BA2-8726-A4B9A8DBF535}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{C7323893-177D-4BA2-8726-A4B9A8DBF535}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CBCCEB08-9904-4D8C-9E70-AEB75453EDDA}
c:\program files\Mozilla Firefox\extensions\{CBCCEB08-9904-4D8C-9E70-AEB75453EDDA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CBCCEB08-9904-4D8C-9E70-AEB75453EDDA}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{CBCCEB08-9904-4D8C-9E70-AEB75453EDDA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CDCB005E-4729-4BCC-8DFF-2C12C6FB8CE6}
c:\program files\Mozilla Firefox\extensions\{CDCB005E-4729-4BCC-8DFF-2C12C6FB8CE6}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CDCB005E-4729-4BCC-8DFF-2C12C6FB8CE6}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{CDCB005E-4729-4BCC-8DFF-2C12C6FB8CE6}\install.rdf
c:\program files\Mozilla Firefox\extensions\{DC993398-01C8-464D-AF8D-47CDE7DDEE11}
c:\program files\Mozilla Firefox\extensions\{DC993398-01C8-464D-AF8D-47CDE7DDEE11}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{DC993398-01C8-464D-AF8D-47CDE7DDEE11}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{DC993398-01C8-464D-AF8D-47CDE7DDEE11}\install.rdf
c:\program files\Mozilla Firefox\extensions\{E3D3C967-77CF-4857-A104-0C5168045EC8}
c:\program files\Mozilla Firefox\extensions\{E3D3C967-77CF-4857-A104-0C5168045EC8}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{E3D3C967-77CF-4857-A104-0C5168045EC8}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{E3D3C967-77CF-4857-A104-0C5168045EC8}\install.rdf
c:\program files\Mozilla Firefox\extensions\{E8FC9FCE-B152-481B-816C-794628625FEC}
c:\program files\Mozilla Firefox\extensions\{E8FC9FCE-B152-481B-816C-794628625FEC}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{E8FC9FCE-B152-481B-816C-794628625FEC}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{E8FC9FCE-B152-481B-816C-794628625FEC}\install.rdf
c:\program files\Mozilla Firefox\extensions\{EEFC096A-6E90-48A7-A322-2ABBB47FF89C}
c:\program files\Mozilla Firefox\extensions\{EEFC096A-6E90-48A7-A322-2ABBB47FF89C}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{EEFC096A-6E90-48A7-A322-2ABBB47FF89C}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{EEFC096A-6E90-48A7-A322-2ABBB47FF89C}\install.rdf
c:\program files\Mozilla Firefox\extensions\{F0A004A0-BF6F-44BD-9979-5935A9F954BE}
c:\program files\Mozilla Firefox\extensions\{F0A004A0-BF6F-44BD-9979-5935A9F954BE}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{F0A004A0-BF6F-44BD-9979-5935A9F954BE}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{F0A004A0-BF6F-44BD-9979-5935A9F954BE}\install.rdf
c:\windows\system32\4232985852.dat
c:\windows\system32\RFHelper.dll
c:\windows\system32\Vbshell.tlb

