Directrdr with Windows XP and IE

About two weeks ago my computer got infected with antimalware doctor (I think). That took a while to get rid of but it seems I"m not done. Now I'm getting lots of redirects and extra IE windows opening that go first to 'directrdr' then onto a random website. Also, yesterday I had to restart my computer twice because it slowed so much it became unusable. Today it's also acting wierd and telling me it has to close programs I'm not running.

I tried to download the DDS file but it saves as an AutoCAD script file so here is the Hijackthis log. I haven't done anything other than run malwarebytes.

Thanks in advance for you help.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:28:31 AM, on 6/22/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Upromise\dca-ua.exe
C:\Program Files\Upromise\UpromiseTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Garmin\gStart.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Kristine K\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061017
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061017
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: FCToolbarURLSearchHook Class - {96b985b7-3cf9-456a-9db6-791710e60f5f} - C:\Program Files\MyPoints Point Finder\Helper.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: FCTBPos00Pos - {614BDA1F-9BEF-4CD1-BDE4-FA4804929B4A} - C:\Program Files\MyPoints Point Finder\Toolbar.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: DCA - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files\Upromise\dca-bho.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ToolHelper - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files\Upromise\upromisetoolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll
O3 - Toolbar: MyPoints Point Finder - {89A2510A-B4B6-4683-BEC9-1B96700BC7F1} - C:\Program Files\MyPoints Point Finder\Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [HPWQTOOLBOX] C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe "-i"
O4 - HKLM\..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [skb] rundll32 "wgeuxjeb.dll",,Run
O4 - HKLM\..\Run: [Ctaxajugaborovom] rundll32.exe "C:\WINDOWS\esodiyubader.dll",Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Upromise Update] C:\Program Files\Upromise\dca-ua.exe
O4 - HKCU\..\Run: [Upromise Tray] C:\Program Files\Upromise\UpromiseTray.exe
O4 - HKCU\..\Run: [Nyawamerihesog] rundll32.exe "C:\WINDOWS\snhtbmsr.dll",Startup
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll
O9 - Extra 'Tools' menuitem: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {20DABCB5-AB70-4E2B-BCA9-17155D5CF583} (hlpFrame Class) - http://planroom.rgsgroup.net/ReproCentral/…elpLauncher.cab
O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer…SWebManager.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applicatio…torLauncher.cab
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://couponmom.coupons.smartsource.com/d…oad/cscmv5X.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {CCBDF033-DD85-45FD-AE68-FBC4A7C7C154} (BravaClientXView Class) - http://planroom.rgsgroup.net/ReproCentral/…ravaClientX.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553557800} - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe

–
End of file - 13581 bytes

Thanks for the quick response and very clear directions. I'm having a problem posting so I"m going to try posting one log at a time…

Also, you asked that I not use this computer but unfortunately this is my work computer and it's the only option. The programs I will be using are Microsoft Excel, Word, and Outlook, AutoCAD 2007, Adobe Acrobat, the Remote Desktop to access my company server, as well as the internet. I will do my best to keep it at a minimum. Please let me know how this will affect the process and I will work around it as best I can.

Here is the first log:

OTL logfile created on: 6/23/2010 8:04:24 AM - Run 1
OTL by OldTimer - Version 3.2.6.1 Folder = C:\Documents and Settings\Kristine K\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 235.00 Mb Available Physical Memory | 23.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 66.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.45 Gb Total Space | 1.15 Gb Free Space | 1.55% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KRISTINE
Current User Name: Kristine K
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Kristine K\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Upromise\UpromiseTray.exe ()
PRC - C:\Program Files\Upromise\dca-ua.exe (Compete Inc)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Garmin\gStart.exe (GARMIN Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe ()
PRC - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\common\DataServer.exe (Wave Systems Corp.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe (Wave Systems Corp.)
PRC - C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe (Hewlett-Packard Company)
PRC - C:\Program Files\palmOne\Hotsync.exe (PalmSource, Inc)
PRC - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Kristine K\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\esodiyubader.dll ()
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (MDM) – File not found
SRV - (Autodesk Licensing Service) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (MSSQL$EXAKTIME) SQL Server (EXAKTIME) – c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (SQLWriter) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe ()
SRV - (DataSvr2) – C:\Program Files\Wave Systems Corp\Common\DataServer.exe (Wave Systems Corp.)
SRV - (IAANTMon) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ASFIPmon) – C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe (Broadcom Corporation)
SRV - (MSSQLServerADHelper) – c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (mercury) – C:\WINDOWS\system32\mercury.sys ()
DRV - (PalmUSBD) – C:\WINDOWS\system32\drivers\PalmUSBD.sys (PalmSource, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (iaStor) – C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (PBADRV) – C:\WINDOWS\system32\drivers\pbadrv.sys (Dell Inc)
DRV - (atmeltpm) – C:\WINDOWS\system32\drivers\atmeltpm.sys (Atmel, Inc.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (BASFND) – C:\Program Files\Broadcom\ASFIPMon\BASFND.sys (Broadcom Corporation)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061017
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061017

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061017
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {96b985b7-3cf9-456a-9db6-791710e60f5f} - C:\Program Files\MyPoints Point Finder\Helper.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\extensions\\{4333911E-7243-4E3E-B558-381848E30599}: C:\Documents and Settings\Kristine K\Local Settings\Application Data\{4333911E-7243-4E3E-B558-381848E30599} [2010/06/09 14:55:32 | 000,000,000 | —D | M]

[2010/06/07 06:07:00 | 000,002,076 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\google_search.xml

