What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Google redirect, AVE.exe, SVCHost leak (trifecta)

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I have tried a solve this based upon following the forum and running Combo-Fix and TDSS Killer, but my SVCHost memory leak is obviously trying over and over to reload AVE.EXE (fake security center) and the Google redirect .

I know I got this from being on the Pirate Bay's website (Flash attack) even trying Firefox to prevent a hijack (to no avail). So, I will surrender further Pirate Bay access (although I might keep my Bit Torrent since I vigorously virus scan the stuff).

At any rate, I can provide any log requested including multiple Combo-Fix's.

I tried the TDSS Killer and got this data:
"17:15:54:421 1036 TDSS rootkit removing tool [removed] Mar 22 2010 10:43:04
17:15:54:421 1036 ================================================================================
17:15:54:421 1036 SystemInfo:

17:15:54:421 1036 OS Version: 5.1.2600 ServicePack: 3.0
17:15:54:421 1036 Product type: Workstation
17:15:54:421 1036 ComputerName: BARROW
17:15:54:421 1036 UserName: Russ Barrow
17:15:54:421 1036 Windows directory: C:\WINDOWS
17:15:54:421 1036 Processor architecture: Intel x86
17:15:54:421 1036 Number of processors: 1
17:15:54:421 1036 Page size: 0x1000
17:15:54:421 1036 Boot type: Normal boot
17:15:54:421 1036 ================================================================================
17:15:54:437 1036 UnloadDriverW: NtUnloadDriver error 2
17:15:54:437 1036 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
17:15:54:437 1036 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
17:15:54:437 1036 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
17:15:54:437 1036 wfopen_ex: Trying to KLMD file open
17:15:54:437 1036 wfopen_ex: File opened ok (Flags 2)
17:15:54:437 1036 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
17:15:54:437 1036 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
17:15:54:437 1036 wfopen_ex: Trying to KLMD file open
17:15:54:437 1036 wfopen_ex: File opened ok (Flags 2)
17:15:54:437 1036 Initialize success
17:15:54:437 1036
17:15:54:437 1036 Scanning Services …
17:15:54:921 1036 Raw services enum returned 426 services
17:15:54:937 1036
17:15:54:937 1036 Scanning Kernel memory …
17:15:54:937 1036 Devices to scan: 7
17:15:54:937 1036
17:15:54:937 1036 Driver Name: Disk
17:15:54:937 1036 IRP_MJ_CREATE : F763DBB0
17:15:54:937 1036 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
17:15:54:937 1036 IRP_MJ_CLOSE : F763DBB0
17:15:54:937 1036 IRP_MJ_READ : F7637D1F
17:15:54:937 1036 IRP_MJ_WRITE : F7637D1F
17:15:54:937 1036 IRP_MJ_QUERY_INFORMATION : 804FA87E
17:15:54:937 1036 IRP_MJ_SET_INFORMATION : 804FA87E
17:15:54:937 1036 IRP_MJ_QUERY_EA : 804FA87E
17:15:54:937 1036 IRP_MJ_SET_EA : 804FA87E
17:15:54:937 1036 IRP_MJ_FLUSH_BUFFERS : F76382E2
17:15:54:937 1036 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
17:15:54:937 1036 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
17:15:54:937 1036 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
17:15:54:937 1036 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
17:15:54:937 1036 IRP_MJ_DEVICE_CONTROL : F76383BB
17:15:54:937 1036 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28
17:15:54:937 1036 IRP_MJ_SHUTDOWN : F76382E2
17:15:54:937 1036 IRP_MJ_LOCK_CONTROL : 804FA87E
17:15:54:937 1036 IRP_MJ_CLEANUP : 804FA87E
17:15:54:937 1036 IRP_MJ_CREATE_MAILSLOT : 804FA87E
17:15:54:937 1036 IRP_MJ_QUERY_SECURITY : 804FA87E
17:15:54:937 1036 IRP_MJ_SET_SECURITY : 804FA87E
17:15:54:937 1036 IRP_MJ_POWER : F7639C82
17:15:54:937 1036 IRP_MJ_SYSTEM_CONTROL : F763E99E
17:15:54:937 1036 IRP_MJ_DEVICE_CHANGE : 804FA87E
17:15:54:937 1036 IRP_MJ_QUERY_QUOTA : 804FA87E
17:15:54:937 1036 IRP_MJ_SET_QUOTA : 804FA87E
17:15:54:953 1036 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
17:15:54:953 1036
17:15:54:953 1036 Driver Name: USBSTOR
17:15:54:953 1036 IRP_MJ_CREATE : B1055218
17:15:54:953 1036 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
17:15:54:953 1036 IRP_MJ_CLOSE : B1055218
17:15:54:953 1036 IRP_MJ_READ : B105523C
17:15:54:953 1036 IRP_MJ_WRITE : B105523C
17:15:54:953 1036 IRP_MJ_QUERY_INFORMATION : 804FA87E
17:15:54:953 1036 IRP_MJ_SET_INFORMATION : 804FA87E
17:15:54:953 1036 IRP_MJ_QUERY_EA : 804FA87E
17:15:54:953 1036 IRP_MJ_SET_EA : 804FA87E
17:15:54:953 1036 IRP_MJ_FLUSH_BUFFERS : 804FA87E
17:15:54:953 1036 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
17:15:54:953 1036 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
