[Resolved] Browers Hijacked, Anti-Spyware Updating Blocked

Wife's Dell Mini has become infected via a link sent to her on FB. McAfee noted the changes and quaranteed some items. Her school tech person recommended MalwareBytes Anti-Malware, which found 12 infections and removed some items, but access to anti-spyware updating is blocked (had to download Hijackthis! on another computer, can't update Spybot S&D, etc) and redirected to a variety of sites, like www.juggle.com or stopzilla.com

Here is the HijackThis! log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:45 PM, on 4/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\rpcnet.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\OA012Mon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\WSED\WSED.exe
C:\Program Files\Battery Meter\BTMeter.exe
C:\Program Files\CapsLKNotify\CapsLKNotify.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\TiVo\Desktop\Plus\TranscodingService.exe
C:\Program Files\TiVo\Desktop\TiVoServer.exe
C:\Program Files\TiVo\Desktop\TiVoTransfer.exe
C:\Program Files\TiVo\Desktop\TiVoNotify.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://m.www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [OA012Mon] C:\WINDOWS\OA012Mon.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [WSED] C:\Program Files\WSED\WSED.exe
O4 - HKLM\..\Run: [BTMeter] C:\Program Files\Battery Meter\BTMeter.exe
O4 - HKLM\..\Run: [CapsLKNotify] C:\Program Files\CapsLKNotify\CapsLKNotify.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TranscodingService] C:\Program Files\TiVo\Desktop\Plus\\TranscodingService.exe
O4 - HKCU\..\Run: [TivoServer] C:\Program Files\TiVo\Desktop\TiVoServer.exe /service /registry /auto:TivoServer
O4 - HKCU\..\Run: [TivoTransfer] C:\Program Files\TiVo\Desktop\TiVoTransfer.exe
O4 - HKCU\..\Run: [TivoNotify] C:\Program Files\TiVo\Desktop\TiVoNotify.exe /service /registry /auto:TivoNotify
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1260540103718
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 11286 bytes





Any direction greatly appreciated.

[external image: Posted Image]


DO NOT use any TOOLS such as Combofix, MBAM, SmitfraudFix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.


If need be, download the tools needed to a flash drive or other removable media, and run them from the USB device.


Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.



Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download Combofix from any of the links below but rename it to ABCD.exe before saving it to your desktop.

Link 1
Link 2 If using this link, Right Click and select Save As.


Double click on the ABCD.exe ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt so we can continue cleaning the system.

**Note: If Combofix (ABCD) won't run from the desktop, try running it from the USB device.


——————————————————————–

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.


Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

Note: If you have SP3, use the SP2 package. Vista and Windows 7 users skip this part


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

[external image: Posted Image]

• Drag the setup package onto ComboFix.exe and drop it.
  
  
• Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  
  
  [external image: Posted Image]
  
  
  
• At the next prompt, click 'Yes' to run the full ComboFix scan.
  
  
• When the tool is finished, it will produce a report for you.

Please post the C:\ComboFix.txt in your next reply using Copy/Paste.


Notes:

Give it atleast 20-30 minutes to finish if needed.

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Also please describe how your computer behaves in your next reply.

Computer is now behaving normally. Browers are not being hijacked. Here is the Combofix log: ComboFix 10-04-10.02 - Pamela 04/11/2010 17:08:00.1.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.334 [GMT -4:00] Running from: c:\documents and settings\[removed]\Desktop\ABCD.exe AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\LogMeInRemoteUser\Application Data\install.dat c:\documents and settings\Pamela\Application Data\install.dat c:\program files\webserver c:\windows\system32\config\system~1\applic~1\install.dat c:\windows\system32\config\systemprofile\Application Data\install.dat . ((((((((((((((((((((((((( Files Created from 2010-03-11 to 2010-04-11 ))))))))))))))))))))))))))))))) . 2010-04-11 07:46 . 2010-04-11 07:46 ——– d—–w- c:\windows\system32\wbem\Repository 2010-04-11 02:34 . 2010-04-11 02:34 ——– d—–w- c:\program files\Trend Micro 2010-04-10 01:04 . 2010-01-25 15:58 462848 —-a-w- c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\[removed]\plugins\ractrlkeyhook.dll 2010-04-10 01:04 . 2010-01-15 18:25 864256 —-a-w- c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\[removed]\plugins\LMIGuardianDll.dll 2010-04-10 01:04 . 2010-01-15 18:25 315392 —-a-w- c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\[removed]\plugins\LMIGuardianEvt.dll 2010-04-10 01:04 . 2010-01-15 18:25 372736 —-a-w- c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\[removed]\plugins\LMIGuardian.exe 2010-04-10 01:04 . 2010-03-03 21:16 3862528 —-a-w- c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\[removed]\plugins\npRACtrl.dll 2010-04-10 01:04 . 2010-01-15 18:26 70984 —-a-w- c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\[removed]\plugins\LMIProxyHelper.exe 2010-04-04 22:00 . 2010-04-04 22:00 ——– d—–w- c:\program files\Common Files\Java 2010-04-04 21:55 . 2010-04-04 21:55 79488 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\jre1.6.0_19\gtapi.dll 2010-04-04 21:55 . 2010-04-04 21:55 152576 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\jre1.6.0_19\lzma.dll 2010-04-04 21:49 . 2010-04-04 21:49 ——– d—–w- c:\program files\iPod 2010-04-04 21:49 . 2010-04-04 21:51 ——– d—–w- c:\program files\iTunes 2010-04-04 21:49 . 2010-04-04 21:51 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} 2010-04-04 21:43 . 2010-04-04 21:45 ——– d—–w- c:\program files\QuickTime 2010-04-04 21:39 . 2010-04-04 21:40 ——– d—–w- c:\program files\Apple Software Update 2010-04-04 21:33 . 2010-04-04 21:33 ——– d—–w- c:\program files\Bonjour 2010-03-27 22:48 . 2010-03-27 22:48 ——– d—–w- c:\program files\Secunia 2010-03-26 05:48 . 2010-03-26 05:48 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-11 18:46 . 2009-12-11 18:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-04-11 16:10 . 2009-12-13 09:05 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-04-11 16:02 . 2009-12-11 18:55 ——– d—–w- c:\program files\SpywareBlaster 2010-04-11 07:48 . 2009-12-13 17:08 17408 —-a-w- c:\windows\system32\rpcnetp.exe 2010-04-11 07:47 . 2009-12-11 11:50 56680 —-a-w- c:\windows\system32\rpcnet.dll 2010-04-11 07:45 . 2009-12-11 15:44 ——– d—–w- c:\program files\LogMeIn 2010-04-08 21:46 . 2009-12-01 03:50 ——– d—–w- c:\program files\McAfee 2010-04-07 21:26 . 2009-12-01 03:50 ——– d—–w- c:\program files\Microsoft Silverlight 2010-04-06 12:56 . 2009-12-11 15:37 ——– d—–w- c:\program files\Defraggler 2010-04-05 02:44 . 2009-12-11 17:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-04-04 22:10 . 2009-12-11 14:40 ——– d—–w- c:\program files\CCleaner 2010-04-04 21:58 . 2009-12-01 03:35 411368 —-a-w- c:\windows\system32\deploytk.dll 2010-04-04 21:49 . 2009-12-11 18:52 ——– d—–w- c:\program files\Common Files\Apple 2010-04-03 13:22 . 2009-12-11 18:32 ——– d—–w- c:\program files\Spybot - Search & Destroy 2010-03-29 19:24 . 2009-12-11 17:42 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-29 19:24 . 2009-12-11 17:42 20824 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-03-10 08:07 . 2010-01-05 12:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-03-08 14:41 . 2009-12-01 05:06 220112 —-a-w- c:\windows\system32\drivers\Rtenicxp.sys 2010-03-05 15:39 . 2009-12-13 17:08 17408 —-a-w- c:\windows\system32\rpcnetp.dll 2010-02-28 21:53 . 2010-02-28 21:53 ——– d—–w- c:\program files\BrownTech 2010-02-27 21:25 . 2009-12-27 11:30 ——– d—–w- c:\program files\Common Files\Adobe AIR 2010-02-27 21:24 . 2009-12-11 13:32 38784 —-a-w- c:\documents and settings\Pamela\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-02-27 21:08 . 2010-01-21 12:26 ——– d—–w- c:\program files\Common Files\Adobe 2010-02-27 19:58 . 2009-12-11 13:38 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS 2010-02-27 19:54 . 2010-02-27 19:53 15849560 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\selfextractor_air_1.5.3.exe 2010-02-27 19:53 . 2010-02-27 19:53 86016 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe 2010-02-25 06:24 . 2008-04-25 20:33 916480 —-a-w- c:\windows\system32\wininet.dll 2010-02-24 14:16 . 2009-12-11 16:54 181632 ——w- c:\windows\system32\MpSigStub.exe 2010-02-18 17:33 . 2009-12-11 03:21 75832 —-a-w- c:\documents and settings\Pamela\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-18 00:58 . 2010-01-14 00:09 664 —-a-w- c:\windows\system32\d3d9caps.dat 2010-02-13 14:37 . 2010-02-13 14:37 ——– d—–w- c:\program files\JRE 2010-02-13 14:37 . 2009-12-11 13:09 ——– d—–w- c:\program files\OpenOffice.org 3 2010-02-12 15:46 . 2010-02-12 15:46 91424 —-a-w- c:\windows\system32\dnssd.dll 2010-02-12 15:46 . 2010-02-12 15:46 107808 —-a-w- c:\windows\system32\dns-sd.exe 2010-02-10 01:41 . 2009-12-11 11:50 56680 —-a-w- c:\windows\system32\rpcnet.exe 2010-02-04 23:46 . 2010-02-16 17:27 52224 —-a-w- c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll 2010-02-04 23:46 . 2010-02-16 17:27 101376 —-a-w- c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll 2010-01-29 01:43 . 2010-01-29 01:43 1 —-a-w- c:\documents and settings\Pamela\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-01-25 11:29 . 2010-01-25 11:29 503808 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1a7dcb81-n\msvcp71.dll 2010-01-25 11:29 . 2010-01-25 11:29 348160 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1a7dcb81-n\msvcr71.dll 2010-01-25 11:29 . 2010-01-25 11:29 499712 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1a7dcb81-n\jmc.dll 2010-01-25 11:29 . 2010-01-25 11:29 61440 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74a535ce-n\decora-sse.dll 2010-01-25 11:29 . 2010-01-25 11:29 12800 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-74a535ce-n\decora-d3d.dll 2010-01-21 12:50 . 2010-01-21 12:50 61440 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-62a5078b-n\decora-sse.dll 2010-01-21 12:50 . 2010-01-21 12:50 503808 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-62a5078b-n\msvcp71.dll 2010-01-21 12:50 . 2010-01-21 12:50 499712 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-62a5078b-n\jmc.dll 2010-01-21 12:50 . 2010-01-21 12:50 348160 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-62a5078b-n\msvcr71.dll 2010-01-21 12:50 . 2010-01-21 12:50 12800 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-62a5078b-n\decora-d3d.dll 2010-01-21 12:50 . 2010-01-21 12:50 315392 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-701ac211-n\jogl.dll 2010-01-21 12:50 . 2010-01-21 12:50 20480 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-701ac211-n\jogl_awt.dll 2010-01-21 12:50 . 2010-01-21 12:50 20480 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-6f4453ef-n\gluegen-rt.dll 2010-01-21 12:50 . 2010-01-21 12:50 114688 —-a-w- c:\documents and settings\Pamela\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-701ac211-n\jogl_cg.dll 2010-01-12 10:35 . 2009-05-26 16:30 100896 —-a-w- c:\windows\system32\RTNUninst32.dll 2010-01-12 09:35 . 2009-12-01 05:06 80416 —-a-w- c:\windows\system32\RtNicProp32.dll 2002-03-25 14:52 . 2002-03-25 14:52 644976 —-a-w- c:\program files\BootVis.exe 2009-12-01 03:43 . 2009-12-01 03:43 75 –sh–r- c:\windows\CT4CET.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TranscodingService"="c:\program files\TiVo\Desktop\Plus\\TranscodingService.exe" [2009-11-02 856280] "TivoServer"="c:\program files\TiVo\Desktop\TiVoServer.exe" [2009-11-02 2195160] "TivoTransfer"="c:\program files\TiVo\Desktop\TiVoTransfer.exe" [2009-11-02 604888] "TivoNotify"="c:\program files\TiVo\Desktop\TiVoNotify.exe" [2009-11-02 430808] "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-19 5248312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-15 1434920] "RTHDCPL"="RTHDCPL.EXE" [2009-03-15 17529856] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-02-15 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-15 166424] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-15 137752] "OA012Mon"="c:\windows\OA012Mon.exe" [2009-09-01 24576] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-01-06 2289664] "WSED"="c:\program files\WSED\WSED.exe" [2009-05-27 247080] "BTMeter"="c:\program files\Battery Meter\BTMeter.exe" [2009-07-22 623984] "CapsLKNotify"="c:\program files\CapsLKNotify\CapsLKNotify.exe" [2009-02-23 320808] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008] "LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] c:\documents and settings\Pamela\Start Menu\Programs\Startup\ Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-8-21 900816] Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-18 4742184] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2009-09-29 00:34 87352 —-a-w- c:\windows\system32\LMIinit.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [11/30/2009 11:37 PM 14248] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [8/11/2008 1:41 PM 12856] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592] R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [11/30/2009 11:42 PM 143840] R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [12/1/2009 1:06 AM 134144] R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [12/1/2009 1:06 AM 133632] R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [12/1/2009 1:06 AM 272256] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [12/1/2009 1:06 AM 162816] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/1/2009 1:05 AM 1684736] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 AM 12648] S4 TivoBeacon2;TiVo Beacon Service;c:\program files\TiVo\Desktop\TiVoBeacon.exe [11/2/2009 2:17 PM 1098968] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] getPlusHelper REG_MULTI_SZ getPlusHelper . Contents of the 'Scheduled Tasks' folder 2010-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50] 2010-04-11 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20] . . ——- Supplementary Scan ——- . uStart Page = hxxp://m.www.yahoo.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - component: c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll FF - component: c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll FF - plugin: c:\documents and settings\Pamela\Application Data\Mozilla\Firefox\Profiles\k9zmblbi.default\extensions\[removed]\plugins\npRACtrl.dll FF - plugin: c:\documents and settings\Pamela\Local Settings\Application Data\Yahoo!\BrowserPlus\2.6.0\Plugins\npybrowserplus_2.6.0.dll FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ —- FIREFOX POLICIES —- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHANS REMOVED - - - - SharedTaskScheduler-{636676CE-286C-4B1A-90AC-87C2BC525423} - (no file) AddRemove-{E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\program files\NOS\bin\getPlus_Helper.dll ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10f_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10f_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'winlogon.exe'(848) c:\windows\system32\LMIinit.dll c:\windows\System32\BCMLogon.dll c:\windows\system32\LMIRfsClientNP.dll c:\windows\system32\igfxdev.dll . Completion time: 2010-04-11 17:16:45 ComboFix-quarantined-files.txt 2010-04-11 21:16 Pre-Run: 130,468,233,216 bytes free Post-Run: 130,438,074,368 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect - - End Of File - - D96130699C6A7E780C386B84C789F2A6 A little slow, but otherwise it is behaving fine. No hijacking, access to the Spybot sites and updating of anti-spyware programs is normal again.