O1 HOSTS File: ([2009/07/29 14:37:55 | 000,249,881 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.1001-search.info
O1 - Hosts: 127.0.0.1 1001-search.info
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 8710 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Freecause Toolbar BHO) - {614BDA1F-9BEF-4CD1-BDE4-FA4804929B4A} - C:\Program Files\MyPoints Point Finder\Toolbar.dll ()
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (DCA BHO) - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files\Upromise\dca-bho.dll (Compete, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Upromise TurboSaver) - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files\Upromise\upromisetoolbar.dll (Upromise, Inc.)
O3 - HKLM\..\Toolbar: (Upromise TurboSaver) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll (Upromise, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (MyPoints Point Finder) - {89A2510A-B4B6-4683-BEC9-1B96700BC7F1} - C:\Program Files\MyPoints Point Finder\Toolbar.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Upromise TurboSaver) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll (Upromise, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (MyPoints Point Finder) - {89A2510A-B4B6-4683-BEC9-1B96700BC7F1} - C:\Program Files\MyPoints Point Finder\Toolbar.dll ()
O4 - HKLM..\Run: [Ctaxajugaborovom] C:\WINDOWS\esodiyubader.DLL ()
O4 - HKLM..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [HPWQTOOLBOX] C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [skb] C:\WINDOWS\System32\wgeuxjeb.dll ()
O4 - HKCU..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKCU..\Run: [Nyawamerihesog] C:\WINDOWS\snhtbmsr.DLL (MaresWEB)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Upromise Tray] C:\Program Files\Upromise\UpromiseTray.exe ()
O4 - HKCU..\Run: [Upromise Update] C:\Program Files\Upromise\dca-ua.exe (Compete Inc)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe (Wave Systems Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe (PalmSource, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe (PalmSource, Inc)
O4 - Startup: C:\Documents and Settings\Kristine K\Start Menu\Programs\Startup\palmOne Registration.lnk = C:\Program Files\palmOne\register.exe (palmOne/Leader Technologies)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll (Upromise, Inc.)
O9 - Extra 'Tools' menuitem : Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll (Upromise, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20DABCB5-AB70-4E2B-BCA9-17155D5CF583} http://planroom.rgsgroup.net/ReproCentral/…elpLauncher.cab (hlpFrame Class)
O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} http://h50203.www5.hp.com/HPISWeb/Customer…SWebManager.CAB (Hewlett-Packard Printer Diagnostics)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www1.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} http://webeffective.keynote.com/applicatio…torLauncher.cab (Keynote Connector Launcher 2)
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} http://couponmom.coupons.smartsource.com/d…oad/cscmv5X.cab (CMV5 Class)
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab (Bejeweled Control)
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab (HpProductDetection Class)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab (HPSDDX Class)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CCBDF033-DD85-45FD-AE68-FBC4A7C7C154} http://planroom.rgsgroup.net/ReproCentral/…ravaClientX.cab (BravaClientXView Class)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553557800} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.7.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\sdra64.exe) - C:\WINDOWS\system32\sdra64.exe ()
O24 - Desktop WallPaper: C:\Documents and Settings\Kristine K\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kristine K\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (wvauth) - C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 15:15:00 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2004/08/11 15:02:12 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17465059307421696)