.
((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\documents and settings\Sara Byron\Local Settings\Application Data\Innovative Solutions
2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\program files\Common Files\Innovative Solutions
2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Innovative Solutions
2010-02-23 18:19 . 2010-02-23 18:19 ——– d—–w- c:\program files\ERUNT
2010-02-15 22:31 . 2010-02-15 22:32 ——– dc-h–w- c:\windows\ie8
2010-02-15 22:07 . 2010-02-15 22:07 ——– d—–w- c:\program files\Microsoft Silverlight
2010-02-15 05:00 . 2010-02-15 05:00 ——– d—–w- c:\documents and settings\HelpAssistant\System
2010-02-14 17:19 . 2010-02-14 17:19 ——– d—–w- c:\documents and settings\HelpAssistant\.limewire
2010-02-14 05:19 . 2010-02-14 05:19 ——– d—–w- c:\documents and settings\HelpAssistant\WINDOWS
2010-02-13 15:39 . 2010-02-15 05:00 ——– d—–w- c:\documents and settings\HelpAssistant\UserData
2010-02-13 15:39 . 2010-02-13 15:39 ——– d—–w- c:\documents and settings\HelpAssistant\PrivacIE
2010-02-13 15:38 . 2010-02-13 15:38 ——– d—–w- c:\documents and settings\HelpAssistant\IECompatCache
2010-02-13 15:38 . 2010-02-13 15:38 ——– d—–w- c:\documents and settings\HelpAssistant\IDIS
2010-02-03 15:24 . 2010-02-03 15:26 ——– d—–w- c:\program files\iTunes
2010-02-03 14:27 . 2010-02-03 14:27 72488 ——w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-03 14:16 . 2010-02-03 14:16 79144 ——w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-28 15:59 . 2008-11-06 17:56 ——– d—–w- c:\program files\Windows Media Connect 2
2010-02-28 15:59 . 2004-08-12 00:01 ——– d—–w- c:\program files\Sierra On-Line
2010-02-28 15:59 . 2009-09-20 19:34 ——– d—–w- c:\program files\QuickTime
2010-02-27 00:58 . 2009-11-08 20:54 ——– d—–w- c:\program files\Palm-old
2010-02-27 00:58 . 2009-03-03 19:39 ——– d—–w- c:\program files\Palm
2010-02-27 00:58 . 2008-11-06 15:32 ——– d—–w- c:\program files\OverDrive Media Console
2010-02-27 00:57 . 2004-03-29 21:58 ——– d—–w- c:\program files\Modem Helper
2010-02-27 00:57 . 2005-11-01 21:34 ——– d—–w- c:\program files\Family Tree Maker 2005
2010-02-26 15:40 . 2009-11-25 22:52 79488 —-a-w- c:\documents and settings\Sara Byron\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-25 22:23 . 2009-04-29 15:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-25 21:26 . 2006-10-05 03:23 128728 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-02-25 17:11 . 2004-03-29 22:04 288 —-a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2010-02-25 17:11 . 2004-03-29 22:04 288 —-a-w- c:\windows\system32\DVCState-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2010-02-25 16:50 . 2007-09-17 02:48 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-25 16:37 . 2006-03-15 00:31 ——– d—–w- c:\program files\Electronic Arts
2010-02-25 16:36 . 2004-08-22 19:44 ——– d—–w- c:\program files\Common Files\Adobe
2010-02-25 16:31 . 2009-04-28 18:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-25 16:31 . 2004-10-24 02:21 ——– d—–w- c:\program files\Lavasoft
2010-02-25 16:29 . 2004-10-27 12:55 ——– d—–w- c:\program files\Innovative Solutions
2010-02-19 00:29 . 2004-10-02 20:51 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Aim
2010-02-19 00:11 . 2006-10-20 18:10 ——– d—–w- c:\program files\McAfee
2010-02-15 14:38 . 2009-11-26 14:53 79488 ——w- c:\documents and settings\Robert Jeffers\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-15 05:38 . 2007-09-17 02:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-15 04:25 . 2008-03-19 21:15 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-14 06:55 . 2009-11-25 22:45 79488 ——w- c:\documents and settings\Madeleine Jeffers\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-12 21:52 . 2005-09-13 02:57 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Canon
2010-02-03 15:25 . 2006-07-01 13:37 ——– d—–w- c:\program files\iPod
2010-02-03 15:25 . 2007-07-31 14:46 ——– d—–w- c:\program files\Common Files\Apple
2010-02-03 14:22 . 2008-08-06 14:04 ——– d—–w- c:\program files\Safari
2010-01-25 04:15 . 2010-01-25 04:15 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Office Genuine Advantage
2010-01-07 22:07 . 2009-04-29 15:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 22:07 . 2009-04-29 15:55 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2002-08-29 11:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-24 01:32 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2009-02-22 14:50 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2002-08-29 11:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 1980-01-01 06:00 2145280 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 1980-01-01 06:00 2023936 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2002-08-29 11:00 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-04 14:01 . 2004-07-25 14:38 130624 ——w- c:\documents and settings\Robert Jeffers\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2003-08-27 20:19 . 2004-12-24 04:53 36963 -c–a-r- c:\program files\Common Files\SM1updtr.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WebDriveTray"="c:\program files\NetDrive\netdrive.exe" [2003-04-14 294912]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"pdfFactory Dispatcher v2"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" [2005-09-06 487424]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

c:\documents and settings\Sara Byron\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2008-1-3 1392640]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2009-3-8 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-21 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"c:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\HP1006MC.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\SYSTEM32\\WBEM\\UNSECAPP.EXE"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"3246:TCP"= 3246:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"1742:TCP"= 1742:TCP:Services
"8708:TCP"= 8708:TCP:Services
"3866:TCP"= 3866:TCP:Services
"4024:TCP"= 4024:TCP:Services
"3132:TCP"= 3132:TCP:Services