17:15:54:953 1036 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
17:15:54:953 1036 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
17:15:54:953 1036 IRP_MJ_DEVICE_CONTROL : B1055180
17:15:54:953 1036 IRP_MJ_INTERNAL_DEVICE_CONTROL : B10509E6
17:15:54:953 1036 IRP_MJ_SHUTDOWN : 804FA87E
17:15:54:953 1036 IRP_MJ_LOCK_CONTROL : 804FA87E
17:15:54:953 1036 IRP_MJ_CLEANUP : 804FA87E
17:15:54:953 1036 IRP_MJ_CREATE_MAILSLOT : 804FA87E
17:15:54:953 1036 IRP_MJ_QUERY_SECURITY : 804FA87E
17:15:54:953 1036 IRP_MJ_SET_SECURITY : 804FA87E
17:15:54:953 1036 IRP_MJ_POWER : B10545F0
17:15:54:953 1036 IRP_MJ_SYSTEM_CONTROL : B1052A6E
17:15:54:953 1036 IRP_MJ_DEVICE_CHANGE : 804FA87E
17:15:54:953 1036 IRP_MJ_QUERY_QUOTA : 804FA87E
17:15:54:953 1036 IRP_MJ_SET_QUOTA : 804FA87E
17:15:54:968 1036 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
17:15:54:968 1036
17:15:54:968 1036 Driver Name: Disk
17:15:54:968 1036 IRP_MJ_CREATE : F763DBB0
17:15:54:968 1036 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
17:15:54:968 1036 IRP_MJ_CLOSE : F763DBB0
17:15:54:968 1036 IRP_MJ_READ : F7637D1F
17:15:54:968 1036 IRP_MJ_WRITE : F7637D1F
17:15:54:968 1036 IRP_MJ_QUERY_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_EA : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_EA : 804FA87E
17:15:54:968 1036 IRP_MJ_FLUSH_BUFFERS : F76382E2
17:15:54:968 1036 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_DEVICE_CONTROL : F76383BB
17:15:54:968 1036 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28
17:15:54:968 1036 IRP_MJ_SHUTDOWN : F76382E2
17:15:54:968 1036 IRP_MJ_LOCK_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_CLEANUP : 804FA87E
17:15:54:968 1036 IRP_MJ_CREATE_MAILSLOT : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_SECURITY : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_SECURITY : 804FA87E
17:15:54:968 1036 IRP_MJ_POWER : F7639C82
17:15:54:968 1036 IRP_MJ_SYSTEM_CONTROL : F763E99E
17:15:54:968 1036 IRP_MJ_DEVICE_CHANGE : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_QUOTA : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_QUOTA : 804FA87E
17:15:54:968 1036 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
17:15:54:968 1036
17:15:54:968 1036 Driver Name: Disk
17:15:54:968 1036 IRP_MJ_CREATE : F763DBB0
17:15:54:968 1036 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
17:15:54:968 1036 IRP_MJ_CLOSE : F763DBB0
17:15:54:968 1036 IRP_MJ_READ : F7637D1F
17:15:54:968 1036 IRP_MJ_WRITE : F7637D1F
17:15:54:968 1036 IRP_MJ_QUERY_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_EA : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_EA : 804FA87E
17:15:54:968 1036 IRP_MJ_FLUSH_BUFFERS : F76382E2
17:15:54:968 1036 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_DEVICE_CONTROL : F76383BB
17:15:54:968 1036 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28
17:15:54:968 1036 IRP_MJ_SHUTDOWN : F76382E2
17:15:54:968 1036 IRP_MJ_LOCK_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_CLEANUP : 804FA87E
17:15:54:968 1036 IRP_MJ_CREATE_MAILSLOT : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_SECURITY : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_SECURITY : 804FA87E
17:15:54:968 1036 IRP_MJ_POWER : F7639C82
17:15:54:968 1036 IRP_MJ_SYSTEM_CONTROL : F763E99E
17:15:54:968 1036 IRP_MJ_DEVICE_CHANGE : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_QUOTA : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_QUOTA : 804FA87E
17:15:54:968 1036 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
17:15:54:968 1036
17:15:54:968 1036 Driver Name: Disk
17:15:54:968 1036 IRP_MJ_CREATE : F763DBB0
17:15:54:968 1036 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
17:15:54:968 1036 IRP_MJ_CLOSE : F763DBB0
17:15:54:968 1036 IRP_MJ_READ : F7637D1F
17:15:54:968 1036 IRP_MJ_WRITE : F7637D1F
17:15:54:968 1036 IRP_MJ_QUERY_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_EA : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_EA : 804FA87E
17:15:54:968 1036 IRP_MJ_FLUSH_BUFFERS : F76382E2
17:15:54:968 1036 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_DEVICE_CONTROL : F76383BB
17:15:54:968 1036 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28
17:15:54:968 1036 IRP_MJ_SHUTDOWN : F76382E2
17:15:54:968 1036 IRP_MJ_LOCK_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_CLEANUP : 804FA87E
17:15:54:968 1036 IRP_MJ_CREATE_MAILSLOT : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_SECURITY : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_SECURITY : 804FA87E