========== Files/Folders - Created Within 90 Days ==========

[2010/06/23 08:03:11 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Kristine K\Desktop\OTL.exe
[2010/06/22 08:31:00 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/06/22 08:27:32 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Kristine K\Desktop\HiJackThis.exe
[2010/06/17 13:51:48 | 000,000,000 | -HSD | C] – C:\WINDOWS\System32\lowsec
[2010/06/16 08:36:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\My Documents\My Garmin
[2010/06/16 08:36:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\GARMIN
[2010/06/16 08:36:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Application Data\GARMIN
[2010/06/16 08:29:47 | 000,000,000 | —D | C] – C:\Garmin
[2010/06/16 08:29:44 | 000,000,000 | —D | C] – C:\Program Files\DIFX
[2010/06/16 08:29:41 | 000,018,304 | —- | C] (GARMIN Corp.) – C:\WINDOWS\System32\drivers\grmngen.sys
[2010/06/16 08:29:40 | 000,000,000 | —D | C] – C:\Program Files\Garmin
[2010/06/14 08:14:14 | 000,000,000 | —D | C] – C:\WINDOWS\System32\vmm32
[2010/06/10 14:46:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Application Data\FCTB000060497
[2010/06/10 14:46:13 | 000,000,000 | —D | C] – C:\Program Files\MyPoints Point Finder
[2010/06/10 08:40:05 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Application Data\Malwarebytes
[2010/06/10 08:39:54 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/10 08:39:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/06/10 08:39:53 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/10 08:39:52 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/09 15:50:10 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/06/09 15:48:55 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/06/09 15:25:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Local Settings\Application Data\Threat Expert
[2010/06/09 15:22:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/06/09 14:55:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Local Settings\Application Data\{4333911E-7243-4E3E-B558-381848E30599}
[2010/06/09 14:54:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Application Data\Street-Ads
[2010/06/09 14:53:35 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Update
[2010/06/09 14:53:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Application Data\Sky-Banners
[2010/06/09 14:53:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Application Data\849F5E8122498EC9FF827BBF9FCC2E2E
[2010/05/26 12:57:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\My Documents\ebay
[2010/04/28 11:10:19 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intuit
[2010/04/28 11:07:36 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Data Dynamics
[2010/04/28 11:07:35 | 000,000,000 | —D | C] – C:\Program Files\Exaktime
[2010/04/28 11:03:12 | 000,000,000 | —D | C] – C:\Program Files\Microsoft SQL Server
[2010/04/15 13:33:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Kristine K\Application Data\Vu360
[2010/04/15 13:32:50 | 000,000,000 | —D | C] – C:\Program Files\The Blue Book
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/06/23 08:03:11 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Kristine K\Desktop\OTL.exe
[2010/06/23 08:02:14 | 000,000,894 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/23 07:53:00 | 000,000,424 | —- | M] () – C:\WINDOWS\tasks\Updater.job
[2010/06/23 07:32:06 | 000,000,120 | —- | M] () – C:\WINDOWS\Qqusurowovoxados.dat
[2010/06/23 07:32:06 | 000,000,000 | —- | M] () – C:\WINDOWS\Udodutulivihanof.bin
[2010/06/23 07:32:02 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/23 07:31:38 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\NvwsApps.xml
[2010/06/23 07:31:34 | 000,000,890 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/23 07:31:33 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/23 07:31:32 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/23 07:31:30 | 1071,738,880 | -HS- | M] () – C:\hiberfil.sys
[2010/06/22 15:54:41 | 018,612,224 | -H– | M] () – C:\Documents and Settings\Kristine K\NTUSER.DAT
[2010/06/22 15:54:25 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Kristine K\ntuser.ini
[2010/06/22 15:09:35 | 003,011,527 | —- | M] () – C:\Documents and Settings\Kristine K\Desktop\Bid_Set_Plans.062110.pdf
[2010/06/22 13:20:57 | 000,001,714 | -H– | M] () – C:\Documents and Settings\Kristine K\My Documents\Default.rdp
[2010/06/22 10:06:03 | 000,062,976 | —- | M] () – C:\Documents and Settings\Kristine K\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/22 08:27:36 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Kristine K\Desktop\HiJackThis.exe
[2010/06/11 12:22:22 | 000,002,304 | —- | M] () – C:\WINDOWS\System32\mercury.sys
[2010/06/10 07:51:00 | 000,000,751 | —- | M] () – C:\Documents and Settings\Kristine K\Start Menu\Programs\Startup\palmOne Registration.lnk
[2010/06/09 14:53:09 | 000,184,832 | —- | M] () – C:\WINDOWS\Umemya.exe
[2010/06/02 12:39:05 | 000,012,178 | —- | M] () – C:\Documents and Settings\Kristine K\My Documents\Glidden Rebate 6-2-10.pdf
[2010/05/24 22:38:04 | 000,309,248 | —- | M] () – C:\WINDOWS\System32\hlwjzuvc.dll
[2010/05/24 22:37:48 | 000,327,680 | —- | M] () – C:\WINDOWS\System32\wgeuxjeb.dll
[2010/05/19 12:47:09 | 005,013,364 | —- | M] () – C:\Documents and Settings\Kristine K\My Documents\Aiden's Adoption Social Summary.pdf
[2010/05/19 07:52:03 | 002,639,639 | —- | M] () – C:\Documents and Settings\Kristine K\My Documents\JT's Adoption Social Summary.pdf
[2010/05/13 07:53:15 | 000,000,482 | —- | M] () – C:\Documents and Settings\Kristine K\Desktop\Spec Files.lnk
[2010/05/12 15:59:41 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/29 07:44:24 | 000,226,728 | R— | M] (Coupons, Inc.) – C:\WINDOWS\System32\cpnprt2.cid
[2010/04/28 11:06:26 | 000,528,638 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/04/28 11:06:26 | 000,492,078 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/04/28 11:06:26 | 000,090,098 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/04/28 10:55:44 | 000,001,556 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
[2010/04/28 10:53:58 | 000,016,694 | —- | M] (PalmSource, Inc.) – C:\WINDOWS\System32\drivers\PalmUSBD.sys
[2010/04/13 11:14:21 | 000,998,756 | —- | M] () – C:\Documents and Settings\Kristine K\My Documents\Passport Application.pdf
[2010/04/01 14:24:01 | 000,230,824 | R— | M] (Coupons, Inc.) – C:\WINDOWS\cpnprt2.cid
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/22 15:09:35 | 003,011,527 | —- | C] () – C:\Documents and Settings\Kristine K\Desktop\Bid_Set_Plans.062110.pdf
[2010/06/11 12:22:22 | 000,002,304 | —- | C] () – C:\WINDOWS\System32\mercury.sys
[2010/06/09 14:55:33 | 000,000,120 | —- | C] () – C:\WINDOWS\Qqusurowovoxados.dat
[2010/06/09 14:55:33 | 000,000,000 | —- | C] () – C:\WINDOWS\Udodutulivihanof.bin
[2010/06/09 14:53:38 | 000,000,424 | —- | C] () – C:\WINDOWS\tasks\Updater.job
[2010/06/09 14:53:19 | 000,184,832 | —- | C] () – C:\WINDOWS\Umemya.exe
[2010/06/02 12:39:05 | 000,012,178 | —- | C] () – C:\Documents and Settings\Kristine K\My Documents\Glidden Rebate 6-2-10.pdf
[2010/05/24 22:38:04 | 000,309,248 | —- | C] () – C:\WINDOWS\System32\hlwjzuvc.dll
[2010/05/24 22:37:48 | 000,327,680 | —- | C] () – C:\WINDOWS\System32\wgeuxjeb.dll
[2010/05/19 12:47:08 | 005,013,364 | —- | C] () – C:\Documents and Settings\Kristine K\My Documents\Aiden's Adoption Social Summary.pdf
[2010/05/19 07:52:02 | 002,639,639 | —- | C] () – C:\Documents and Settings\Kristine K\My Documents\JT's Adoption Social Summary.pdf
[2010/04/28 13:10:16 | 000,000,482 | —- | C] () – C:\Documents and Settings\Kristine K\Desktop\Spec Files.lnk
[2010/04/28 10:59:21 | 000,000,751 | —- | C] () – C:\Documents and Settings\Kristine K\Start Menu\Programs\Startup\palmOne Registration.lnk
[2010/04/28 10:55:44 | 000,001,556 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
[2010/04/13 11:14:21 | 000,998,756 | —- | C] () – C:\Documents and Settings\Kristine K\My Documents\Passport Application.pdf
[2009/09/11 04:09:44 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\jacob-1.14.3-x86.dll
[2008/07/10 14:04:28 | 000,000,056 | —- | C] () – C:\WINDOWS\hpdj110.ini
[2008/03/21 08:44:36 | 000,000,134 | —- | C] () – C:\WINDOWS\webica.ini
[2008/01/14 17:54:04 | 000,099,712 | —- | C] () – C:\WINDOWS\HPBroker.dll
[2006/10/30 08:16:04 | 000,000,397 | R— | C] () – C:\WINDOWS\hpw9800k.ini
[2006/10/30 08:13:17 | 000,000,468 | —- | C] () – C:\WINDOWS\hpdj9800.ini
[2006/10/30 08:13:06 | 000,001,367 | —- | C] () – C:\WINDOWS\mariner.ini
[2006/10/17 18:04:11 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/10/17 17:57:28 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/10/17 17:52:27 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\bioapi_mds300.dll
