Spyware / Malware / Virus Removal

[Resolved] Please Help! Virus that pegs the CPU at 100% and keeps

20 min read

Looking for the outcome? Ask AI

3streamMusic

Post #31March 13, 2010, 11:40 PM UTC

OK - then I did let my subscription for SpyDoctor expire

LDTate

Post #32March 14, 2010, 2:03 PM UTC

OK. Run a new Combofix and we'll get rid of what you're not using any longer.

3streamMusic

Post #33March 17, 2010, 2:54 AM UTC

ComboFix 10-03-16.03 - Matt Montoro 03/16/2010 21:38:05.8.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1279.727 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\Matt Montoro\Local Settings\Application Data\sysappdg\sysappdg.dll
c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\monnwb32.exe
c:\windows\ejonuresiqaquz.dll
c:\windows\system32\config\systemprofile\oashdihasidhasuidhiasdhiashdiuasdhasd

Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\cdrom.sys

.
((((((((((((((((((((((((( Files Created from 2010-02-17 to 2010-03-17 )))))))))))))))))))))))))))))))
.

2010-03-16 19:20 . 2010-03-16 19:20 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\sysappdg
2010-03-16 19:20 . 2010-03-17 01:21 203264 –sha-w- c:\documents and settings\LocalService\Local Settings\Application Data\ave.exe
2010-03-16 18:49 . 2010-03-17 01:54 ——– d—–w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\sysappdg
2010-03-16 18:49 . 2010-03-16 18:49 ——– d—–w- C:\9acb3b6a78c737d603facb
2010-03-16 16:45 . 2010-03-16 16:45 ——– d—–w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}
2010-03-16 16:41 . 2010-03-16 16:41 116 —-a-w- c:\windows\system32\fjhdyfhsn.bat
2010-03-16 16:41 . 2010-03-16 16:41 51807 —-a-w- c:\windows\system32\config\systemprofile\wuaucldt.exe
2010-03-11 16:30 . 2010-03-11 16:29 389120 —-a-w- c:\windows\system32\CF5989.exe
2010-03-10 19:53 . 2009-10-23 15:28 3558912 —-a-w- c:\windows\system32\dllcache\moviemk.exe
2010-03-10 19:23 . 2010-03-10 19:20 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-03-06 07:13 . 2010-03-06 07:12 389120 —-a-w- c:\windows\system32\CF26197.exe
2010-02-28 18:57 . 2010-02-28 18:57 ——– d—–w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\Threat Expert