17:15:54:968 1036 IRP_MJ_POWER : F7639C82
17:15:54:968 1036 IRP_MJ_SYSTEM_CONTROL : F763E99E
17:15:54:968 1036 IRP_MJ_DEVICE_CHANGE : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_QUOTA : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_QUOTA : 804FA87E
17:15:54:968 1036 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
17:15:54:968 1036
17:15:54:968 1036 Driver Name: atapi
17:15:54:968 1036 IRP_MJ_CREATE : F74CA6F2
17:15:54:968 1036 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
17:15:54:968 1036 IRP_MJ_CLOSE : F74CA6F2
17:15:54:968 1036 IRP_MJ_READ : 804FA87E
17:15:54:968 1036 IRP_MJ_WRITE : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_EA : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_EA : 804FA87E
17:15:54:968 1036 IRP_MJ_FLUSH_BUFFERS : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
17:15:54:968 1036 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_DEVICE_CONTROL : F74CA712
17:15:54:968 1036 IRP_MJ_INTERNAL_DEVICE_CONTROL : F74C6852
17:15:54:968 1036 IRP_MJ_SHUTDOWN : 804FA87E
17:15:54:968 1036 IRP_MJ_LOCK_CONTROL : 804FA87E
17:15:54:968 1036 IRP_MJ_CLEANUP : 804FA87E
17:15:54:968 1036 IRP_MJ_CREATE_MAILSLOT : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_SECURITY : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_SECURITY : 804FA87E
17:15:54:968 1036 IRP_MJ_POWER : F74CA73C
17:15:54:968 1036 IRP_MJ_SYSTEM_CONTROL : F74D1336
17:15:54:968 1036 IRP_MJ_DEVICE_CHANGE : 804FA87E
17:15:54:968 1036 IRP_MJ_QUERY_QUOTA : 804FA87E
17:15:54:968 1036 IRP_MJ_SET_QUOTA : 804FA87E
17:15:54:968 1036 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1
17:15:54:968 1036
17:15:54:968 1036 Driver Name: atapi
17:15:54:968 1036 IRP_MJ_CREATE : 8AB20CA1
17:15:54:968 1036 IRP_MJ_CREATE_NAMED_PIPE : 8AB20CA1
17:15:54:968 1036 IRP_MJ_CLOSE : 8AB20CA1
17:15:54:968 1036 IRP_MJ_READ : 8AB20CA1
17:15:54:968 1036 IRP_MJ_WRITE : 8AB20CA1
17:15:54:968 1036 IRP_MJ_QUERY_INFORMATION : 8AB20CA1
17:15:54:968 1036 IRP_MJ_SET_INFORMATION : 8AB20CA1
17:15:54:968 1036 IRP_MJ_QUERY_EA : 8AB20CA1
17:15:54:968 1036 IRP_MJ_SET_EA : 8AB20CA1
17:15:54:968 1036 IRP_MJ_FLUSH_BUFFERS : 8AB20CA1
17:15:54:968 1036 IRP_MJ_QUERY_VOLUME_INFORMATION : 8AB20CA1
17:15:54:968 1036 IRP_MJ_SET_VOLUME_INFORMATION : 8AB20CA1
17:15:54:968 1036 IRP_MJ_DIRECTORY_CONTROL : 8AB20CA1
17:15:54:968 1036 IRP_MJ_FILE_SYSTEM_CONTROL : 8AB20CA1
17:15:54:968 1036 IRP_MJ_DEVICE_CONTROL : 8AB20CA1
17:15:54:968 1036 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8AB20CA1
17:15:54:968 1036 IRP_MJ_SHUTDOWN : 8AB20CA1
17:15:54:968 1036 IRP_MJ_LOCK_CONTROL : 8AB20CA1
17:15:54:968 1036 IRP_MJ_CLEANUP : 8AB20CA1
17:15:54:968 1036 IRP_MJ_CREATE_MAILSLOT : 8AB20CA1
17:15:54:968 1036 IRP_MJ_QUERY_SECURITY : 8AB20CA1
17:15:54:968 1036 IRP_MJ_SET_SECURITY : 8AB20CA1
17:15:54:968 1036 IRP_MJ_POWER : 8AB20CA1
17:15:54:968 1036 IRP_MJ_SYSTEM_CONTROL : 8AB20CA1
17:15:54:968 1036 IRP_MJ_DEVICE_CHANGE : 8AB20CA1
17:15:54:968 1036 IRP_MJ_QUERY_QUOTA : 8AB20CA1
17:15:54:968 1036 IRP_MJ_SET_QUOTA : 8AB20CA1
17:15:54:968 1036 Driver "atapi" infected by TDSS rootkit!
17:15:54:984 1036 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1
17:15:54:984 1036 File "C:\WINDOWS\system32\DRIVERS\atapi.sys" infected by TDSS rootkit … 17:15:54:984 1036 Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
17:15:54:984 1036 ProcessDirEnumEx: FindFirstFile(C:\WINDOWS\system32\DriverStore\FileRepository\*) error 3
17:15:55:187 1036 vfvi6
17:15:55:265 1036 !dsvbh1
17:15:55:343 1036 !vdf7
17:15:55:343 1036 !cbck3
17:15:55:343 1036 ProcessDirEnumEx: FindFirstFile(C:\WINDOWS\OemDir\*) error 3
17:15:55:343 1036 vfvi6
17:15:55:343 1036 !dsvbh1
17:15:55:343 1036 !vdf7
17:15:55:343 1036 !fck2
17:15:55:359 1036 !fdfb7
17:15:55:359 1036 vfvi6
17:15:55:359 1036 !dsvbh1
17:15:55:359 1036 !vdf7
17:15:55:359 1036 Backup copy not found, trying to cure infected file..
17:15:55:359 1036 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Cure failed (0)
17:15:55:359 1036 cure failed
17:15:55:359 1036
17:15:55:359 1036 Completed
17:15:55:359 1036
17:15:55:359 1036 Results:
17:15:55:359 1036 Memory objects infected / cured / cured on reboot: 1 / 0 / 0
17:15:55:359 1036 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
17:15:55:359 1036 File objects infected / cured / cured on reboot: 1 / 0 / 0
17:15:55:359 1036
17:15:55:359 1036 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
17:15:55:359 1036 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
17:15:55:359 1036 KLMD(ARK) unloaded successfully