[2006/10/17 17:52:27 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\bioapi100.dll
[2006/10/17 17:33:49 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/10/17 17:32:54 | 000,000,393 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2006/09/16 14:40:44 | 000,462,848 | —- | C] () – C:\WINDOWS\System32\softcoin.dll
[2006/09/16 14:40:26 | 000,344,064 | —- | C] () – C:\WINDOWS\System32\gencoin.dll
[2006/06/12 08:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_RUS.dll
[2006/06/12 08:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ITA.dll
[2006/06/12 08:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_FRA.dll
[2006/06/12 08:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ESN.dll
[2006/06/12 08:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ENU.dll
[2006/06/12 08:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_DEU.dll
[2006/06/12 08:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_CHS.dll
[2006/06/12 08:01:16 | 000,348,160 | —- | C] () – C:\WINDOWS\System32\Tsp.dll
[2006/05/22 06:37:36 | 000,184,320 | —- | C] () – C:\WINDOWS\System32\AmRes_en.dll
[2006/05/22 06:32:12 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_es.dll
[2006/05/22 06:32:06 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_ko.dll
[2006/05/22 06:32:00 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_de.dll
[2006/05/22 06:31:52 | 000,184,320 | —- | C] () – C:\WINDOWS\System32\AmRes_pt-BR.dll
[2006/05/22 06:31:46 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_fr.dll
[2006/05/22 06:31:38 | 000,184,320 | —- | C] () – C:\WINDOWS\System32\AmRes_ja.dll
[2006/05/22 06:31:32 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\AmRes_ru.dll
[2006/05/22 06:31:26 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_it.dll
[2006/05/22 06:31:18 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\AmRes_zh-CHS.dll
[2006/05/22 06:31:12 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\AmRes_zh-CHT.dll
[2006/05/16 10:34:22 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\wxvault.dll
[2006/05/16 10:33:06 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\detoured.dll
[2006/05/15 17:08:42 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_en.dll
[2006/05/15 16:52:12 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt.dll
[2006/05/15 16:52:02 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHT.dll
[2006/05/15 16:51:52 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_ko.dll
[2006/05/15 16:51:42 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_es.dll
[2006/05/15 16:51:34 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_ru.dll
[2006/05/15 16:51:24 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_ja.dll
[2006/05/15 16:51:16 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_it.dll
[2006/05/15 16:51:06 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_de.dll
[2006/05/15 16:50:56 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_fr.dll
[2006/05/15 16:50:46 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHS.dll
[2005/12/01 12:41:20 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\pbadrvdll.dll
[2005/09/20 11:36:06 | 000,798,720 | —- | C] () – C:\WINDOWS\System32\DemoLicense.dll
[2004/08/11 15:24:19 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/11 15:11:31 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/11 15:00:36 | 000,235,520 | —- | C] () – C:\WINDOWS\esodiyubader.dll
[2004/07/21 13:03:14 | 000,917,504 | —- | C] () – C:\WINDOWS\System32\lmgr10.dll
[2004/07/20 12:27:52 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ADsSecurity.dll
[2004/03/18 16:01:20 | 000,072,192 | —- | C] () – C:\WINDOWS\System32\xltZlib.dll
[2003/01/07 13:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2006/11/14 15:02:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Actify
[2009/09/10 14:05:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ancestry.com
[2006/10/23 13:56:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Autodesk
[2008/03/11 15:40:10 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\DataComm64
[2010/04/29 11:29:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Exaktime
[2010/06/16 08:36:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GARMIN
[2008/06/24 14:43:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HotSync
[2008/03/11 15:40:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\JpegSizer
[2009/11/24 15:52:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Light Crafts
[2006/11/10 09:14:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2009/07/20 13:12:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RoboForm
[2007/06/15 12:13:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpinTop Games
[2010/06/10 08:25:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/06/11 09:38:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Update
[2007/05/18 11:37:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2006/10/17 17:52:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Wave Systems Corp
[2007/12/03 16:49:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/09/15 07:48:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/06/23 07:59:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/06/10 09:46:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\849F5E8122498EC9FF827BBF9FCC2E2E
[2009/07/16 07:56:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Aurora
[2007/04/30 13:30:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Autodesk
[2010/02/12 10:24:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\com.powerade.pulse.E05451257EBCF1128D1DCCD636C4C762D9BC275D.1
[2009/02/09 14:58:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\CVS
[2010/01/19 11:23:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\E-centives
[2009/08/13 07:54:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\eMusic
[2010/06/10 14:46:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\FCTB000060497
[2010/06/16 08:36:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\GARMIN
[2008/06/24 14:43:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\HotSync
[2008/03/20 11:51:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\ICAClient
[2007/06/14 14:46:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\iWin
[2008/11/13 10:25:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\KeyingTool
[2007/09/28 09:02:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Keynote Systems
[2008/06/24 14:44:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Leadertech
[2009/07/16 07:56:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Light Crafts
[2008/08/27 11:23:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Research In Motion
[2010/06/09 14:53:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Sky-Banners
[2006/12/14 11:14:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Snapfish
[2010/06/10 08:24:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Street-Ads
[2009/10/28 08:48:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\upromise
[2008/04/01 15:23:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Volts
[2010/04/15 13:33:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Vu360
[2010/06/23 07:31:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\Wave Systems Corp
[2009/07/14 12:03:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Kristine K\Application Data\YouDataAIR.CDA5CEB063BC2A22C44BAA035F25F65FCCDA2208.1
[2010/06/23 07:53:00 | 000,000,424 | —- | M] () – C:\WINDOWS\Tasks\Updater.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/05/26 10:28:25 | 000,024,201 | —- | M] () – C:\acadminidump.dmp
[2004/08/11 15:15:00 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/08/21 07:43:09 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2004/08/11 15:15:00 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2006/10/17 17:34:20 | 000,004,989 | RH– | M] () – C:\dell.sdr
[2010/06/23 07:31:30 | 1071,738,880 | -HS- | M] () – C:\hiberfil.sys
[2008/06/24 14:44:03 | 003,906,188 | —- | M] () – C:\HuskyInstallerLog.txt
[2006/10/27 10:42:53 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2004/08/11 15:15:00 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2004/08/11 15:15:00 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2004/08/04 03:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/04 03:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/06/23 07:31:28 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2005/06/28 07:33:54 | 000,011,016 | —- | M] () – C:\README.TXT
[2005/07/28 05:32:56 | 000,011,252 | —- | M] () – C:\README_JA.TXT
[2010/06/10 08:38:22 | 000,000,588 | —- | M] () – C:\rkill.log
[2010/01/07 14:36:06 | 000,012,800 | -HS- | M] () – C:\Thumbs.db

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2010/03/11 05:38:51 | 000,347,136 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2010/03/11 05:38:51 | 000,214,528 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[2010/03/09 04:09:18 | 000,430,080 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\vbscript.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/08/11 15:06:14 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/11 15:06:14 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/11 15:06:14 | 000,876,544 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /180 >
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2010/02/24 05:31:30 | 000,454,016 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\mrxsmb.sys
[2010/04/28 10:53:58 | 000,016,694 | —- | M] (PalmSource, Inc.) – C:\WINDOWS\system32\drivers\PalmUSBD.sys
[2009/12/31 09:14:12 | 000,352,640 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\srv.sys
[2010/02/11 05:01:43 | 000,226,880 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\tcpip6.sys

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2006/11/02 10:39:34 | 000,043,520 | —- | M] (Lexmark International Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\DKAA2B4C.DLL
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2005/05/10 16:14:32 | 000,067,072 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xt.dll
[2004/03/22 13:17:08 | 000,025,840 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 55930 bytes -> C:\Documents and Settings\All Users\Desktop:$ES_DESCRIPTOR_NBP2VBVKPVF9VPPP55N3EDT0ETX1JU0VSVLLV7J
@Alternate Data Stream - 55930 bytes -> C:\Documents and Settings\All Users\Application Data\Light Crafts:$ES_DESCRIPTOR_NBP2VBVKPVF9VPPP55N3EDT0ETX1JU0VSVLLV7J
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

I tried to post the 'Extras' log but I don't seem to be able to. I will try again but here is the other for now.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-23 10:22:42
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\KRISTI~1\LOCALS~1\Temp\fxlyqpoc.sys


—- Kernel code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF65A2360, 0x20364D, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 00356DCE C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 003572BA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 00355BBB C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 0035737D C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 0035724D C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 00355AF1 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 003573E3 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 00356C79 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 0035595F C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 003561DA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 003565B6 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 00356AEA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 0035633F C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 00356261 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 003562BB C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 00356035 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 003566AD C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 00356A54 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 003559B9 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 003564E4 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 00356EA5 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 00356F53 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 00356725 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 00357202 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 00355C61 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 00355BDA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 0035718A C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 00356BE5 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 0035644C C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 003569D0 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 00356135 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 00357001 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 00356D63 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 00355E5A C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 00356E31 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 00355F4C C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 00355A83 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 00357108 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 00357236 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[484] USER32.dll!ExitWindowsEx 7E45A045 5 Bytes JMP 003571E7 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!??2@YAPAXI@Z 77C29CC5 5 Bytes JMP 0A93C080 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!??3@YAXPAX@Z 77C29CDD 5 Bytes JMP 0A93C0E0 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!?set_new_handler@@YAP6AXXZP6AXXZ@Z 77C29D9F 5 Bytes JMP 0A93C110 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_aligned_offset_malloc 77C29DAF 5 Bytes JMP 0A93BFE0 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_aligned_free 77C29E33 5 Bytes JMP 0A93C0E0 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_aligned_malloc 77C29E52 5 Bytes JMP 0A93BFC0 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_aligned_offset_realloc 77C29E6E 5 Bytes JMP 0A93C020 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_aligned_realloc 77C29FC6 5 Bytes JMP 0A93C000 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_expand 77C29FE5 5 Bytes JMP 0A93BFA0 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_heapadd 77C2BC9F 5 Bytes JMP 0A93C160 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_heapchk 77C2BCB3 5 Bytes JMP 0A93C170 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_heapset + 1 77C2BD83 4 Bytes JMP 0A93C191 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_heapmin 77C2BD8C 5 Bytes JMP 0A93C260 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_heapused 77C2BE3A 5 Bytes JMP 0A93C230 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_heapwalk 77C2BE4D 5 Bytes JMP 0A93C1A0 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!_msize 77C2BF6C 5 Bytes JMP 0A93BEB0 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!calloc 77C2C0C3 5 Bytes JMP 0A93BE50 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!free 77C2C21B 5 Bytes JMP 0A93C0E0 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!malloc 77C2C407 5 Bytes JMP 0A93BE10 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\palmOne\Hotsync.exe[664] msvcrt.dll!realloc 77C2C437 5 Bytes JMP 0A93BE90 C:\Program Files\palmOne\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00A3000A
.text C:\Program Files\Internet Explorer\iexplore.exe[668] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00DD000A
.text C:\Program Files\Internet Explorer\iexplore.exe[668] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00A2000C
.text C:\Program Files\Internet Explorer\iexplore.exe[668] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 3E1DF4B9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 3E352046 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 3E351FC7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 3E35200B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 3E351F53 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 3E351F8D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 3E352081 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 3E2017EA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[668] ole32.dll!OleLoadFromStream 7752A257 5 Bytes JMP 3E352243 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0098000A
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0099000A
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0097000C
.text C:\WINDOWS\System32\svchost.exe[1112] USER32.dll!GetCursorPos 7E41BD76 5 Bytes JMP 0086000A
.text C:\WINDOWS\System32\svchost.exe[1112] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00CB000A
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B6000A
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00C4000A
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B5000C
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00A4000A
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00DE000A
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00A3000C
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 3E1DF4B9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 3E352046 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 3E351FC7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 3E35200B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 3E351F53 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 3E351F8D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 3E352081 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 3E2017EA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2128] ole32.dll!OleLoadFromStream 7752A257 5 Bytes JMP 3E352243 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\WINDOWS\system32\wuauclt.exe[4040] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00C0000A
.text C:\WINDOWS\system32\wuauclt.exe[4040] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00C1000A
.text C:\WINDOWS\system32\wuauclt.exe[4040] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00BF000C

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Fastfat \Fat B753CC8A

—- EOF - GMER 1.0.15 —-

Hi Satchfan.

I had a bit of a hiccup following your directions. Java would not update. It said it was ready to download but displayed 0% downloaded for almost 20 minutes before I cancled it. Same thing the second time. I just tried again after running OTL and Combofix but now it says there is a problem with my internet settings. Should I just uninstall then install again? I'll wait for your instructions on that.

Spybot was not in my system tray and I could not figure out how to do what you requested. Instead I stopped the process 'Teatimer.exe'. After running OTL it popped back in my system tray and I was able to uncheck what you asked.

Here is the OTL log:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Process explorer.exe killed successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Ctaxajugaborovom deleted successfully.
C:\WINDOWS\esodiyubader.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\skb deleted successfully.
C:\WINDOWS\system32\wgeuxjeb.dll moved successfully.
C:\Documents and Settings\Kristine K\Application Data\849F5E8122498EC9FF827BBF9FCC2E2E folder moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Nyawamerihesog deleted successfully.
C:\WINDOWS\snhtbmsr.dll moved successfully.
Starting removal of ActiveX control {549F957E-2F89-11D6-8CFE-00C04F52B225}
C:\WINDOWS\Downloaded Program Files\CpnMgr.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{549F957E-2F89-11D6-8CFE-00C04F52B225}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{549F957E-2F89-11D6-8CFE-00C04F52B225}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{549F957E-2F89-11D6-8CFE-00C04F52B225}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{549F957E-2F89-11D6-8CFE-00C04F52B225}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\WINDOWS\system32\sdra64.exe deleted successfully.
File move failed. C:\WINDOWS\system32\sdra64.exe scheduled to be moved on reboot.
Folder move failed. C:\WINDOWS\System32\lowsec scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{4333911E-7243-4E3E-B558-381848E30599} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4333911E-7243-4E3E-B558-381848E30599}\ not found.
C:\Documents and Settings\Kristine K\Local Settings\Application Data\{4333911E-7243-4E3E-B558-381848E30599}\chrome\content folder moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Application Data\{4333911E-7243-4E3E-B558-381848E30599}\chrome folder moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Application Data\{4333911E-7243-4E3E-B558-381848E30599} folder moved successfully.
C:\Documents and Settings\Kristine K\Application Data\Street-Ads folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Update folder moved successfully.
C:\WINDOWS\cpnprt2.cid moved successfully.
C:\WINDOWS\system32\cpnprt2.cid moved successfully.
C:\Documents and Settings\Kristine K\Application Data\Sky-Banners\skb folder moved successfully.
C:\Documents and Settings\Kristine K\Application Data\Sky-Banners folder moved successfully.
C:\WINDOWS\Umemya.exe moved successfully.
C:\WINDOWS\tasks\Updater.job moved successfully.
C:\WINDOWS\Qqusurowovoxados.dat moved successfully.
C:\WINDOWS\Udodutulivihanof.bin moved successfully.
C:\WINDOWS\system32\hlwjzuvc.dll moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 56504 bytes

User: Kristine K
->Temp folder emptied: 3066037527 bytes
->Temporary Internet Files folder emptied: 228960245 bytes
->Java cache emptied: 152860890 bytes
->Flash cache emptied: 1989183 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 161335905 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 115168 bytes
->Temporary Internet Files folder emptied: 156108043 bytes
->Flash cache emptied: 6868 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 211419322 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23951242 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 3478388076 bytes

Total Files Cleaned = 7,135.00 mb


OTL by OldTimer - Version 3.2.6.1 log created on 06252010_082945

Files\Folders moved on Reboot…
File move failed. C:\WINDOWS\system32\sdra64.exe scheduled to be moved on reboot.
Folder move failed. C:\WINDOWS\System32\lowsec scheduled to be moved on reboot.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\ZD73PT1G\clk[4].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\ZD73PT1G\iframe3[1].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\V5CXZPAV\iframe[1].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\SYLAFQUA\fc[1].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\SYLAFQUA\st[1] moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\APBCFM3B\blank[1].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\APBCFM3B\launch[3].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\4462D6DK\add_reply_f27_to112760[2].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\4462D6DK\index[2].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\4462D6DK\like[1].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\Content.IE5\1GNV5DFM\blank[1].htm moved successfully.
C:\Documents and Settings\Kristine K\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U77NXP8C\Rediscovering_China_20091022_part_1[2].flv moved successfully.
File\Folder C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\17TJR4CM\co-parent-did-you-pick-right-mate[1].htm not found!
C:\WINDOWS\temp\fla11.tmp moved successfully.

Registry entries deleted on Reboot…


And from Combofix:

ComboFix 10-06-24.03 - Kristine K 06/25/2010 9:28.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.685 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\searchplugins\google_search.xml
C:\Thumbs.db
c:\windows\Downloaded Program Files\CpnMgr.dll
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\sdra64.exe
c:\windows\xpsp1hfm.log

Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_6TO4


((((((((((((((((((((((((( Files Created from 2010-05-25 to 2010-06-25 )))))))))))))))))))))))))))))))
.

2010-06-25 16:31 . 2010-06-25 16:31 ——– d—–w- c:\windows\LastGood.Tmp
2010-06-25 15:29 . 2010-06-25 15:29 ——– d—–w- C:\_OTL
2010-06-16 15:36 . 2010-06-16 15:36 ——– d—–w- c:\documents and settings\All Users\Application Data\GARMIN
2010-06-16 15:36 . 2010-06-16 15:36 ——– d—–w- c:\documents and settings\Kristine K\Application Data\GARMIN
2010-06-16 15:29 . 2010-06-16 15:29 ——– d—–w- C:\Garmin
2010-06-16 15:29 . 2010-06-16 15:29 ——– d—–w- c:\program files\DIFX
2010-06-16 15:29 . 2009-04-17 22:48 9344 —-a-w- c:\windows\system32\drivers\grmnusb.sys
2010-06-16 15:29 . 2009-04-17 22:48 18304 —-a-w- c:\windows\system32\drivers\grmngen.sys
2010-06-16 15:29 . 2010-06-16 15:29 ——– d—–w- c:\program files\Garmin
2010-06-14 15:14 . 2010-06-14 15:14 ——– d—–w- c:\windows\system32\vmm32
2010-06-11 19:22 . 2010-06-11 19:22 2304 —-a-w- c:\windows\system32\mercury.sys
2010-06-10 15:40 . 2010-06-10 15:40 ——– d—–w- c:\documents and settings\Kristine K\Application Data\Malwarebytes
2010-06-10 15:39 . 2010-06-10 15:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-10 15:39 . 2010-04-29 22:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-10 15:39 . 2010-04-29 22:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-10 15:39 . 2010-06-11 16:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-09 22:25 . 2010-06-09 22:25 ——– d—–w- c:\documents and settings\Kristine K\Local Settings\Application Data\Threat Expert
2010-06-09 22:22 . 2010-06-10 15:25 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-24 21:03 . 2006-10-23 20:42 ——– d—–w- c:\documents and settings\Kristine K\Application Data\Wave Systems Corp
2010-06-23 20:06 . 2006-10-24 21:43 ——– d—–w- c:\documents and settings\Kristine K\Application Data\AdobeUM
2010-06-22 20:29 . 2009-07-13 15:58 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-06-11 16:38 . 2010-06-10 21:46 ——– d—–w- c:\program files\MyPoints Point Finder
2010-06-10 21:46 . 2010-06-10 21:46 ——– d—–w- c:\documents and settings\Kristine K\Application Data\FCTB000060497
2010-06-10 21:46 . 2010-06-10 21:46 243200 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\Helper.dll
2010-06-10 21:46 . 2010-06-10 21:46 1547776 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\Toolbar.dll
2010-06-10 21:46 . 2010-06-10 21:46 126251 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\Uninst.exe
2010-05-28 20:39 . 2010-02-12 17:19 ——– d—–w- c:\program files\PoweradePulse
2010-05-27 05:34 . 2010-06-10 21:46 209920 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\SearchComponent.dll
2010-05-26 00:07 . 2010-06-10 21:46 1477 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\patch.bat
2010-05-21 15:27 . 2010-06-10 21:46 143496 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\ToolbarUpdate.exe
2010-05-14 14:58 . 2006-10-18 00:57 ——– d—–w- c:\program files\Google
2010-05-08 05:32 . 2010-06-10 21:46 371200 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\RSSReader_plugin.dll
2010-05-07 19:09 . 2010-06-10 21:46 395776 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\emailchecker_plugin.dll
2010-04-30 05:44 . 2010-06-10 21:46 274432 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\bookmarksplugin.dll
2010-04-29 18:29 . 2008-06-24 21:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Exaktime
2010-04-28 18:10 . 2010-04-28 18:10 ——– d—–w- c:\program files\Common Files\Intuit
2010-04-28 18:10 . 2010-04-28 18:07 ——– d—–w- c:\program files\Exaktime
2010-04-28 18:07 . 2010-04-28 18:07 ——– d—–w- c:\program files\Common Files\Data Dynamics
2010-04-28 18:04 . 2006-10-18 00:56 ——– d—–w- c:\program files\Microsoft.NET
2010-04-28 18:04 . 2010-04-28 18:03 ——– d—–w- c:\program files\Microsoft SQL Server
2010-04-28 17:57 . 2008-06-24 21:43 ——– d—–w- c:\program files\palmOne
2010-04-28 17:54 . 2010-04-28 17:54 65536 —-a-r- c:\documents and settings\Kristine K\Application Data\Microsoft\Installer\{FF8157AA-F640-45BD-B7C2-BAA1016B267A}\PalmDesktopShortcut.exe
2010-04-28 17:54 . 2010-04-28 17:54 65536 —-a-r- c:\documents and settings\Kristine K\Application Data\Microsoft\Installer\{FF8157AA-F640-45BD-B7C2-BAA1016B267A}\ARPPRODUCTICON.exe
2010-04-28 17:53 . 2009-01-15 17:13 16694 —-a-w- c:\windows\system32\drivers\PalmUSBD.sys
2010-04-07 01:51 . 2010-06-10 21:46 264704 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\statplugin.dll
2010-04-07 01:51 . 2010-06-10 21:46 276992 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\weatherplugin.dll
2010-04-07 01:51 . 2010-06-10 21:46 399360 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\RadioPlugin.dll
2010-04-07 01:51 . 2010-06-10 21:46 290304 —-a-w- c:\documents and settings\Kristine K\Application Data\FCTB000060497\Toolbar\msgboxplugin.dll
2008-07-31 21:55 . 2008-07-31 21:55 774144 —-a-w- c:\program files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{96b985b7-3cf9-456a-9db6-791710e60f5f}"= "c:\program files\MyPoints Point Finder\Helper.dll" [2010-06-10 243200]