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-17 02:33 . 2010-02-10 04:03 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-03-17 02:33 . 2010-03-17 02:01 1472 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-03-17 02:33 . 2010-03-17 02:00 3480 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-03-16 18:17 . 2005-02-09 14:48 ——– d—–w- c:\program files\Spyware Doctor
2010-03-16 18:15 . 2006-11-06 15:23 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-16 16:41 . 2010-03-16 16:41 20 —-a-w- c:\windows\system32\config\systemprofile\Application Data\zxcdyt.dat
2010-03-13 05:54 . 2006-01-21 00:46 ——– d—–w- c:\program files\EPSON Print CD
2010-03-10 19:19 . 2004-02-10 22:08 ——– d—–w- c:\program files\Java
2010-03-09 15:20 . 2010-03-09 15:20 24 —-a-w- c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
2010-03-09 02:46 . 2008-04-22 22:05 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\FileZilla
2010-03-09 02:43 . 2010-03-09 02:43 24 —-a-w- c:\documents and settings\NetworkService\Application Data\rbuwzv.dat
2010-03-05 20:25 . 2008-12-30 16:11 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-05 01:02 . 2010-02-13 03:11 3764224 —ha-w- C:\SZKGFS.dat
2010-03-03 17:29 . 2004-04-29 00:46 128848 -c–a-w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-02 19:05 . 2009-05-12 20:58 ——– d—–w- c:\program files\Finale 2009
2010-02-24 14:16 . 2010-02-09 16:13 181632 —-a-w- c:\windows\system32\MpSigStub.exe
2010-02-10 16:41 . 2007-07-20 14:33 ——– d—–w- c:\program files\Security Task Manager
2010-02-10 04:06 . 2010-02-10 04:06 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2010-02-10 04:03 . 2010-02-10 04:03 ——– d—–w- c:\program files\STOPzilla!
2010-02-10 04:03 . 2010-02-10 04:03 ——– d—–w- c:\program files\Common Files\iS3
2010-02-10 03:12 . 2010-02-10 02:28 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\GetRightToGo
2010-02-09 23:02 . 2010-02-09 23:03 389120 —-a-w- c:\windows\system32\CF7346.exe
2010-02-09 16:22 . 2009-10-26 15:12 94248 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-09 16:02 . 2010-02-09 16:02 24 —-a-w- c:\windows\system32\config\systemprofile\Application Data\sgcpom.dat
2010-02-04 16:21 . 2010-02-04 16:21 17408 —-a-r- c:\windows\system32\SZIO5.dll
2010-02-04 16:19 . 2010-02-04 16:19 442368 —-a-r- c:\windows\system32\SZBase5.dll
2010-02-04 16:18 . 2010-02-04 16:18 540672 —-a-r- c:\windows\system32\SZComp5.dll
2010-02-03 17:25 . 2010-02-03 17:23 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Smart PDF Creator
2010-02-03 17:22 . 2010-02-03 17:22 ——– d—–w- c:\program files\Smart PDF Creator
2010-01-29 05:41 . 2010-01-29 05:41 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Facebook
2010-01-27 15:19 . 2010-01-27 15:19 167312 —-a-r- c:\windows\system32\drivers\SZKGFS.sys
2010-01-22 17:31 . 2010-01-22 17:31 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Helios
2010-01-22 17:30 . 2010-01-22 17:30 ——– d—–w- c:\program files\TextPad 5
2010-01-22 02:39 . 2008-08-16 01:55 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-10 22:38 . 2009-05-06 21:56 256 —-a-w- c:\windows\system32\pool.bin
2010-01-07 21:07 . 2008-12-30 16:11 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2008-12-30 16:11 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2003-03-31 02:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-24 00:32 916480 —-a-w- c:\windows\system32\wininet.dll
2009-01-05 17:47 . 2009-01-05 01:22 806944 –sha-w- c:\windows\system32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2005-02-07 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi2"=mausbman.dll
"midi3"=mausbman.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^FirePod Control Panel.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\FirePod Control Panel.lnk
backup=c:\windows\pss\FirePod Control Panel.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Lexmark X125 Settings Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Lexmark X125 Settings Utility.lnk
backup=c:\windows\pss\Lexmark X125 Settings Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpySubtract.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk
backup=c:\windows\pss\SpySubtract.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^monnwb32.exe]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\monnwb32.exe
backup=c:\windows\pss\monnwb32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^V CAST Music Monitor.lnk]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\V CAST Music Monitor.lnk
backup=c:\windows\pss\V CAST Music Monitor.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^winesm32.exe]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\winesm32.exe
backup=c:\windows\pss\winesm32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^wkcalrem.LNK]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\wkcalrem.LNK
backup=c:\windows\pss\wkcalrem.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABBYY Community Agent]
2002-03-20 23:32 253952 —-a-w- c:\program files\ABBYY FineReader 5.0 Sprint\CAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2007-05-11 03:46 624248 —-a-w- c:\program files\Common Files\Adobe\Installers\4dcfd9b7e901b57f81f667144603236\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
2002-06-21 16:54 684032 -c–a-w- c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2009-10-28 14:38 50536 —-a-w- c:\program files\AOL 9.5\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2003-10-08 03:40 159744 -c–a-w- c:\program files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2009-11-20 03:29 623960 —-a-w- c:\program files\Common Files\Research in Motion\Auto Update\RIMAutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-10-07 08:23 90112 -c–a-w- c:\program files\HP\Digital Imaging\Unload\HpqCmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
2005-01-07 21:30 864256 ——w- c:\program files\Brother\ControlCenter2\brctrcen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
2003-10-17 22:51 196670 -c–a-w- c:\program files\HPQ\Default Settings\Cpqset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
2003-12-11 16:50 241664 -c–a-w- c:\program files\HPQ\Quick Launch Buttons\eabservr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C42 Series]
2002-02-19 08:03 74240 -c–a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S10IC1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FireControl]
2007-09-01 20:03 1523712 -c–a-w- c:\program files\PreSonus_FireStudio\PreSonus FireControl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2009-07-20 19:52 41264 —-a-w- c:\program files\Common Files\AOL\1263237442\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 19:24 49152 -c–a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-05-23 03:55 483328 -c–a-w- c:\windows\system32\hphmon05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2004-04-14 19:04 40960 —-a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2008-10-24 13:14 206112 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 20:36 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LMPDPSRV]
2002-07-11 18:31 45056 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\LMpdpsrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —ha-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 15:50 155648 -c–a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2003-12-19 08:17 4730880 —-a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIEW]
2003-12-19 08:17 856133 -c–a-w- c:\windows\system32\nview.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2004-04-14 18:46 57393 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 05:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2009-07-08 17:31 236016 —-a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-17 18:42 69632 -c–a-w- c:\program files\HP\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSoft PDF Printer (demo) Agent]
2007-10-22 07:45 94208 —-a-w- c:\program files\Smart PDF Creator\sspdfagentd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSoft PDF Printer (demo) virtual printer agent]
2007-10-22 07:45 94208 —-a-w- c:\program files\Smart PDF Creator\sspdfagentd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 14:22 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-03-10 19:20 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2006-11-28 00:26 163576 -c–a-w- c:\program files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
2005-02-05 18:02 111840 -c–a-w- c:\progra~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 09:01 110592 -c–a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Button Manager]
2007-11-05 23:34 364544 -c–a-w- c:\windows\system32\WDBtnMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-03 23:20 866584 -c–a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xmasepe]
c:\windows\ejonuresiqaquz.dll [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)
"TUWinStylerThemeSvc"=3 (0x3)
"ThreatFire"=3 (0x3)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"RoxWatch9"=2 (0x2)
"RoxMediaDB9"=3 (0x3)
"RoxLiveShare9"=2 (0x2)
"Roxio Upnp Server 9"=2 (0x2)
"Roxio UPnP Renderer 9"=3 (0x3)
"ose"=3 (0x3)
"MAudioMidAirService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"ClipSrv"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"aawservice"=2 (0x2)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]
jvieator REG_SZ c:\windows\system32\drvidial.dll
jdbgstub REG_SZ c:\windows\system32\drmuutou.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [12/7/2009 5:59 PM 61328]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [1/27/2010 11:19 AM 167312]
R2 ALSDrvr;Alesis Disk Driver;c:\windows\system32\drivers\alsdrvr.sys [3/3/2008 12:18 PM 5119]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [12/7/2009 5:59 PM 61328]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys –> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys –> c:\windows\system32\drivers\TfSysMon.sys [?]
S3 MAUSBMA;%EVOL_USB.SvcDescInst%;c:\windows\system32\drivers\mausbma.sys [6/20/2008 12:55 PM 21472]
S3 PacketNTx;Packet helper driver;c:\windows\system32\drivers\PacketNTx.sys [4/28/2004 2:00 PM 24544]
S3 PaeFireStudio;PreSonus FireStudio;c:\windows\system32\drivers\PaeFireStudio.sys [11/5/2007 2:40 PM 129024]
S3 PaeFireStudioAudio;PreSonus FireStudio Audio;c:\windows\system32\drivers\PaeFireStudioAudio.sys [11/5/2007 2:40 PM 22528]
S3 PaeFireStudioMidi;PreSonus FireStudio MIDI;c:\windows\system32\drivers\PaeFireStudioMidi.sys [11/5/2007 2:40 PM 23040]
S3 pc22nd5;Toshiba PCX2200 USB Cable Modem networking driver (NDIS);c:\windows\system32\drivers\pc22nd5.sys [4/28/2004 2:00 PM 17648]
S3 pc22unic;Toshiba PCX2200 USB Cable Modem WDM driver;c:\windows\system32\drivers\pc22unic.sys [4/28/2004 2:00 PM 69744]
S3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [11/21/2004 9:46 PM 15104]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys –> c:\windows\system32\drivers\TfNetMon.sys [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [11/5/2007 7:35 PM 10112]
S4 MAudioMidAirService;M-Audio MidAir Installer;c:\program files\M-Audio\MidAir\MidAirInst.exe –> c:\program files\M-Audio\MidAir\MidAirInst.exe [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]

2010-03-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: 3smd.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} - hxxp://centra1.nvcc.edu/SiteRoots/main/Install/CentraDownloader.cab
FF - ProfilePath - c:\documents and settings\Matt Montoro\Application Data\Mozilla\Firefox\Profiles\kwbldaj6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.3sgiants.com
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Move Networks\plugins\npqmp071502000008.dll
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\program files\Common Files\Adobe\Installers\4dcfd9b7e901b57f81f667144603236\Acrobat 8.0\Acrobat\browser\nppdf32.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: XULRunner: {47D0C67F-661A-4C52-A0F5-3282D959AA37} - c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-syncman - c:\documents and settings\matt montoro\wuaucldt.exe
HKCU-Run-sysappdg - c:\documents and settings\Matt Montoro\Local Settings\Application Data\sysappdg\sysappdg.dll
HKLM-Run-Xmasepe - c:\windows\ejonuresiqaquz.dll
MSConfigStartUp-Adobe Photo Downloader - c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-ISTray - c:\program files\Spyware Doctor\pctsTray.exe
MSConfigStartUp-Regedit32 - c:\windows\system32\regedit.exe
MSConfigStartUp-syncman - c:\windows\system32\wuaucldt.exe
AddRemove-Adobe Photoshop 7.0 - c:\program files\Adobe\Photoshop 7.0\Uninst.isu

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-16 22:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2632)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\iS3\Anti-Spyware\SZServer.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\nvsvc32.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\wanmpsvc.exe
.
**************************************************************************
.
Completion time: 2010-03-16 22:46:37 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-17 02:46
ComboFix2.txt 2010-03-13 07:54
ComboFix3.txt 2010-03-11 21:11

Pre-Run: 13,413,900,288 bytes free
Post-Run: 13,404,585,984 bytes free

- - End Of File - - 6814032415BDA69E283E82B4296F6B92

LDTate

Post #34March 17, 2010, 3:03 AM UTC

I'm headed to bed but will check your scans out in the morning.

Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

c:\documents and settings\LocalService\Local Settings\Application Data\sysappdg

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virscan.org is too busy you can try these.

http://virscan.org/

http://www.kaspersky.com/scanforvirus.html

http://www.virustotal.com/en/indexf.html

3streamMusic

Post #35March 17, 2010, 3:25 AM UTC

Filename: sysappdg.dll Status: Scan finished. 4 out of 20 scanners reported malware. Scan taken on: Wed 17 Mar 2010 04:21:19 (CET) Permalink Additional info File size: 73728 bytes Filetype: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 486a4269eab43dfa97d526de7ce2281c SHA1: 7c5b763daa7c76b96dd317a4780180dcff7e0b8a Scanners [ArcaVir] 2010-03-16 Found nothing [F-Secure Anti-Virus] 2010-03-17 Found nothing [A-Squared] 2010-03-17 Trojan.Win32.Obfuscated!IK [G DATA] 2010-03-17 Found nothing [Avast! antivirus] 2010-03-16 Found nothing [Ikarus] 2010-03-17 Trojan.Win32.Obfuscated [Grisoft AVG Anti-Virus] 2010-03-16 Found nothing [Kaspersky Anti-Virus] 2010-03-16 Found nothing [Avira AntiVir] 2010-03-16 TR/Crypt.XPACK.Gen [ESET NOD32] 2010-03-16 Found nothing [Softwin BitDefender] 2010-03-17 Found nothing [Panda Antivirus] 2010-03-16 Found nothing [ClamAV] 2010-03-17 Found nothing [Quick Heal] 2010-03-17 Found nothing [CPsecure] 2010-03-17 Found nothing [Sophos] 2010-03-17 Mal/Behav-365 [Dr.Web] 2010-03-17 Found nothing [VirusBlokAda VBA32] 2010-03-15 Found nothing [Frisk F-Prot Antivirus] 2010-03-16 Found nothing [VirusBuster] 2010-03-16 Found nothing

LDTate

Post #36March 17, 2010, 12:12 PM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

http://forums.whatthetech.com/Please_Help_Virus_pegs_CPU_100_keeps_computer_ru_t110693.html&st=30

File::
c:\documents and settings\LocalService\Local Settings\Application Data\ave.exe
c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
c:\documents and settings\NetworkService\Application Data\rbuwzv.dat
c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\winesm32.exe
c:\progra~1\SYMNET~1\SNDMon.exe
c:\windows\ejonuresiqaquz.dll

Folder::
c:\documents and settings\LocalService\Local Settings\Application Data\sysappdg
c:\documents and settings\Matt Montoro\Local Settings\Application Data\sysappdg
c:\program files\Spyware Doctor
c:\progra~1\SYMNET~1

Collect::
c:\windows\system32\fjhdyfhsn.bat
c:\windows\system32\drvidial.dll
c:\windows\system32\drmuutou.dll

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^winesm32.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xmasepe]
[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

3streamMusic

Post #37March 17, 2010, 4:09 PM UTC

ComboFix 10-03-16.05 - Matt Montoro 03/17/2010 11:36:23.9.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1279.760 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Matt Montoro\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\LocalService\Local Settings\Application Data\ave.exe"
"c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\winesm32.exe"
"c:\documents and settings\NetworkService\Application Data\rbuwzv.dat"
"c:\progra~1\SYMNET~1\SNDMon.exe"
"c:\windows\ejonuresiqaquz.dll"
"c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat"

file zipped: c:\windows\system32\fjhdyfhsn.bat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Local Settings\Application Data\ave.exe
c:\documents and settings\LocalService\Local Settings\Application Data\sysappdg
c:\documents and settings\LocalService\Local Settings\Application Data\sysappdg\sysappdg.dll
c:\documents and settings\Matt Montoro\Application Data\avdrn.dat
c:\documents and settings\Matt Montoro\Local Settings\Application Data\sysappdg
c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\monnwb32.exe
c:\documents and settings\NetworkService\Application Data\rbuwzv.dat
c:\progra~1\SYMNET~1
c:\progra~1\SYMNET~1\SNDMon.exe
c:\program files\Spyware Doctor
c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe.old
c:\program files\Spyware Doctor\BDT\PCTBDUpdate.exe.old
c:\program files\Spyware Doctor\BDT\PCTBrowserDefender.dll.old
c:\program files\Spyware Doctor\BDT\PCTLicReset.dll
c:\program files\Spyware Doctor\log\log20050203172125.sdl
c:\program files\Spyware Doctor\log\log20050204083530.sdl
c:\program files\Spyware Doctor\log\log20050204102250.sdl
c:\program files\Spyware Doctor\log\log20050204102401.sdl
c:\program files\Spyware Doctor\log\log20050204102403.sdl
c:\program files\Spyware Doctor\log\log20050204103457.sdl
c:\program files\Spyware Doctor\log\log20050204103513.sdl
c:\program files\Spyware Doctor\log\log20050204103517.sdl
c:\program files\Spyware Doctor\log\log20050204104714.sdl
c:\program files\Spyware Doctor\log\log20050204104728.sdl
c:\program files\Spyware Doctor\log\log20050204104748.sdl
c:\program files\Spyware Doctor\log\log20050204104838.sdl
c:\program files\Spyware Doctor\log\log20050204105058.sdl
c:\program files\Spyware Doctor\log\log20050204113958.sdl
c:\program files\Spyware Doctor\log\log20050204114044.sdl
c:\program files\Spyware Doctor\log\log20050204114256.sdl
c:\program files\Spyware Doctor\log\log20050204114638.sdl
c:\program files\Spyware Doctor\log\log20050204114649.sdl
c:\program files\Spyware Doctor\log\log20050209095541.sdl
c:\program files\Spyware Doctor\log\log20050209105550.sdl
c:\program files\Spyware Doctor\log\log20050210123349.sdl
c:\program files\Spyware Doctor\log\log20050210142335.sdl
c:\program files\Spyware Doctor\log\log20050210163308.sdl
c:\program files\Spyware Doctor\log\log20050210172443.sdl
c:\program files\Spyware Doctor\log\log20050210172631.sdl
c:\program files\Spyware Doctor\log\log20050211000635.sdl
c:\program files\Spyware Doctor\log\log20050211003123.sdl
c:\program files\Spyware Doctor\log\log20050211105626.sdl
c:\program files\Spyware Doctor\log\log20050211132227.sdl
c:\program files\Spyware Doctor\log\log20050211174447.sdl
c:\program files\Spyware Doctor\log\log20050211180001.sdl
c:\program files\Spyware Doctor\log\log20050211180007.sdl
c:\program files\Spyware Doctor\log\log20050322024854.sdl
c:\program files\Spyware Doctor\log\log20050408121606.sdl
c:\program files\Spyware Doctor\log\log20050408180001.sdl
c:\program files\Spyware Doctor\log\log20050408180003.sdl
c:\program files\Spyware Doctor\log\log20050629194218.sdl
c:\program files\Spyware Doctor\log\log20050701180002.sdl
c:\program files\Spyware Doctor\log\log20050701180004.sdl
c:\program files\Spyware Doctor\log\log20051108103157.sdl
c:\program files\Spyware Doctor\log\log20051108183543.sdl
c:\program files\Spyware Doctor\log\log20051108183605.sdl
c:\program files\Spyware Doctor\log\log20051110190620.sdl
c:\program files\Spyware Doctor\log\log20051112202149.sdl
c:\program files\Spyware Doctor\log\log20051112202217.sdl
c:\program files\Spyware Doctor\log\log20051112202236.sdl
c:\program files\Spyware Doctor\log\log20051112202409.sdl
c:\program files\Spyware Doctor\log\log20051120181243.sdl
c:\program files\Spyware Doctor\log\log20051120181314.sdl
c:\program files\Spyware Doctor\log\log20051120181334.sdl
c:\program files\Spyware Doctor\log\log20051120181353.sdl
c:\program files\Spyware Doctor\log\log20051120181409.sdl
c:\program files\Spyware Doctor\log\log20060102190155.sdl
c:\program files\Spyware Doctor\log\log20060108015648.sdl
c:\program files\Spyware Doctor\log\log20060203234906.sdl
c:\program files\Spyware Doctor\log\log20060214174527.sdl
c:\program files\Spyware Doctor\log\log20060223115519.sdl
c:\program files\Spyware Doctor\log\log20060228020840.sdl
c:\program files\Spyware Doctor\log\log20060307161658.sdl
c:\program files\Spyware Doctor\log\log20060323144604.sdl
c:\program files\Spyware Doctor\log\log20060331102536.sdl
c:\program files\Spyware Doctor\log\log20060607133424.sdl
c:\program files\Spyware Doctor\log\log20060607134705.sdl
c:\program files\Spyware Doctor\log\log20060619192350.sdl
c:\program files\Spyware Doctor\log\log20060710020303.sdl
c:\program files\Spyware Doctor\log\log20060723140019.sdl
c:\program files\Spyware Doctor\log\log20060819175228.sdl
c:\program files\Spyware Doctor\log\log20060825171727.sdl
c:\program files\Spyware Doctor\log\log20060904175256.sdl
c:\program files\Spyware Doctor\log\log20060904205653.sdl
c:\program files\Spyware Doctor\log\log20060905154902.sdl
c:\program files\Spyware Doctor\log\log20060918123004.sdl
c:\program files\Spyware Doctor\log\log20061010120558.sdl
c:\program files\Spyware Doctor\log\log20061016140145.sdl
c:\program files\Spyware Doctor\log\log20061201134130.sdl
c:\program files\Spyware Doctor\log\log20070212001147.sdl
c:\program files\Spyware Doctor\log\log20070219145620.sdl
c:\program files\Spyware Doctor\log\log20070325211954.sdl
c:\program files\Spyware Doctor\log\log20070423021908.sdl
c:\program files\Spyware Doctor\log\log20070425222922.sdl
c:\program files\Spyware Doctor\log\log20070810133920.sdl
c:\program files\Spyware Doctor\log\log20070918021004.sdl
c:\program files\Spyware Doctor\log\log20071117115145.sdl
c:\program files\Spyware Doctor\log\log20071203023142.sdl
c:\program files\Spyware Doctor\log\log20081227111202.sdl
c:\program files\Spyware Doctor\log\log20081227125848.sdl
c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
c:\windows\system32\fjhdyfhsn.bat

.
((((((((((((((((((((((((( Files Created from 2010-02-17 to 2010-03-17 )))))))))))))))))))))))))))))))
.

2010-03-17 12:59 . 2010-03-17 12:59 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-03-17 12:59 . 2010-03-17 12:59 ——– d—–w- c:\program files\NOS
2010-03-17 12:59 . 2010-02-19 23:31 350064 —-a-w- c:\documents and settings\Matt Montoro\Application Data\Mozilla\Firefox\Profiles\kwbldaj6.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe.exe
2010-03-17 12:59 . 2010-02-19 23:31 31936 —-a-w- c:\documents and settings\Matt Montoro\Application Data\Mozilla\Firefox\Profiles\kwbldaj6.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-03-17 12:59 . 2010-02-19 23:31 29344 —-a-w- c:\documents and settings\Matt Montoro\Application Data\Mozilla\Firefox\Profiles\kwbldaj6.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-03-16 18:49 . 2010-03-16 18:49 ——– d—–w- C:\9acb3b6a78c737d603facb
2010-03-16 16:45 . 2010-03-16 16:45 ——– d—–w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}
2010-03-16 16:41 . 2010-03-16 16:41 51807 —-a-w- c:\windows\system32\config\systemprofile\wuaucldt.exe
2010-03-11 16:30 . 2010-03-11 16:29 389120 —-a-w- c:\windows\system32\CF5989.exe
2010-03-10 19:53 . 2009-10-23 15:28 3558912 —-a-w- c:\windows\system32\dllcache\moviemk.exe
2010-03-10 19:23 . 2010-03-10 19:20 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-03-10 19:14 . 2010-03-10 19:14 152576 —-a-w- c:\documents and settings\Matt Montoro\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-03-10 19:13 . 2010-03-10 19:13 79488 —-a-w- c:\documents and settings\Matt Montoro\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-06 07:13 . 2010-03-06 07:12 389120 —-a-w- c:\windows\system32\CF26197.exe
2010-02-28 18:57 . 2010-02-28 18:57 ——– d—–w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\Threat Expert

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-17 15:49 . 2010-02-10 04:03 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-03-17 15:36 . 2010-03-17 15:35 1584 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-03-17 15:36 . 2010-03-17 15:09 2784 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-03-16 18:15 . 2006-11-06 15:23 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-16 16:41 . 2010-03-16 16:41 20 —-a-w- c:\windows\system32\config\systemprofile\Application Data\zxcdyt.dat
2010-03-13 05:54 . 2006-01-21 00:46 ——– d—–w- c:\program files\EPSON Print CD
2010-03-10 19:19 . 2004-02-10 22:08 ——– d—–w- c:\program files\Java
2010-03-09 02:46 . 2008-04-22 22:05 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\FileZilla
2010-03-05 20:25 . 2008-12-30 16:11 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-05 01:02 . 2010-02-13 03:11 3764224 —ha-w- C:\SZKGFS.dat
2010-03-03 17:29 . 2004-04-29 00:46 128848 -c–a-w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-02 19:05 . 2009-05-12 20:58 ——– d—–w- c:\program files\Finale 2009
2010-02-24 14:16 . 2010-02-09 16:13 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-10 16:41 . 2007-07-20 14:33 ——– d—–w- c:\program files\Security Task Manager
2010-02-10 04:06 . 2010-02-10 04:06 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2010-02-10 04:03 . 2010-02-10 04:03 ——– d—–w- c:\program files\STOPzilla!
2010-02-10 04:03 . 2010-02-10 04:03 ——– d—–w- c:\program files\Common Files\iS3
2010-02-10 03:12 . 2010-02-10 02:28 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\GetRightToGo
2010-02-09 23:02 . 2010-02-09 23:03 389120 —-a-w- c:\windows\system32\CF7346.exe
2010-02-09 16:22 . 2009-10-26 15:12 94248 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-09 16:02 . 2010-02-09 16:02 24 —-a-w- c:\windows\system32\config\systemprofile\Application Data\sgcpom.dat
2010-02-04 16:21 . 2010-02-04 16:21 17408 —-a-r- c:\windows\system32\SZIO5.dll
2010-02-04 16:19 . 2010-02-04 16:19 442368 —-a-r- c:\windows\system32\SZBase5.dll
2010-02-04 16:18 . 2010-02-04 16:18 540672 —-a-r- c:\windows\system32\SZComp5.dll
2010-02-03 17:25 . 2010-02-03 17:23 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Smart PDF Creator
2010-02-03 17:22 . 2010-02-03 17:22 ——– d—–w- c:\program files\Smart PDF Creator
2010-01-29 05:41 . 2010-01-29 05:41 50354 —-a-w- c:\documents and settings\Matt Montoro\Application Data\Facebook\uninstall.exe
2010-01-29 05:41 . 2010-01-29 05:41 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Facebook
2010-01-27 15:19 . 2010-01-27 15:19 167312 —-a-r- c:\windows\system32\drivers\SZKGFS.sys
2010-01-27 03:21 . 2010-01-27 03:21 847040 —-a-w- c:\documents and settings\Matt Montoro\Application Data\Facebook\axfbootloader.dll
2010-01-27 03:20 . 2010-01-27 03:20 5578752 —-a-w- c:\documents and settings\Matt Montoro\Application Data\Facebook\npfbplugin_1_0_1.dll
2010-01-22 17:31 . 2010-01-22 17:31 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Helios
2010-01-22 17:30 . 2010-01-22 17:30 ——– d—–w- c:\program files\TextPad 5
2010-01-22 02:39 . 2008-08-16 01:55 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-11 19:10 . 2010-01-11 19:09 43732816 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\waol_single\4337.155.1.1\setup.exe
2010-01-11 19:09 . 2010-01-11 19:09 42960 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\waol_single\4337.155.1.1\noneCodesignFilesBundle.exe
2010-01-10 22:38 . 2009-05-06 21:56 256 —-a-w- c:\windows\system32\pool.bin
2010-01-07 21:07 . 2008-12-30 16:11 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2008-12-30 16:11 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2003-03-31 02:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-24 00:32 916480 ——w- c:\windows\system32\wininet.dll
2009-01-05 17:47 . 2009-01-05 01:22 806944 –sha-w- c:\windows\system32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2005-02-07 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi2"=mausbman.dll
"midi3"=mausbman.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^FirePod Control Panel.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\FirePod Control Panel.lnk
backup=c:\windows\pss\FirePod Control Panel.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Lexmark X125 Settings Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Lexmark X125 Settings Utility.lnk
backup=c:\windows\pss\Lexmark X125 Settings Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpySubtract.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk
backup=c:\windows\pss\SpySubtract.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^monnwb32.exe]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\monnwb32.exe
backup=c:\windows\pss\monnwb32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^V CAST Music Monitor.lnk]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\V CAST Music Monitor.lnk
backup=c:\windows\pss\V CAST Music Monitor.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^wkcalrem.LNK]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\wkcalrem.LNK
backup=c:\windows\pss\wkcalrem.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABBYY Community Agent]
2002-03-20 23:32 253952 —-a-w- c:\program files\ABBYY FineReader 5.0 Sprint\CAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2007-05-11 03:46 624248 —-a-w- c:\program files\Common Files\Adobe\Installers\4dcfd9b7e901b57f81f667144603236\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
2002-06-21 16:54 684032 -c–a-w- c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2009-10-28 14:38 50536 —-a-w- c:\program files\AOL 9.5\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2003-10-08 03:40 159744 -c–a-w- c:\program files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2009-11-20 03:29 623960 —-a-w- c:\program files\Common Files\Research in Motion\Auto Update\RIMAutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-10-07 08:23 90112 -c–a-w- c:\program files\HP\Digital Imaging\Unload\HpqCmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
2005-01-07 21:30 864256 ——w- c:\program files\Brother\ControlCenter2\brctrcen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
2003-10-17 22:51 196670 -c–a-w- c:\program files\HPQ\Default Settings\Cpqset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
2003-12-11 16:50 241664 -c–a-w- c:\program files\HPQ\Quick Launch Buttons\eabservr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C42 Series]
2002-02-19 08:03 74240 -c–a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S10IC1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FireControl]
2007-09-01 20:03 1523712 -c–a-w- c:\program files\PreSonus_FireStudio\PreSonus FireControl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2009-07-20 19:52 41264 —-a-w- c:\program files\Common Files\AOL\1263237442\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 19:24 49152 -c–a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-05-23 03:55 483328 -c–a-w- c:\windows\system32\hphmon05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2004-04-14 19:04 40960 —-a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2008-10-24 13:14 206112 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 20:36 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LMPDPSRV]
2002-07-11 18:31 45056 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\LMpdpsrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —ha-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 15:50 155648 -c–a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2003-12-19 08:17 4730880 —-a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIEW]
2003-12-19 08:17 856133 -c–a-w- c:\windows\system32\nview.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2004-04-14 18:46 57393 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 05:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2009-07-08 17:31 236016 —-a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-17 18:42 69632 -c–a-w- c:\program files\HP\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSoft PDF Printer (demo) Agent]
2007-10-22 07:45 94208 —-a-w- c:\program files\Smart PDF Creator\sspdfagentd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSoft PDF Printer (demo) virtual printer agent]
2007-10-22 07:45 94208 —-a-w- c:\program files\Smart PDF Creator\sspdfagentd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 14:22 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-03-10 19:20 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2006-11-28 00:26 163576 -c–a-w- c:\program files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 09:01 110592 -c–a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Button Manager]
2007-11-05 23:34 364544 -c–a-w- c:\windows\system32\WDBtnMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-03 23:20 866584 -c–a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)
"TUWinStylerThemeSvc"=3 (0x3)
"ThreatFire"=3 (0x3)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"RoxWatch9"=2 (0x2)
"RoxMediaDB9"=3 (0x3)
"RoxLiveShare9"=2 (0x2)
"Roxio Upnp Server 9"=2 (0x2)
"Roxio UPnP Renderer 9"=3 (0x3)
"ose"=3 (0x3)
"MAudioMidAirService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"ClipSrv"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"aawservice"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [12/7/2009 5:59 PM 61328]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [1/27/2010 11:19 AM 167312]
R2 ALSDrvr;Alesis Disk Driver;c:\windows\system32\drivers\alsdrvr.sys [3/3/2008 12:18 PM 5119]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [12/7/2009 5:59 PM 61328]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys –> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys –> c:\windows\system32\drivers\TfSysMon.sys [?]
S3 MAUSBMA;%EVOL_USB.SvcDescInst%;c:\windows\system32\drivers\mausbma.sys [6/20/2008 12:55 PM 21472]
S3 PacketNTx;Packet helper driver;c:\windows\system32\drivers\PacketNTx.sys [4/28/2004 2:00 PM 24544]
S3 PaeFireStudio;PreSonus FireStudio;c:\windows\system32\drivers\PaeFireStudio.sys [11/5/2007 2:40 PM 129024]
S3 PaeFireStudioAudio;PreSonus FireStudio Audio;c:\windows\system32\drivers\PaeFireStudioAudio.sys [11/5/2007 2:40 PM 22528]
S3 PaeFireStudioMidi;PreSonus FireStudio MIDI;c:\windows\system32\drivers\PaeFireStudioMidi.sys [11/5/2007 2:40 PM 23040]
S3 pc22nd5;Toshiba PCX2200 USB Cable Modem networking driver (NDIS);c:\windows\system32\drivers\pc22nd5.sys [4/28/2004 2:00 PM 17648]
S3 pc22unic;Toshiba PCX2200 USB Cable Modem WDM driver;c:\windows\system32\drivers\pc22unic.sys [4/28/2004 2:00 PM 69744]
S3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [11/21/2004 9:46 PM 15104]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys –> c:\windows\system32\drivers\TfNetMon.sys [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [11/5/2007 7:35 PM 10112]
S4 MAudioMidAirService;M-Audio MidAir Installer;c:\program files\M-Audio\MidAir\MidAirInst.exe –> c:\program files\M-Audio\MidAir\MidAirInst.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-03-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]

2010-03-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: 3smd.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} - hxxp://centra1.nvcc.edu/SiteRoots/main/Install/CentraDownloader.cab
FF - ProfilePath - c:\documents and settings\Matt Montoro\Application Data\Mozilla\Firefox\Profiles\kwbldaj6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.3sgiants.com
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Move Networks\plugins\npqmp071502000008.dll
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Mozilla\Firefox\Profiles\kwbldaj6.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Common Files\Adobe\Installers\4dcfd9b7e901b57f81f667144603236\Acrobat 8.0\Acrobat\browser\nppdf32.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: XULRunner: {47D0C67F-661A-4C52-A0F5-3282D959AA37} - c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 11:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-03-17 11:55:35
ComboFix-quarantined-files.txt 2010-03-17 15:55
ComboFix2.txt 2010-03-17 02:46
ComboFix3.txt 2010-03-13 07:54
ComboFix4.txt 2010-03-11 21:11

Pre-Run: 13,322,305,536 bytes free
Post-Run: 13,279,588,352 bytes free

- - End Of File - - 1F8C86762C825EA3EE675DE7266D099E
Upload was successful

LDTate

Post #38March 17, 2010, 4:12 PM UTC

Get a free one.

Only run one Anti-virus program at a time.

Use an AntiVirus Software - Choose only one - More than one will conflict. It is very important that your computer has anti-virus software running to protect against viruses. Update Antivirus prior to manual scans as necessary or as used. Please only choose one, having more than one can cause problems, such as crashes and your computer to slow down.

Run a full scan and let us know what it finds

3streamMusic

Post #39March 20, 2010, 10:36 PM UTC

It took me a while to do a full system scan. XP Security Essentials found several viruses and seems to contimue to do so. I am getting a bogus XP Defender and Security Center Popup on startup. Found these files in the startup folder: C:\WINDOWS\system32\regedit32.exe C:\WINDOWS\system32\wuaucldt.exe wuaucldt.exe is also my documents and settings folder and monnwb32 and syspck32 are in the start menu folder

LDTate

Post #40March 21, 2010, 12:17 AM UTC

Submit them for checking.

Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

C:\WINDOWS\system32\regedit32.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

Do the same for the others

If virscan.org is too busy you can try these.

http://virscan.org/

http://www.kaspersky.com/scanforvirus.html

3streamMusic

Post #41March 22, 2010, 12:29 AM UTC

I was unable to do the online virus scan because of the CPU pegged at 100% -
So I ran another combofix scan which reported the deletion of many of the files I listed and then some - MS Essentials reported a clean scan - here is the CF Log:

ComboFix 10-03-20.06 - Matt Montoro 03/21/2010 12:42:50.11.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1279.867 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}
c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}\chrome.manifest
c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}\chrome\content\_cfg.js
c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}\chrome\content\overlay.xul
c:\documents and settings\Matt Montoro\Local Settings\Application Data\{47D0C67F-661A-4C52-A0F5-3282D959AA37}\install.rdf
c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\monnwb32.exe
c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\syspck32.exe
c:\windows\system32\fjhdyfhsn.bat
c:\windows\system32\syslink.dll
c:\windows\system32\sysprint.dll
c:\windows\system32\syswrk.dll
c:\windows\system32\tcpG4T.dll
c:\windows\system32\tcpGDC.dll
c:\windows\system32\tcpr32.dll
c:\windows\system32\tcpwrk.dll
c:\windows\system32\upperhost.dll
c:\windows\system32\vdmt16.sys
c:\windows\system32\vinm32.dll
c:\windows\system32\vinm32.sys
c:\windows\system32\vinm64.sys
c:\windows\system32\vmdesched.sys
c:\windows\system32\wnmicf.sys
c:\windows\system32\xmsk64.sys

.
((((((((((((((((((((((((( Files Created from 2010-02-21 to 2010-03-21 )))))))))))))))))))))))))))))))
.

2010-03-20 20:38 . 2010-03-20 20:38 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-03-20 15:44 . 2010-03-21 02:59 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\nvrssystools
2010-03-20 15:42 . 2010-03-21 00:44 ——– d—–w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\nvrssystools
2010-03-17 17:01 . 2010-03-17 17:03 ——– d—–w- c:\program files\Microsoft Security Essentials
2010-03-17 16:38 . 2010-03-17 16:38 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\AVG8
2010-03-17 12:59 . 2010-03-17 12:59 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-03-17 12:59 . 2010-03-17 12:59 ——– d—–w- c:\program files\NOS
2010-03-16 18:49 . 2010-03-16 18:49 ——– d—–w- C:\9acb3b6a78c737d603facb
2010-03-11 16:30 . 2010-03-11 16:29 389120 —-a-w- c:\windows\system32\CF5989.exe
2010-03-10 19:53 . 2009-10-23 15:28 3558912 —-a-w- c:\windows\system32\dllcache\moviemk.exe
2010-03-10 19:23 . 2010-03-10 19:20 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-03-06 07:13 . 2010-03-06 07:12 389120 —-a-w- c:\windows\system32\CF26197.exe
2010-02-28 18:57 . 2010-02-28 18:57 ——– d—–w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\Threat Expert

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-21 18:18 . 2010-02-10 04:03 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-03-21 18:18 . 2010-03-21 17:57 528 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-03-21 18:17 . 2010-03-21 17:57 1792 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-03-20 21:25 . 2010-03-19 14:57 16 —-a-w- c:\windows\system32\config\systemprofile\Application Data\jasltw.dat
2010-03-16 18:15 . 2006-11-06 15:23 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-16 16:41 . 2010-03-16 16:41 20 —-a-w- c:\windows\system32\config\systemprofile\Application Data\zxcdyt.dat
2010-03-13 05:54 . 2006-01-21 00:46 ——– d—–w- c:\program files\EPSON Print CD
2010-03-10 19:19 . 2004-02-10 22:08 ——– d—–w- c:\program files\Java
2010-03-09 02:46 . 2008-04-22 22:05 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\FileZilla
2010-03-05 20:25 . 2008-12-30 16:11 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-05 01:02 . 2010-02-13 03:11 3772416 —ha-w- C:\SZKGFS.dat
2010-03-03 17:29 . 2004-04-29 00:46 128848 -c–a-w- c:\documents and settings\Matt Montoro\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-02 19:05 . 2009-05-12 20:58 ——– d—–w- c:\program files\Finale 2009
2010-02-24 14:16 . 2010-02-09 16:13 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-10 16:41 . 2007-07-20 14:33 ——– d—–w- c:\program files\Security Task Manager
2010-02-10 04:06 . 2010-02-10 04:06 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2010-02-10 04:03 . 2010-02-10 04:03 ——– d—–w- c:\program files\STOPzilla!
2010-02-10 04:03 . 2010-02-10 04:03 ——– d—–w- c:\program files\Common Files\iS3
2010-02-10 03:12 . 2010-02-10 02:28 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\GetRightToGo
2010-02-09 23:02 . 2010-02-09 23:03 389120 —-a-w- c:\windows\system32\CF7346.exe
2010-02-09 16:22 . 2009-10-26 15:12 94248 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-09 16:02 . 2010-02-09 16:02 24 —-a-w- c:\windows\system32\config\systemprofile\Application Data\sgcpom.dat
2010-02-04 16:21 . 2010-02-04 16:21 17408 —-a-r- c:\windows\system32\SZIO5.dll
2010-02-04 16:19 . 2010-02-04 16:19 442368 —-a-r- c:\windows\system32\SZBase5.dll
2010-02-04 16:18 . 2010-02-04 16:18 540672 —-a-r- c:\windows\system32\SZComp5.dll
2010-02-03 17:25 . 2010-02-03 17:23 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Smart PDF Creator
2010-02-03 17:22 . 2010-02-03 17:22 ——– d—–w- c:\program files\Smart PDF Creator
2010-01-29 05:41 . 2010-01-29 05:41 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Facebook
2010-01-27 15:19 . 2010-01-27 15:19 167312 —-a-r- c:\windows\system32\drivers\SZKGFS.sys
2010-01-22 17:31 . 2010-01-22 17:31 ——– d—–w- c:\documents and settings\Matt Montoro\Application Data\Helios
2010-01-22 17:30 . 2010-01-22 17:30 ——– d—–w- c:\program files\TextPad 5
2010-01-22 02:39 . 2008-08-16 01:55 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-10 22:38 . 2009-05-06 21:56 256 —-a-w- c:\windows\system32\pool.bin
2010-01-07 21:07 . 2008-12-30 16:11 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2008-12-30 16:11 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2003-03-31 02:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-24 00:32 916480 ——w- c:\windows\system32\wininet.dll
2009-01-05 17:47 . 2009-01-05 01:22 806944 –sha-w- c:\windows\system32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2005-02-07 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi2"=mausbman.dll
"midi3"=mausbman.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^FirePod Control Panel.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\FirePod Control Panel.lnk
backup=c:\windows\pss\FirePod Control Panel.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Lexmark X125 Settings Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Lexmark X125 Settings Utility.lnk
backup=c:\windows\pss\Lexmark X125 Settings Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpySubtract.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk
backup=c:\windows\pss\SpySubtract.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^monnwb32.exe]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\monnwb32.exe
backup=c:\windows\pss\monnwb32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^syspck32.exe]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\syspck32.exe
backup=c:\windows\pss\syspck32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^V CAST Music Monitor.lnk]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\V CAST Music Monitor.lnk
backup=c:\windows\pss\V CAST Music Monitor.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matt Montoro^Start Menu^Programs^Startup^wkcalrem.LNK]
path=c:\documents and settings\Matt Montoro\Start Menu\Programs\Startup\wkcalrem.LNK
backup=c:\windows\pss\wkcalrem.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABBYY Community Agent]
2002-03-20 23:32 253952 —-a-w- c:\program files\ABBYY FineReader 5.0 Sprint\CAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2007-05-11 03:46 624248 —-a-w- c:\program files\Common Files\Adobe\Installers\4dcfd9b7e901b57f81f667144603236\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
2002-06-21 16:54 684032 -c–a-w- c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2009-10-28 14:38 50536 —-a-w- c:\program files\AOL 9.5\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2003-10-08 03:40 159744 -c–a-w- c:\program files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2009-11-20 03:29 623960 —-a-w- c:\program files\Common Files\Research in Motion\Auto Update\RIMAutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-10-07 08:23 90112 -c–a-w- c:\program files\HP\Digital Imaging\Unload\HpqCmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
2005-01-07 21:30 864256 ——w- c:\program files\Brother\ControlCenter2\brctrcen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
2003-10-17 22:51 196670 -c–a-w- c:\program files\HPQ\Default Settings\Cpqset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
2003-12-11 16:50 241664 -c–a-w- c:\program files\HPQ\Quick Launch Buttons\eabservr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C42 Series]
2002-02-19 08:03 74240 -c–a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S10IC1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FireControl]
2007-09-01 20:03 1523712 -c–a-w- c:\program files\PreSonus_FireStudio\PreSonus FireControl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2009-07-20 19:52 41264 —-a-w- c:\program files\Common Files\AOL\1263237442\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 19:24 49152 -c–a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-05-23 03:55 483328 -c–a-w- c:\windows\system32\hphmon05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2004-04-14 19:04 40960 —-a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2008-10-24 13:14 206112 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 20:36 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LMPDPSRV]
2002-07-11 18:31 45056 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\LMpdpsrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —ha-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
2010-02-21 09:03 1093208 —-a-w- c:\program files\Microsoft Security Essentials\msseces.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 15:50 155648 -c–a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2003-12-19 08:17 4730880 —-a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIEW]
2003-12-19 08:17 856133 -c–a-w- c:\windows\system32\nview.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2004-04-14 18:46 57393 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 05:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regedit32]
c:\windows\system32\regedit.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2009-07-08 17:31 236016 —-a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-17 18:42 69632 -c–a-w- c:\program files\HP\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSoft PDF Printer (demo) Agent]
2007-10-22 07:45 94208 —-a-w- c:\program files\Smart PDF Creator\sspdfagentd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSoft PDF Printer (demo) virtual printer agent]
2007-10-22 07:45 94208 —-a-w- c:\program files\Smart PDF Creator\sspdfagentd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 14:22 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-03-10 19:20 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2006-11-28 00:26 163576 -c–a-w- c:\program files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\syncman]
c:\windows\system32\wuaucldt.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 09:01 110592 -c–a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Button Manager]
2007-11-05 23:34 364544 -c–a-w- c:\windows\system32\WDBtnMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-03 23:20 866584 -c–a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)
"TUWinStylerThemeSvc"=3 (0x3)
"ThreatFire"=3 (0x3)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"RoxWatch9"=2 (0x2)
"RoxMediaDB9"=3 (0x3)
"RoxLiveShare9"=2 (0x2)
"Roxio Upnp Server 9"=2 (0x2)
"Roxio UPnP Renderer 9"=3 (0x3)
"ose"=3 (0x3)
"MAudioMidAirService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"ClipSrv"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"aawservice"=2 (0x2)
"Adobe Version Cue CS3"=3 (0x3)
"WinDefend"=2 (0x2)
"MsMpSvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [12/7/2009 5:59 PM 61328]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [1/27/2010 11:19 AM 167312]
R2 ALSDrvr;Alesis Disk Driver;c:\windows\system32\drivers\alsdrvr.sys [3/3/2008 12:18 PM 5119]
S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [12/7/2009 5:59 PM 61328]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys –> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys –> c:\windows\system32\drivers\TfSysMon.sys [?]
S3 MAUSBMA;%EVOL_USB.SvcDescInst%;c:\windows\system32\drivers\mausbma.sys [6/20/2008 12:55 PM 21472]
S3 PacketNTx;Packet helper driver;c:\windows\system32\drivers\PacketNTx.sys [4/28/2004 2:00 PM 24544]
S3 PaeFireStudio;PreSonus FireStudio;c:\windows\system32\drivers\PaeFireStudio.sys [11/5/2007 2:40 PM 129024]
S3 PaeFireStudioAudio;PreSonus FireStudio Audio;c:\windows\system32\drivers\PaeFireStudioAudio.sys [11/5/2007 2:40 PM 22528]
S3 PaeFireStudioMidi;PreSonus FireStudio MIDI;c:\windows\system32\drivers\PaeFireStudioMidi.sys [11/5/2007 2:40 PM 23040]
S3 pc22nd5;Toshiba PCX2200 USB Cable Modem networking driver (NDIS);c:\windows\system32\drivers\pc22nd5.sys [4/28/2004 2:00 PM 17648]
S3 pc22unic;Toshiba PCX2200 USB Cable Modem WDM driver;c:\windows\system32\drivers\pc22unic.sys [4/28/2004 2:00 PM 69744]
S3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [11/21/2004 9:46 PM 15104]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys –> c:\windows\system32\drivers\TfNetMon.sys [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [11/5/2007 7:35 PM 10112]
S4 MAudioMidAirService;M-Audio MidAir Installer;c:\program files\M-Audio\MidAir\MidAirInst.exe –> c:\program files\M-Audio\MidAir\MidAirInst.exe [?]
S4 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-03-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]