R0 MDPMGRNT;MDPMGRNT;c:\windows\SYSTEM32\DRIVERS\MDPMGRNT.SYS [7/20/2005 4:35 PM 24320]
R0 szkg5;szkg;c:\windows\SYSTEM32\DRIVERS\SZKG.sys [10/8/2008 1:27 PM 49664]
R1 MDFSYSNT;MDFSYSNT;c:\windows\SYSTEM32\DRIVERS\MDFSYSNT.SYS [9/13/2006 12:53 PM 213888]
R2 DVDAccss;DVDAccss;c:\windows\SYSTEM32\DRIVERS\DVDAccss.sys [12/3/2008 3:39 PM 29156]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/10/2008 1:18 PM 24652]
R2 WebDriveFSD;WebDrive File System Driver;c:\program files\NetDrive\rffsd.sys [9/23/2005 5:20 AM 67032]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys –> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S3 lac97inf;lac97inf;\??\c:\docume~1\SARABY~1\LOCALS~1\Temp\lac97inf.sys –> c:\docume~1\SARABY~1\LOCALS~1\Temp\lac97inf.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
S4 RFNP32;WebDrive Provider; [x]
.
Contents of the 'Scheduled Tasks' folder

2010-02-16 c:\windows\Tasks\Backup.job
- c:\windows\SYSTEM32\ntbackup.exe [2009-02-22 00:12]

2010-03-01 c:\windows\Tasks\User_Feed_Synchronization-{C1000964-AA95-4E84-990A-2DFD6562E161}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:31]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://member.square-enix.com/na/
mSearch Bar =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
FF - ProfilePath - c:\documents and settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.ravelry.com/account/login|https://webauth.att.net/auth/webmail/login?action=Login&url=http%3A%2F%2Fwebmail.att.net%2Fwmc%2Fv%2Fwm%2F49B4A62800082B1E00002C2F2223070362%2F%3Fcmd%3DList%26sid%3Dc0|http://www.voy.com/33031/|http://central.hinsdale86.org/Daily%20Announcements/Forms/AllItems.aspx|http://mail.google.com/mail/?source=navclient-ff&zx=1w0tkde3j7rys&shva=1#inbox|http://www.facebook.com/login.php?v=1.0&api_key=e004be66908863e93f45ec5853daecba&next=%3Faction%3Dseal%26id%3D856664843%26skip%3D856664843&canvas|http://www.atlasquest.com/people/profile.html|http://www.hcbands.org/|http://www.fiberfarm.com/blog
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\documents and settings\Madeleine Jeffers\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\Sara Byron\Application Data\Mozilla\plugins\npPxPlay.dll
FF - plugin: c:\progra~1\Palm\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npImgCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 19:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x894FB5B8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74a0852
\Driver\iaStor -> 0x894fb5b8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x88d0d330
PacketIndicateHandler -> NDIS.sys @ 0xf788ca21
SendHandler -> NDIS.sys @ 0xf786a87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1117699391-305849530-2431133585-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:00,1f,6d,2a,7d,04,89,b0,89,2e,46,94,1d,9d,62,2c,73,d8,56,bf,a5,20,94,
c0,1a,48,61,33,a6,37,16,2d,47,8e,88,83,08,22,01,85,4a,b2,54,64,a5,4e,98,d4,\
"??"=hex:5c,f1,83,89,34,2e,c3,29,75,49,0f,ac,fc,c3,b8,aa

[HKEY_USERS\S-1-5-21-1117699391-305849530-2431133585-1008\Software\SecuROM\License information*]
"datasecu"=hex:a0,c8,a9,21,97,e1,5e,28,08,d0,73,37,5b,c9,5b,88,32,c4,d6,cb,f5,
10,12,ba,99,3e,c2,0f,8e,38,d7,b4,68,17,9d,74,cd,9a,8b,ab,f5,d6,36,07,01,a4,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(768)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(824)
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
.
Completion time: 2010-03-01 20:00:30
ComboFix-quarantined-files.txt 2010-03-02 02:00
ComboFix2.txt 2009-05-06 14:01

Pre-Run: 32,767,672,320 bytes free
Post-Run: 32,766,693,376 bytes free

- - End Of File - - 92972FAE3EBE2C10A7041AA3C03A6F39

CatByte

Post #4March 2, 2010, 2:23 AM UTC

Hi

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Slooowww_computer_keeps_freezing_can_t_get_cleaned_up_t110629.html&view=findpost&p=637594#entry637594

Collect::
c:\docume~1\SARABY~1\LOCALS~1\Temp\lac97inf.sys

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"=- 
"52344:TCP"=- 
"2479:TCP"=- 
"3246:TCP"=- 
"3389:TCP"=-
"1742:TCP"=- 
"8708:TCP"=-
"3866:TCP"=-
"4024:TCP"=-
"3132:TCP"=-

Driver::
lac97inf

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

NEXT

Go to Start > Run > type in Cmd > OK

a command window will open

copy/paste the following text inside the quote box into the command window:

net user HelpAssistant>%temp%\temp0
start notepad %temp%\temp0
exit
cls

a Notepad will pop open

please post the contents of the notepad in your next reply

Patrick's Mom

Post #5March 2, 2010, 4:16 AM UTC

Thanks gain for your help - and that's a really cute Cat picture!