Here is the latest Combo Fix Log:

ComboFix 10-03-25.02 - Russ Barrow 03/25/2010 16:56:46.25.1 - x86
Running from: g:\new os\Tools\Combo-Fix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Local Settings\Application Data\ave.exe
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Files Created from 2010-02-25 to 2010-03-25 )))))))))))))))))))))))))))))))
.

2010-03-24 20:57 . 2010-03-25 22:07 ——– d—–w- c:\temp\ProcessExplorer
2010-03-18 00:42 . 2010-03-18 00:42 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-03-18 00:42 . 2010-03-18 00:42 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Apple Computer
2010-03-18 00:40 . 2010-03-18 00:41 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-03-17 02:35 . 2010-03-17 02:35 ——– d—–w- c:\documents and settings\LocalService\Application Data\AdobeUM
2010-02-25 20:14 . 2010-03-18 04:20 ——– d—–w- c:\documents and settings\Russ Barrow\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-25 22:53 . 2008-03-19 01:55 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\DNA
2010-03-25 22:43 . 2008-03-19 01:55 ——– d—–w- c:\program files\DNA
2010-03-25 17:03 . 2009-06-28 03:36 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-24 22:08 . 2007-11-14 02:56 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\BitTorrent
2010-03-24 17:30 . 2008-07-01 17:38 ——– d—–w- c:\documents and settings\Russ Barrow\Application Data\vlc
2010-03-22 22:49 . 2009-12-09 02:14 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-03-18 16:54 . 2002-08-29 07:27 96512 ——w- c:\windows\system32\drivers\atapi.sys
2010-02-24 16:16 . 2009-10-23 23:20 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-19 23:47 . 2010-02-19 23:47 3604480 —-a-w- c:\windows\system32\GPhotos.scr
2010-02-10 01:09 . 2003-12-01 02:46 ——– d—–w- c:\program files\Google
2010-01-06 20:37 . 2009-11-11 16:16 90112 —-a-w- c:\windows\DUMP6496.tmp
2009-08-17 01:00 . 2009-08-17 01:00 1376973 —-a-w- c:\program files\bit_che_1_0_60.exe
2009-08-17 00:55 . 2009-08-17 00:55 1376973 —-a-w- c:\program files\down.php
2009-08-13 01:48 . 2009-08-10 01:38 3942048 —-a-w- c:\program files\mbam-setup.exe
2009-08-08 21:02 . 2009-08-08 21:02 791393 —-a-w- c:\program files\erunt-setup.exe
2009-08-08 20:41 . 2009-08-08 16:37 724952 —-a-w- c:\program files\avenger.zip
2009-07-28 00:48 . 2009-07-28 00:48 354396 —-a-w- c:\program files\SysProt.zip
2009-07-27 00:04 . 2009-07-27 00:04 4626422 —-a-w- c:\program files\avz4.zip
2009-07-25 17:00 . 2009-07-25 17:00 50688 —-a-w- c:\program files\ATF_Cleaner.exe
2009-07-25 16:52 . 2009-07-25 16:52 1826038 —-a-w- c:\program files\SmitfraudFix.zip
2009-07-25 01:04 . 2009-07-25 01:04 92672 —-a-w- c:\program files\KillBox.exe
2009-06-29 23:31 . 2009-06-29 23:44 1868904 —-a-w- c:\program files\disk-defrag-setup.exe
2009-06-29 23:29 . 2009-06-29 23:44 265216 —-a-w- c:\program files\TFC.exe
2009-06-28 02:58 . 2009-06-28 01:13 11314 —-a-w- c:\program files\hijackthis.log
2009-06-28 01:10 . 2009-06-28 01:13 218112 —-a-w- c:\program files\HijackThis.exe
2009-06-27 21:26 . 2009-06-27 21:31 2327856 —-a-w- c:\program files\speedupmypc3plc.exe
2004-06-23 18:55 . 2004-09-11 01:47 20480 —-a-w- c:\program files\ProcManager.exe
2002-07-26 23:02 . 2008-01-05 01:58 153088 —-a-w- c:\program files\UNWISE.EXE
.