[HKEY_CLASSES_ROOT\clsid\{96b985b7-3cf9-456a-9db6-791710e60f5f}]
[HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{9FEBEA6D-4801-4D23-97E7-A771B698E442}]
[HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{614BDA1F-9BEF-4CD1-BDE4-FA4804929B4A}]
2010-06-10 21:46 1547776 —-a-w- c:\program files\MyPoints Point Finder\Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{89A2510A-B4B6-4683-BEC9-1B96700BC7F1}"= "c:\program files\MyPoints Point Finder\Toolbar.dll" [2010-06-10 1547776]

[HKEY_CLASSES_ROOT\clsid\{89a2510a-b4b6-4683-bec9-1b96700bc7f1}]
[HKEY_CLASSES_ROOT\FCTB000060497.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{061ED138-E065-4356-82AA-578F7F1EEAF1}]
[HKEY_CLASSES_ROOT\FCTB000060497.IEToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{89A2510A-B4B6-4683-BEC9-1B96700BC7F1}"= "c:\program files\MyPoints Point Finder\Toolbar.dll" [2010-06-10 1547776]

[HKEY_CLASSES_ROOT\clsid\{89a2510a-b4b6-4683-bec9-1b96700bc7f1}]
[HKEY_CLASSES_ROOT\FCTB000060497.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{061ED138-E065-4356-82AA-578F7F1EEAF1}]
[HKEY_CLASSES_ROOT\FCTB000060497.IEToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Upromise Update"="c:\program files\Upromise\dca-ua.exe" [2009-10-07 81920]
"Upromise Tray"="c:\program files\Upromise\UpromiseTray.exe" [2009-10-10 167936]
"gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-21 7204864]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 282624]
"Document Manager"="c:\program files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-05-16 102400]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2006-04-26 143360]
"HPWQTOOLBOX"="c:\program files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe" [2005-06-01 335872]
"MP10_EnsureFileVer"="c:\windows\inf\unregmp2.exe" [2004-08-04 208896]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-16 141608]

c:\documents and settings\Kristine K\Start Menu\Programs\Startup\
palmOne Registration.lnk - c:\program files\palmOne\register.exe [2009-1-15 2367488]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 217194]
AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart17.exe [2006-3-5 11000]
EMBASSY Trust Suite Secure Update.lnk - c:\program files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-1-30 192512]
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2004-6-9 471040]
HOTSYNCSHORTCUTNAME.lnk - c:\program files\palmOne\Hotsync.exe [2004-6-9 471040]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Audible Download Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Audible Download Manager.lnk
backup=c:\windows\pss\Audible Download Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Kristine K^Start Menu^Programs^Startup^palmOne Registration.lnk]
path=c:\documents and settings\Kristine K\Start Menu\Programs\Startup\palmOne Registration.lnk
backup=c:\windows\pss\palmOne Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6]
2009-04-23 20:42 801904 —-a-w- c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Roxio\\Media Manager 9\\MediaManager9.exe"=
"c:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Aurora\\Aurora.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\MyPoints Point Finder\\TroubleShooter.exe"=
"c:\\Program Files\\MyPoints Point Finder\\ToolbarUpdate.exe"=

R2 ASFIPmon;Broadcom ASF IP Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [3/17/2006 3:25 PM 65536]
R2 MSSQL$EXAKTIME;SQL Server (EXAKTIME);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2/10/2007 6:29 AM 29178224]
S0 iqyrpxe;iqyrpxe; [x]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/9/2010 12:42 PM 135664]
S3 mercury;mercury;c:\windows\system32\mercury.sys [6/11/2010 12:22 PM 2304]
.
Contents of the 'Scheduled Tasks' folder

2010-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 19:41]

2010-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 19:41]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.cnn.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {20DABCB5-AB70-4E2B-BCA9-17155D5CF583} - hxxp://planroom.rgsgroup.net/ReproCentral/Resources/helpLauncher.cab
DPF: {CCBDF033-DD85-45FD-AE68-FBC4A7C7C154} - hxxp://planroom.rgsgroup.net/ReproCentral/Resources/BravaClient/BravaClientX.cab
.
.
——- File Associations ——-
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Nyawamerihesog - c:\windows\snhtbmsr.dll
AddRemove-The Blue Book - c:\program files\The Blue Book\Vu360\uninstall.exe
AddRemove-WireGuide-ECM - c:\zoltek\WIREGUID\unwise.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-25 09:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(764)
c:\windows\system32\wvauth.dll
c:\windows\system32\biolsp.dll

- - - - - - - > 'explorer.exe'(1684)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Wave Systems Corp\Common\DataServer.exe
c:\program files\Intel\Intel Matrix Storage Manager\iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\stsystra.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-06-25 09:43:10 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-25 16:43

Pre-Run: 5,271,592,960 bytes free
Post-Run: 5,015,195,648 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - F72735FA81E8E598EF92FD51351541C9


You asked about this:
C:\Documents and Settings\Kristine K\Application Data\Volts
I believe this is some software I downloaded a couple years ago. Not something I ever used and I thought I removed it with the add/remove programs but it seems it's still there.

You also asked:
'Have you installed Shutdown/Restart Controller and Battery Monitor'
I don't know what this is.

My computer is running better so far. I have not seen the directrdr redirect and I did a bunch of searches to try and make it happen. The speed of my computer seems to be back to normal as well but I'll have to see how that goes for the rest of the day.
The one thing I did notice is twice I've been on a webpage (this one the second time) and I suddenly get redirected to a dell seach page telling me it can't find the page I was looking for. This has happened for awhile and I don't know if it's part of what my computer was infected with or not.

I did also have a question, all the stuff that's infected my computer, do you know if it's possible that it would have also infected our server? It's running fine I'm just wondering if it may cause problems later?

Thanks again for your help. I'll be at this computer for a couple more hours today then not again until monday morning. Have a great weekend!
Kristine