2010-03-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-12-09 22:02]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: 3smd.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} - hxxp://centra1.nvcc.edu/SiteRoots/main/Install/CentraDownloader.cab
FF - ProfilePath - c:\documents and settings\Matt Montoro\Application Data\Mozilla\Firefox\Profiles\kwbldaj6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.3sgiants.com
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Move Networks\plugins\npqmp071502000008.dll
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\Matt Montoro\Application Data\Mozilla\Firefox\Profiles\kwbldaj6.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Common Files\Adobe\Installers\4dcfd9b7e901b57f81f667144603236\Acrobat 8.0\Acrobat\browser\nppdf32.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-nvrssystools - c:\documents and settings\Matt Montoro\Local Settings\Application Data\nvrssystools\nvrssystools.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 14:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(136)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\iS3\Anti-Spyware\SZServer.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\nvsvc32.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\wanmpsvc.exe
.
**************************************************************************
.
Completion time: 2010-03-21 14:32:19 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-21 18:32
ComboFix2.txt 2010-03-17 16:03
ComboFix3.txt 2010-03-17 02:46
ComboFix4.txt 2010-03-13 07:54
ComboFix5.txt 2010-03-20 04:48

Pre-Run: 12,551,081,984 bytes free
Post-Run: 12,841,234,432 bytes free

- - End Of File - - 07223285F235D9B18D37FD42FA7FE65F

LDTate

Post #42March 23, 2010, 4:13 PM UTC

How's it running now?

3streamMusic

Post #43March 23, 2010, 5:41 PM UTC

A little sluggish. The CPU is no longer pegged, but programs seem to take a sec to open. I will continue to clean and use the Win Essentials for now.
What is your opinion of the StopZilla Spyware program. The offer a free Registry cleaner: http://www.zoombli.com/PrimaryLanding/samm…a%20Email%20aro

LDTate

Post #44March 29, 2010, 3:43 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Please Help! Virus that pegs the CPU at 100% and keeps

✨ Ask AI

Ask AI