——- Sigcheck ——-

[-] 2010-03-18 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DRIVERS\atapi.sys
[-] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

[-] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\asyncmac.sys
[-] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DRIVERS\asyncmac.sys
[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\asyncmac.sys

[-] 2002-08-29 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\SYSTEM32\DRIVERS\BEEP.SYS

[-] 2008-04-14 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kbdclass.sys
[-] 2008-04-14 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DRIVERS\kbdclass.sys
[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\kbdclass.sys

[-] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DRIVERS\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys

[-] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DRIVERS\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ntfs.sys

[-] 2002-08-29 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\SYSTEM32\DRIVERS\NULL.SYS

[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\SYSTEM32\DLLCACHE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\SYSTEM32\DRIVERS\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys

[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\browser.dll
[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\browser.dll
[-] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\browser.dll

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lsass.exe
[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\lsass.exe
[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lsass.exe

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll
[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\netman.dll
[-] 2005-08-22 . 36739B39267914BA69AD0610A0299732 . 197632 . . [5.1.2600.2743] . . c:\windows\$NtServicePackUninstall$\netman.dll

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\ServicePackFiles\i386\qmgr.dll
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\SYSTEM32\qmgr.dll
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\SYSTEM32\bits\qmgr.dll
[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\$NtServicePackUninstall$\qmgr.dll

[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\winlogon.exe
[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\SYSTEM32\comctl32.dll
[-] 2006-08-25 . B0124CB21D28B1C9F678B566B6B57D92 . 617472 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\cryptsvc.dll
[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\cryptsvc.dll
[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\cryptsvc.dll

[-] 2008-07-07 20:32 . 60D1A6342238378BFB7545C81EE3606C . 253952 . . [2001.12.4414.320] . . c:\windows\$NtServicePackUninstall$\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\SYSTEM32\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\SYSTEM32\DLLCACHE\es.dll
[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
[-] 2008-07-07 20:06 . A4AB3DCA4A383F0DF4988ABDEB84F9A4 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll
[-] 2008-04-14 11:41 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\$NtUninstallKB950974$\es.dll
[-] 2008-04-14 11:41 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\ServicePackFiles\i386\es.dll
[-] 2005-07-26 04:39 . 34BBD9ACC1538818F2C878898C64E793 . 243200 . . [2001.12.4414.308] . . c:\windows\$NtUninstallKB950974_0$\es.dll

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\imm32.dll
[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\imm32.dll
[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\imm32.dll

[-] 2009-03-21 . B6ACAED7588295129791E0E6A2B0FADE . 986112 . . [5.1.2600.3541] . . c:\windows\$NtServicePackUninstall$\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3GDR\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\SYSTEM32\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\SYSTEM32\DLLCACHE\kernel32.dll
[-] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2009-03-21 . 80202858D245FF07DAA1739C57A3E19B . 989184 . . [5.1.2600.3541] . . c:\windows\$hf_mig$\KB959426\SP2QFE\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kernel32.dll
[-] 2006-07-05 . D8DB5397DE07577C1CB50BA6D23B3AD4 . 984064 . . [5.1.2600.2945] . . c:\windows\$NtUninstallKB959426_0$\kernel32.dll