But this process is really stressful!

OK - Here is the Combofix log:

ComboFix 10-03-01.01 - Sara Byron 03/01/2010 21:19:38.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1506 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Sara Byron\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_LAC97INF
——-\Service_lac97inf

((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\documents and settings\Sara Byron\Local Settings\Application Data\Innovative Solutions
2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\program files\Common Files\Innovative Solutions
2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Innovative Solutions
2010-02-23 18:19 . 2010-02-23 18:19 ——– d—–w- c:\program files\ERUNT
2010-02-15 22:31 . 2010-02-15 22:32 ——– dc-h–w- c:\windows\ie8
2010-02-15 22:07 . 2010-02-15 22:07 ——– d—–w- c:\program files\Microsoft Silverlight
2010-02-15 05:00 . 2010-02-15 05:00 ——– d—–w- c:\documents and settings\HelpAssistant\System
2010-02-14 17:19 . 2010-02-14 17:19 ——– d—–w- c:\documents and settings\HelpAssistant\.limewire
2010-02-14 05:19 . 2010-02-14 05:19 ——– d—–w- c:\documents and settings\HelpAssistant\WINDOWS
2010-02-13 15:39 . 2010-02-15 05:00 ——– d—–w- c:\documents and settings\HelpAssistant\UserData
2010-02-13 15:39 . 2010-02-13 15:39 ——– d—–w- c:\documents and settings\HelpAssistant\PrivacIE
2010-02-13 15:38 . 2010-02-13 15:38 ——– d—–w- c:\documents and settings\HelpAssistant\IECompatCache
2010-02-13 15:38 . 2010-02-13 15:38 ——– d—–w- c:\documents and settings\HelpAssistant\IDIS
2010-02-03 15:24 . 2010-02-03 15:26 ——– d—–w- c:\program files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-02 03:26 . 2004-03-29 22:04 288 —-a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2010-03-02 03:26 . 2004-03-29 22:04 288 —-a-w- c:\windows\system32\DVCState-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2010-02-28 15:59 . 2008-11-06 17:56 ——– d—–w- c:\program files\Windows Media Connect 2
2010-02-28 15:59 . 2004-08-12 00:01 ——– d—–w- c:\program files\Sierra On-Line
2010-02-28 15:59 . 2009-09-20 19:34 ——– d—–w- c:\program files\QuickTime
2010-02-27 00:58 . 2009-11-08 20:54 ——– d—–w- c:\program files\Palm-old
2010-02-27 00:58 . 2009-03-03 19:39 ——– d—–w- c:\program files\Palm
2010-02-27 00:58 . 2008-11-06 15:32 ——– d—–w- c:\program files\OverDrive Media Console
2010-02-27 00:57 . 2004-03-29 21:58 ——– d—–w- c:\program files\Modem Helper
2010-02-27 00:57 . 2005-11-01 21:34 ——– d—–w- c:\program files\Family Tree Maker 2005
2010-02-25 22:23 . 2009-04-29 15:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-25 21:26 . 2006-10-05 03:23 128728 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-02-25 16:50 . 2007-09-17 02:48 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-25 16:37 . 2006-03-15 00:31 ——– d—–w- c:\program files\Electronic Arts
2010-02-25 16:36 . 2004-08-22 19:44 ——– d—–w- c:\program files\Common Files\Adobe
2010-02-25 16:31 . 2009-04-28 18:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-25 16:31 . 2004-10-24 02:21 ——– d—–w- c:\program files\Lavasoft
2010-02-25 16:29 . 2004-10-27 12:55 ——– d—–w- c:\program files\Innovative Solutions
2010-02-19 00:29 . 2004-10-02 20:51 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Aim
2010-02-19 00:11 . 2006-10-20 18:10 ——– d—–w- c:\program files\McAfee
2010-02-15 05:38 . 2007-09-17 02:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-15 04:25 . 2008-03-19 21:15 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-12 21:52 . 2005-09-13 02:57 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Canon
2010-02-03 15:25 . 2006-07-01 13:37 ——– d—–w- c:\program files\iPod
2010-02-03 15:25 . 2007-07-31 14:46 ——– d—–w- c:\program files\Common Files\Apple
2010-02-03 14:22 . 2008-08-06 14:04 ——– d—–w- c:\program files\Safari
2010-01-25 04:15 . 2010-01-25 04:15 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Office Genuine Advantage
2010-01-07 22:07 . 2009-04-29 15:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 22:07 . 2009-04-29 15:55 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2002-08-29 11:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-24 01:32 916480 ——w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2009-02-22 14:50 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2002-08-29 11:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 1980-01-01 06:00 2145280 ——w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 1980-01-01 06:00 2023936 ——w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2002-08-29 11:00 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-04 14:01 . 2004-07-25 14:38 130624 ——w- c:\documents and settings\Robert Jeffers\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2003-08-27 20:19 . 2004-12-24 04:53 36963 -c–a-r- c:\program files\Common Files\SM1updtr.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WebDriveTray"="c:\program files\NetDrive\netdrive.exe" [2003-04-14 294912]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"pdfFactory Dispatcher v2"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" [2005-09-06 487424]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

c:\documents and settings\Sara Byron\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2008-1-3 1392640]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2009-3-8 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-21 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"c:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\HP1006MC.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\SYSTEM32\\WBEM\\UNSECAPP.EXE"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"9272:TCP"= 9272:TCP:Services

R0 MDPMGRNT;MDPMGRNT;c:\windows\SYSTEM32\DRIVERS\MDPMGRNT.SYS [7/20/2005 4:35 PM 24320]
R0 szkg5;szkg;c:\windows\SYSTEM32\DRIVERS\SZKG.sys [10/8/2008 1:27 PM 49664]
R1 MDFSYSNT;MDFSYSNT;c:\windows\SYSTEM32\DRIVERS\MDFSYSNT.SYS [9/13/2006 12:53 PM 213888]
R2 DVDAccss;DVDAccss;c:\windows\SYSTEM32\DRIVERS\DVDAccss.sys [12/3/2008 3:39 PM 29156]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/10/2008 1:18 PM 24652]
R2 WebDriveFSD;WebDrive File System Driver;c:\program files\NetDrive\rffsd.sys [9/23/2005 5:20 AM 67032]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys –> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
S4 RFNP32;WebDrive Provider; [x]
.
Contents of the 'Scheduled Tasks' folder

2010-02-16 c:\windows\Tasks\Backup.job
- c:\windows\SYSTEM32\ntbackup.exe [2009-02-22 00:12]

2010-03-01 c:\windows\Tasks\User_Feed_Synchronization-{C1000964-AA95-4E84-990A-2DFD6562E161}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:31]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://member.square-enix.com/na/
mSearch Bar =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
FF - ProfilePath - c:\documents and settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.ravelry.com/account/login|https://webauth.att.net/auth/webmail/login?action=Login&url=http%3A%2F%2Fwebmail.att.net%2Fwmc%2Fv%2Fwm%2F49B4A62800082B1E00002C2F2223070362%2F%3Fcmd%3DList%26sid%3Dc0|http://www.voy.com/33031/|http://central.hinsdale86.org/Daily%20Announcements/Forms/AllItems.aspx|http://mail.google.com/mail/?source=navclient-ff&zx=1w0tkde3j7rys&shva=1#inbox|http://www.facebook.com/login.php?v=1.0&api_key=e004be66908863e93f45ec5853daecba&next=%3Faction%3Dseal%26id%3D856664843%26skip%3D856664843&canvas|http://www.atlasquest.com/people/profile.html|http://www.hcbands.org/|http://www.fiberfarm.com/blog
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\documents and settings\Madeleine Jeffers\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\Sara Byron\Application Data\Mozilla\plugins\npPxPlay.dll
FF - plugin: c:\progra~1\Palm\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npImgCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 21:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1117699391-305849530-2431133585-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:00,1f,6d,2a,7d,04,89,b0,89,2e,46,94,1d,9d,62,2c,73,d8,56,bf,a5,20,94,
c0,1a,48,61,33,a6,37,16,2d,47,8e,88,83,08,22,01,85,4a,b2,54,64,a5,4e,98,d4,\
"??"=hex:5c,f1,83,89,34,2e,c3,29,75,49,0f,ac,fc,c3,b8,aa

[HKEY_USERS\S-1-5-21-1117699391-305849530-2431133585-1008\Software\SecuROM\License information*]
"datasecu"=hex:a0,c8,a9,21,97,e1,5e,28,08,d0,73,37,5b,c9,5b,88,32,c4,d6,cb,f5,
10,12,ba,99,3e,c2,0f,8e,38,d7,b4,68,17,9d,74,cd,9a,8b,ab,f5,d6,36,07,01,a4,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(764)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(820)
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll

- - - - - - - > 'explorer.exe'(2680)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Mediafour\XPlay\XPFPROT.DLL
c:\program files\Mediafour\XPlay\1033\XPFPROT.DL_
c:\program files\Mediafour\XPlay\XPDEVICE.DLL
c:\windows\system32\MACDRAPI.DLL
c:\program files\Mediafour\XPlay\1033\XPDEVICE.DL_
c:\program files\Mediafour\XPlay\XPIPOD.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\CTsvcCDA.exe
c:\program files\Intel\Intel Application Accelerator\iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
c:\windows\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
c:\program files\Photodex\ProShowGold\ScsiAccess.exe
c:\windows\system32\UAService7.exe
c:\windows\System32\MsPMSPSv.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\program files\McAfee\MPF\MPFSrv.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
.
**************************************************************************
.
Completion time: 2010-03-01 21:47:50 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-02 03:47
ComboFix2.txt 2010-03-02 02:00
ComboFix3.txt 2009-05-06 14:01

Pre-Run: 32,763,305,984 bytes free
Post-Run: 32,644,710,400 bytes free

- - End Of File - - A20E7392E3CEBC2AA15EEB47C0F1E8EE

Note: I was unable to paste into the cmd window - so I hope I re-typed that script correctly. Here is the result:

User name HelpAssistant
Full Name Remote Desktop Help Assistant Account
Comment Account for Providing Remote Assistance
User's comment
Country code 000 (System Default)
Account active Yes
Account expires Never

Password last set 3/1/2010 9:33 PM
Password expires Never
Password changeable 3/1/2010 9:33 PM
Password required Yes
User may change password Yes

Workstations allowed All
Logon script
User profile
Home directory
Last logon 3/1/2010 9:33 PM

Logon hours allowed All

Local Group Memberships *Administrators
Global Group memberships *None
The command completed successfully.

What's next? Although, I am coming down with a real virus, and I think I'm going to bed now. I'll recheck this in the morning. Thank you very very much!

CatByte

Post #6March 2, 2010, 4:25 AM UTC

Hi,

Please do the following:

Download and save HelpAsst_mebroot_fix.exe
Double click to run the tool.

when it has completed, please do the following:
Go to Start > run > copy/paste the command inside the quote box into the run box

mbr -f

> press OK

a small black box will flash on the screen this is normal

Now reboot.
Go to Start > run > copy/paste the command inside the quote box into the run box

mbr -t

> press OK

Please post the resulting logs

Patrick's Mom

Post #7March 2, 2010, 6:04 PM UTC

I followed your last instructions last night. However, a Notepad did appear, but did not give me time to save the log anywhere. If you know where it might have automatically saved the log, tell me and I will post it. As soon as that last command finished, the PC froze and since I had to reboot, I went to bed. I do not want to re-do your last instructions until told to do so. PC froze two times while I have been trying to write this post. New error message upon start up: Netdrive.exe will not install because RFHelper.dll was not found, or something close to that. What's next? TIA

CatByte

Post #8March 2, 2010, 6:11 PM UTC

does the PC boot up normally?

CatByte

Post #9March 2, 2010, 6:12 PM UTC

go to Start > run type in mbr.log see if a notepad opens up

Patrick's Mom

Post #10March 2, 2010, 6:42 PM UTC

OK - after 2 more re-boots, I got it to come up:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A491468]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\iaStor -> 0x8a491468
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x893fc330
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

CatByte

Post #11March 2, 2010, 6:52 PM UTC

Hi,

this is a very difficult stubborn infection to clean, so let's give it another try:

Please delete the copy of HelpAsst_mebroot_fix.exe that you have on your desktop and down load a fresh copy from this link

http://noahdfear.net/downloads/HelpAsst_mebroot_fix.exe

double click on it to run the tool:

now

Go to Start > run > copy/paste the command inside the quote box into the run box

mbr -f

> press OK

reboot and do that a second time.

reboot again then go to Start > run type in mbr.log > post the contents of the log

if that doesn't work we will need to go to the Recovery Console to fix the MBR

Patrick's Mom

Post #12March 2, 2010, 8:23 PM UTC

OK all done and here is the new mbr.log

Looks like there is still a problem tho

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\iaStor -> 0x8964bd98
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x894ab330
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

CatByte

Post #13March 2, 2010, 8:24 PM UTC

Please do the following:

Download TDSSKiller and save it to your Desktop.

Extract the file and run it.

Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)

please post the content of that log TDSSKiller

Patrick's Mom

Post #14March 2, 2010, 9:50 PM UTC

OK - Had to get kids from school. This was quick. 15:46:37:015 3108 TDSS rootkit removing tool [removed] Feb 27 2010 13:29:25 15:46:37:015 3108 ================================================================================ 15:46:37:015 3108 SystemInfo: 15:46:37:015 3108 OS Version: 5.1.2600 ServicePack: 3.0 15:46:37:015 3108 Product type: Workstation 15:46:37:015 3108 ComputerName: FAMILYDELL 15:46:37:015 3108 UserName: Sara Byron 15:46:37:015 3108 Windows directory: C:\WINDOWS 15:46:37:015 3108 Processor architecture: Intel x86 15:46:37:015 3108 Number of processors: 2 15:46:37:015 3108 Page size: 0x1000 15:46:37:031 3108 Boot type: Normal boot 15:46:37:031 3108 ================================================================================ 15:46:37:031 3108 UnloadDriverW: NtUnloadDriver error 2 15:46:37:031 3108 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2 15:46:37:421 3108 Initialize success 15:46:37:421 3108 15:46:37:421 3108 Scanning Services … 15:46:37:421 3108 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 15:46:37:421 3108 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 15:46:37:421 3108 wfopen_ex: Trying to KLMD file open 15:46:37:421 3108 wfopen_ex: File opened ok (Flags 2) 15:46:37:421 3108 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 15:46:37:421 3108 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 15:46:37:421 3108 wfopen_ex: Trying to KLMD file open 15:46:37:421 3108 wfopen_ex: File opened ok (Flags 2) 15:46:40:921 3108 GetAdvancedServicesInfo: Raw services enum returned 421 services 15:46:40:937 3108 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 15:46:40:937 3108 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 15:46:40:937 3108 15:46:40:937 3108 Scanning Kernel memory … 15:46:40:937 3108 Devices to scan: 3 15:46:40:937 3108 15:46:40:937 3108 Driver Name: Disk 15:46:40:937 3108 IRP_MJ_CREATE : F763DBB0 15:46:40:937 3108 IRP_MJ_CREATE_NAMED_PIPE : 804F9759 15:46:40:937 3108 IRP_MJ_CLOSE : F763DBB0 15:46:40:937 3108 IRP_MJ_READ : F7637D1F 15:46:40:937 3108 IRP_MJ_WRITE : F7637D1F 15:46:40:937 3108 IRP_MJ_QUERY_INFORMATION : 804F9759 15:46:40:937 3108 IRP_MJ_SET_INFORMATION : 804F9759 15:46:40:937 3108 IRP_MJ_QUERY_EA : 804F9759 15:46:40:937 3108 IRP_MJ_SET_EA : 804F9759 15:46:40:937 3108 IRP_MJ_FLUSH_BUFFERS : F76382E2 15:46:40:937 3108 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9759 15:46:40:937 3108 IRP_MJ_SET_VOLUME_INFORMATION : 804F9759 15:46:40:937 3108 IRP_MJ_DIRECTORY_CONTROL : 804F9759 15:46:40:937 3108 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9759 15:46:40:937 3108 IRP_MJ_DEVICE_CONTROL : F76383BB 15:46:40:937 3108 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28 15:46:40:937 3108 IRP_MJ_SHUTDOWN : F76382E2 15:46:40:937 3108 IRP_MJ_LOCK_CONTROL : 804F9759 15:46:40:937 3108 IRP_MJ_CLEANUP : 804F9759 15:46:40:937 3108 IRP_MJ_CREATE_MAILSLOT : 804F9759 15:46:40:937 3108 IRP_MJ_QUERY_SECURITY : 804F9759 15:46:40:937 3108 IRP_MJ_SET_SECURITY : 804F9759 15:46:40:937 3108 IRP_MJ_POWER : F7639C82 15:46:40:937 3108 IRP_MJ_SYSTEM_CONTROL : F763E99E 15:46:40:937 3108 IRP_MJ_DEVICE_CHANGE : 804F9759 15:46:40:937 3108 IRP_MJ_QUERY_QUOTA : 804F9759 15:46:40:937 3108 IRP_MJ_SET_QUOTA : 804F9759 15:46:40:937 3108 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code 15:46:40:937 3108 sion 15:46:40:968 3108 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 15:46:40:968 3108 15:46:40:968 3108 Driver Name: Disk 15:46:40:968 3108 IRP_MJ_CREATE : F763DBB0 15:46:40:968 3108 IRP_MJ_CREATE_NAMED_PIPE : 804F9759 15:46:40:968 3108 IRP_MJ_CLOSE : F763DBB0 15:46:40:968 3108 IRP_MJ_READ : F7637D1F 15:46:40:968 3108 IRP_MJ_WRITE : F7637D1F 15:46:40:968 3108 IRP_MJ_QUERY_INFORMATION : 804F9759 15:46:40:968 3108 IRP_MJ_SET_INFORMATION : 804F9759 15:46:40:968 3108 IRP_MJ_QUERY_EA : 804F9759 15:46:40:968 3108 IRP_MJ_SET_EA : 804F9759 15:46:40:968 3108 IRP_MJ_FLUSH_BUFFERS : F76382E2 15:46:40:968 3108 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9759 15:46:40:968 3108 IRP_MJ_SET_VOLUME_INFORMATION : 804F9759 15:46:40:968 3108 IRP_MJ_DIRECTORY_CONTROL : 804F9759 15:46:40:968 3108 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9759 15:46:40:968 3108 IRP_MJ_DEVICE_CONTROL : F76383BB 15:46:40:968 3108 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28 15:46:40:968 3108 IRP_MJ_SHUTDOWN : F76382E2 15:46:40:968 3108 IRP_MJ_LOCK_CONTROL : 804F9759 15:46:40:968 3108 IRP_MJ_CLEANUP : 804F9759 15:46:40:968 3108 IRP_MJ_CREATE_MAILSLOT : 804F9759 15:46:40:984 3108 IRP_MJ_QUERY_SECURITY : 804F9759 15:46:40:984 3108 IRP_MJ_SET_SECURITY : 804F9759 15:46:40:984 3108 IRP_MJ_POWER : F7639C82 15:46:40:984 3108 IRP_MJ_SYSTEM_CONTROL : F763E99E 15:46:40:984 3108 IRP_MJ_DEVICE_CHANGE : 804F9759 15:46:40:984 3108 IRP_MJ_QUERY_QUOTA : 804F9759 15:46:40:984 3108 IRP_MJ_SET_QUOTA : 804F9759 15:46:41:015 3108 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code 15:46:41:015 3108 sion 15:46:41:062 3108 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 15:46:41:062 3108 15:46:41:062 3108 Driver Name: iaStor 15:46:41:062 3108 IRP_MJ_CREATE : F7464624 15:46:41:062 3108 IRP_MJ_CREATE_NAMED_PIPE : 804F9759 15:46:41:062 3108 IRP_MJ_CLOSE : F7464624 15:46:41:062 3108 IRP_MJ_READ : 804F9759 15:46:41:062 3108 IRP_MJ_WRITE : 804F9759 15:46:41:062 3108 IRP_MJ_QUERY_INFORMATION : 804F9759 15:46:41:062 3108 IRP_MJ_SET_INFORMATION : 804F9759 15:46:41:062 3108 IRP_MJ_QUERY_EA : 804F9759 15:46:41:062 3108 IRP_MJ_SET_EA : 804F9759 15:46:41:062 3108 IRP_MJ_FLUSH_BUFFERS : 804F9759 15:46:41:062 3108 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9759 15:46:41:062 3108 IRP_MJ_SET_VOLUME_INFORMATION : 804F9759 15:46:41:062 3108 IRP_MJ_DIRECTORY_CONTROL : 804F9759 15:46:41:062 3108 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9759 15:46:41:062 3108 IRP_MJ_DEVICE_CONTROL : F7466036 15:46:41:062 3108 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8A74D3D8 15:46:41:062 3108 IRP_MJ_SHUTDOWN : 804F9759 15:46:41:062 3108 IRP_MJ_LOCK_CONTROL : 804F9759 15:46:41:062 3108 IRP_MJ_CLEANUP : 804F9759 15:46:41:062 3108 IRP_MJ_CREATE_MAILSLOT : 804F9759 15:46:41:062 3108 IRP_MJ_QUERY_SECURITY : 804F9759 15:46:41:062 3108 IRP_MJ_SET_SECURITY : 804F9759 15:46:41:062 3108 IRP_MJ_POWER : F7468FE0 15:46:41:062 3108 IRP_MJ_SYSTEM_CONTROL : F746906C 15:46:41:062 3108 IRP_MJ_DEVICE_CHANGE : 804F9759 15:46:41:062 3108 IRP_MJ_QUERY_QUOTA : 804F9759 15:46:41:062 3108 IRP_MJ_SET_QUOTA : 804F9759 15:46:41:062 3108 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code 15:46:41:062 3108 sion 15:46:41:140 3108 C:\WINDOWS\system32\drivers\iaStor.sys - Verdict: Clean 15:46:41:140 3108 15:46:41:156 3108 Completed 15:46:41:156 3108 15:46:41:156 3108 Results: 15:46:41:156 3108 Memory objects infected / cured / cured on reboot: 0 / 0 / 0 15:46:41:156 3108 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 15:46:41:156 3108 File objects infected / cured / cured on reboot: 0 / 0 / 0 15:46:41:156 3108 15:46:41:156 3108 KLMD(ARK) unloaded successfully

CatByte

Post #15March 2, 2010, 9:55 PM UTC

Hi,

Please run the batch again:

Go to Start > Run > type in Cmd > OK

a command window will open

copy/paste the following text inside the quote box into the command window:

net user HelpAssistant>%temp%\temp0
start notepad %temp%\temp0
exit
cls

a Notepad will pop open

please post the contents of the notepad in your next reply

Please advise how your computer is running and any outstanding issues

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Slooowww computer, keeps freezing - can't get it cleane

✨ Ask AI

Ask AI