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll
[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\linkinfo.dll
[-] 2005-09-01 . A1A688EE56CF3BBD24EDEB815D48E9BA . 19968 . . [5.1.2600.2751] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lpk.dll
[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\lpk.dll
[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lpk.dll

[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\ServicePackFiles\i386\msvcrt.dll
[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\SYSTEM32\msvcrt.dll
[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\$NtServicePackUninstall$\msvcrt.dll

[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\SYSTEM32\mswsock.dll
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\SYSTEM32\DLLCACHE\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . 1DFCA7713EA5A70D5D93B436AEA0317A . 245248 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\mswsock.dll
[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748_0$\mswsock.dll

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netlogon.dll
[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\netlogon.dll
[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netlogon.dll

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\SYSTEM32\powrprof.dll
[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\powrprof.dll

[-] 2009-08-13 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\SYSTEM32\scecli.dll
[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\scecli.dll
[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\scecli.dll

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfc.dll
[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\sfc.dll
[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfc.dll

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\svchost.exe
[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\svchost.exe
[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DLLCACHE\svchost.exe
[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\svchost.exe

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll
[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\tapisrv.dll
[-] 2005-07-08 . FB78839B36025AA286A51289ED28B73E . 249344 . . [5.1.2600.2716] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\user32.dll
[-] 2007-03-08 . 7AA4F6C00405DFC4B70ED4214E7D687B . 578048 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 . B409909F6E2E8A7067076ED748ABF1E7 . 577536 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2005-03-02 . DE2DB164BBB35DB061AF0997E4499054 . 577024 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\userinit.exe
[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\userinit.exe

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2_32.dll
[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\ws2_32.dll
[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2_32.dll

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll
[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\srsvc.dll
[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\wscntfy.exe
[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\xmlprov.dll
[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\xmlprov.dll
[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\xmlprov.dll

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfcfiles.dll
[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\sfcfiles.dll
[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DLLCACHE\sfcfiles.dll
[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfcfiles.dll

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\ctfmon.exe
[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\SYSTEM32\shsvcs.dll
[-] 2006-12-19 . 6815DEF9B810AEFAC107EEAF72DA6F82 . 134656 . . [6.00.2900.3051] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
[-] 2006-12-19 . 53D9184A21C5CBF600D918E51EF3A7E5 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll
[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\regsvc.dll
[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\schedsvc.dll
[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\schedsvc.dll
[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\schedsvc.dll

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ssdpsrv.dll
[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\ssdpsrv.dll
[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ssdpsrv.dll

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\termsrv.dll
[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\termsrv.dll
[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\termsrv.dll

[-] 2009-08-13 . 9C3C12975C97119412802B181FBEEFFE . 167936 . . [5.1.2600.2180] . . c:\windows\SYSTEM32\appmgmts.dll

[-] 2002-08-29 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\SYSTEM32\DRIVERS\ACPIEC.SYS

[-] 2008-04-14 04:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
[-] 2008-04-14 04:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SYSTEM32\DRIVERS\aec.sys
[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$NtServicePackUninstall$\aec.sys

[-] 2008-04-14 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\agp440.sys
[-] 2008-04-14 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DRIVERS\agp440.sys
[-] 2004-08-04 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\agp440.sys
[-] 2004-08-04 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\SYSTEM32\ReinstallBackups\0008\DriverFiles\i386\AGP440.SYS

[-] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ip6fw.sys
[-] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DRIVERS\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ip6fw.sys

[-] 2008-04-14 . F08D74EC300B8BA60CA953C58A24D19E . 35328 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\iprip.dll
[-] 2008-04-14 . F08D74EC300B8BA60CA953C58A24D19E . 35328 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\iprip.dll
[-] 2008-04-14 . F08D74EC300B8BA60CA953C58A24D19E . 35328 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\DLLCACHE\iprip.dll

[-] 2008-04-14 11:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll
[-] 2008-04-14 11:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\SYSTEM32\mfc40u.dll
[-] 2006-11-01 19:17 . 925F8B61ED301A317BA850EBEECBDAA0 . 927504 . . [4.1.0.61] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll
[-] 2002-08-29 11:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\$NtUninstallKB924667$\mfc40u.dll

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msgsvc.dll
[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\msgsvc.dll
[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msgsvc.dll

[-] 2006-10-19 03:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\SYSTEM32\mspmsnsv.dll
[-] 2006-10-19 03:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\SYSTEM32\DLLCACHE\mspmsnsv.dll
[-] 2004-09-22 23:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-04 04:56 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll

[-] 2008-04-14 11:42 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\ServicePackFiles\i386\ntmssvc.dll
[-] 2008-04-14 11:42 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\SYSTEM32\ntmssvc.dll
[-] 2004-08-04 04:56 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\$NtServicePackUninstall$\ntmssvc.dll

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\upnphost.dll
[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\upnphost.dll
[-] 2007-02-05 . 36ACA6CDC19C95FF468A1426EB7F32F0 . 185344 . . [5.1.2600.3077] . . c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll
[-] 2007-02-05 . ACA5D98663D879C6BAAFCEA7E2F1B710 . 185344 . . [5.1.2600.3077] . . c:\windows\$NtServicePackUninstall$\upnphost.dll
[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB931261$\upnphost.dll
.
((((((((((((((((((((((((((((( SnapShot_2010-03-20_20.53.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-25 22:54 . 2010-03-25 22:54 16384 c:\windows\temp\Perflib_Perfdata_294.dat
+ 2003-03-27 16:13 . 2010-03-25 22:58 67370 c:\windows\SYSTEM32\PERFC009.DAT
- 2003-03-27 16:13 . 2010-03-20 20:43 67370 c:\windows\SYSTEM32\PERFC009.DAT
+ 2003-03-31 23:35 . 2010-03-22 21:43 81400 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
+ 2003-03-27 16:13 . 2010-03-25 22:58 432796 c:\windows\SYSTEM32\PERFH009.DAT
- 2003-03-27 16:13 . 2010-03-20 20:43 432796 c:\windows\SYSTEM32\PERFH009.DAT
+ 2009-08-07 01:23 . 2009-08-07 01:23 215904 c:\windows\SYSTEM32\muweb.dll
+ 2010-03-25 22:43 . 2010-03-25 22:43 245760 c:\windows\ERDNT\AutoBackup\3-25-2010\Users\00000002\UsrClass.dat
+ 2010-03-25 22:43 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\3-25-2010\ERDNT.EXE
+ 2010-03-24 18:54 . 2010-03-24 18:54 241664 c:\windows\ERDNT\AutoBackup\3-24-2010\Users\00000002\UsrClass.dat
+ 2010-03-24 18:55 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\3-24-2010\ERDNT.EXE
+ 2010-03-21 18:01 . 2010-03-21 18:01 241664 c:\windows\ERDNT\AutoBackup\3-21-2010\Users\00000002\UsrClass.dat
+ 2010-03-21 18:01 . 2005-10-20 18:02 163328 c:\windows\ERDNT\AutoBackup\3-21-2010\ERDNT.EXE
+ 2010-03-25 22:43 . 2010-03-25 22:43 17981440 c:\windows\ERDNT\AutoBackup\3-25-2010\Users\00000001\ntuser.dat
+ 2010-03-24 18:54 . 2010-03-24 18:54 17952768 c:\windows\ERDNT\AutoBackup\3-24-2010\Users\00000001\ntuser.dat
+ 2010-03-21 18:01 . 2010-03-21 18:01 17956864 c:\windows\ERDNT\AutoBackup\3-21-2010\Users\00000001\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 —-a-w- c:\documents and settings\Russ Barrow\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 —-a-w- c:\documents and settings\Russ Barrow\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 —-a-w- c:\documents and settings\Russ Barrow\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-24 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-27 1998064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"CgaViewer"="c:\progra~1\CYBERG~1\cgav.exe" [2005-04-14 81976]
"CgaHelper"="c:\progra~1\CYBERG~1\cgahelp.exe" [2005-04-14 90174]
"SoftPerfect Personal Firewall"="c:\program files\SoftPerfect Personal Firewall\fw.exe" [2008-08-02 1083904]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Russ Barrow\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
F1U201.401.lnk - c:\program files\Belkin\F1U201.401\usbshare.exe [2008-5-5 135168]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 21:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe [x]
R3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [2007-09-18 109080]
R3 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1000000.07D\BHDrvx86.sys [2009-12-09 254512]
R3 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1000000.07D\ccHPx86.sys [2009-12-09 362544]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-12-09 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20080826.006\IDSxpx86.sys [2009-12-09 274808]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-10-13 7408]
R3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\DRIVERS\swnc8u56.sys [2007-06-27 101248]
R3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\DRIVERS\swumx56.sys [2007-06-27 73856]
R3 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1000000.07D\SYMEFA.SYS [2009-12-09 309296]
R4 DistRestart;DistRestart;c:\windows\srvany.exe [x]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\dddsk.sys [2009-02-12 22312]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-10-13 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-10-13 74480]
S2 CGAgent;CyberGatekeeper Agent;c:\progra~1\CYBERG~1\cgasvc.exe [2005-04-14 73788]
S2 ndserv;ndserv;c:\program files\netDeploy\Launcher\ndserv.exe [2000-10-24 859648]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-04 13592]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder

2010-03-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2010-03-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 01:09]

2010-03-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 01:09]

2010-03-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
mWindow Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
uInternet Settings,ProxyServer = ftp=wwwgate.ti.com:80;gopher=wwwgate.ti.com:80;http=wwwgate.ti.com:80;https=wwwg
ate.ti.com:81;socks=wwwgate.ti.com:80
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: bmnet.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {4B48D5DF-9021-45F7-A240-60304302A215}
FF - ProfilePath - c:\documents and settings\Russ Barrow\Application Data\Mozilla\Firefox\Profiles\idgvrok3.default\
FF - prefs.js: browser.startup.homepage - hxxp://thepiratebay.org/top
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-25 17:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x8AB20CA1]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74c6852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8
ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8
ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-541624744-611074163-757372905-1006\Software\Microsoft\Driver Signing]
@Denied: (2) (Administrators)
@Allowed: (2) (Administrators)
"Policy"=dword:00000000

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl]
@DACL=(02 0000)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1012)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\documents and settings\Russ Barrow\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

- - - - - - - > 'lsass.exe'(1080)
c:\windows\system32\WININET.dll
.
Completion time: 2010-03-25 17:14:38
ComboFix-quarantined-files.txt 2010-03-25 23:14
ComboFix2.txt 2010-03-25 19:06
ComboFix3.txt 2010-03-25 16:36
ComboFix4.txt 2010-03-22 22:38
ComboFix5.txt 2010-03-25 22:50

Pre-Run: 15,385,243,648 bytes free
Post-Run: 15,352,139,776 bytes free

- - End Of File - - 05A8DF18812D7266DAAA1651BBE9390D


Thanks for the Help,

Russ

Here is my HJT log (note, this is after a Combo Fix, so some processes are not running):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:36:53 PM, on 3/25/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bmwebcfg.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\CYBERG~1\cgasvc.exe
C:\PROGRA~1\CYBERG~1\cgagent.exe
c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\Hummbird\inetd32.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\netDeploy\Launcher\ndserv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=wwwgate.ti.com:80;gopher=wwwgate.ti.com:80;http=wwwgate.ti.com:80;https=wwwg
ate.ti.com:81;socks=wwwgate.ti.com:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CgaViewer] C:\PROGRA~1\CYBERG~1\cgav.exe -check
O4 - HKLM\..\Run: [CgaHelper] C:\PROGRA~1\CYBERG~1\cgahelp.exe -check
O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] "C:\Program Files\SoftPerfect Personal Firewall\fw.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-541624744-611074163-757372905-1006\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" (User '?')
O4 - HKUS\S-1-5-21-541624744-611074163-757372905-1006\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-21-541624744-611074163-757372905-1006\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User '?')
O4 - HKUS\S-1-5-21-541624744-611074163-757372905-1006\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User '?')
O4 - HKUS\S-1-5-21-541624744-611074163-757372905-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User '?')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-21-541624744-611074163-757372905-1006 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User '?')
O4 - S-1-5-18 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User '?')
O4 - .DEFAULT Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: F1U201.401.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} -
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1269532222531
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} -
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} -
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} -
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ent.ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ent.ti.com
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: SearchList = ent.ti.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ent.ti.com
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AT&T RcAppSvc (ATTRcAppSvc) - PCTEL - C:\Program Files\AT&T\Communication Manager\RcAppSvc.exe
O23 - Service: Bytemobile Web Configurator (bmwebcfg) - Bytemobile, Inc. - C:\WINDOWS\system32\bmwebcfg.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberGatekeeper Agent (CGAgent) - InfoExpress - C:\PROGRA~1\CYBERG~1\cgasvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Unknown owner - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hummingbird Inetd (HCLInetd) - Hummingbird Communications Ltd. - C:\WINDOWS\System32\Hummbird\inetd32.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ndserv - Open Software Associates Ltd. - C:\Program Files\netDeploy\Launcher\ndserv.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton AntiVirus - Unknown owner - C:\Program Files\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Unknown owner - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)

–
End of file - 10751 bytes
Post #2
Please download HelpAsst_mebroot_fix.exe and save it to your desktop.
Close out all other open programs and windows.
Double click the file to run it and follow any prompts.
If the tool detects an mbr infection, please allow it to run mbr -f and shutdown your computer.
Upon restarting, please wait about 5 minutes, click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !
When it completes, a log will open.
Please post the contents of that log.


*In the event the tool does not detect an mbr infection and completes, click Start>Run and type the following bolded command, then hit Enter.

mbr -f

Now, please do the Start>Run>mbr -f command a second time.
Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up.
Give it about 5 minutes, then click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !
When it completes, a log will open.
Please post the contents of that log.

**Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI