Google redirects and random opens

Hello and thanks in advance for helping,

I am experiencing intermittent redirects from the google search results - it does it sometimes but not always. One example site is "shopcomparus.com". It will open one site on the same search page fine, then have a problem on the next one. I also have an occasional new window pop open and go to some search site out of nowhere. Not consistent either. The only way to get where I want is to copy the url into the address window and go directly to the site. Even then, while within a site I may still get redirected, or have a popup open.

I am running Vipre antivirus and have run Malaware, Adaware, Spybot, and CWShredder. The first three all removed something on their first passes. I had not read your warning ahead of time about only running what you suggest. I was running Microsoft Onecare but they have dropped support which led to the switch.

I have posted the logfile from HiJackthis below:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:05:06 PM, on 7/29/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\TAMSvr.exe
C:\WINDOWS\system32\FpLogonServ.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe
C:\Program Files\Sprint\Pantech\Sprint Mobile Broadband (Pantech)\PWIUtilityService.exe
C:\Toshiba\IVP\ISM\pinger.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\WINDOWS\system32\svchost.exe
c:\Toshiba\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\ThpSrv.exe
C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\System32\TTPDSRV.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\TrueSuite Access Manager\FpNotifier.exe
C:\Program Files\TrueSuite Access Manager\usbnotify.exe
C:\Program Files\TrueSuite Access Manager\PwdBank.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TrueSuite Access Manager\CssSvr.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\TOSHIBA\CrossMenu\CrossMenu.exe
C:\WINDOWS\system32\00THotkey.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe
C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\WINDOWS\system32\thpsrv.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe
C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE
C:\WINDOWS\system32\TPSODDCtl.exe
C:\Program Files\TOSHIBA\TME3\TMETEMNU.EXE
C:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Smart PDF Creator\sspdfagentd.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Documents and Settings\Mike Petrushka\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://m.www.yahoo.com/?r472=1254844908
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=Sz…dTc6L7kdQmCJ750
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile - {D5233FCD-D258-4903-89B8-FB1568E7413D} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [FingerPrintNotifer] "C:\Program Files\TrueSuite Access Manager\FpNotifier.exe"
O4 - HKLM\..\Run: [UsbMonitor] "C:\Program Files\TrueSuite Access Manager\usbnotify.exe"
O4 - HKLM\..\Run: [PwdBank] "C:\Program Files\TrueSuite Access Manager\PwdBank.exe"
O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [CrossMenu] C:\Program Files\TOSHIBA\CrossMenu\CrossMenu.exe
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TAcelMgr] C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe
O4 - HKLM\..\Run: [TSkrMain] C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [ThpSrv] C:\WINDOWS\system32\thpsrv /logon
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TAudEffect] C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe /run
O4 - HKLM\..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE /Service
O4 - HKLM\..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE /Logon
O4 - HKLM\..\Run: [TOSDCR] TOSDCR.EXE
O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TRot.exe] c:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.exe
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [Act! Preloader] "C:\Program Files\ACT\ACT for Windows\Act8.exe" -stayrunning
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SmartSoft PDF Printer (demo) Agent] "C:\Program Files\Smart PDF Creator\sspdfagentd.exe"
O4 - HKLM\..\Run: [SmartSoft PDF Printer (demo) virtual printer agent] "C:\Program Files\Smart PDF Creator\sspdfagentd.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\NOS\bin\getPlus_Helper_3004.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Epson Stylus NX420(Network)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIGCA.EXE /FU "C:\WINDOWS\TEMP\E_S1A5.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Mike Petrushka\Application Data\Dropbox\bin\Dropbox.exe
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Attach Web page to ACT! contact - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Attach Web page to ACT! contact… - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CS3\Services\Tcpip\..\{0E3AF8A2-6CB7-4A4C-A485-52AA7613A120}: NameServer = 68.28.146.92 68.28.154.92
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: ATFUS - C:\WINDOWS\system32\FpWinLogonNp.dll
O20 - Winlogon Notify: TosBtNP - TosBtNP.dll (file missing)
O20 - Winlogon Notify: TSigNP - TSigNP.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Intel® Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: Authentec memory manager service (Authentec memory manager) - AuthenTec Inc. - C:\WINDOWS\system32\TAMSvr.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Fingerprint Server (FingerprintServer) - AuthenTec,Inc - C:\WINDOWS\system32\FpLogonServ.exe
O23 - Service: FlipShare Service - Unknown owner - C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel® Active Management Technology Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: Pantech Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Sprint\Pantech\Sprint Mobile Broadband (Pantech)\PWIUtilityService.exe
O23 - Service: pinger - Unknown owner - C:\Toshiba\IVP\ISM\pinger.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: VIPRE Antivirus (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv.exe
O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA Touch Pad Service (TTPDSrv) - TOSHIBA Corporation - C:\WINDOWS\System32\TTPDSRV.exe
O23 - Service: Intel® Active Management Technology User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\AMT\UNS.exe

–
End of file - 19609 bytes

Hello Hammerman and thanks for helping

here is part of the OTL report (I'm having problems getting it all to load at once)

OTL logfile created on: 7/29/2010 4:46:11 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Mike Petrushka\Desktop
Windows XP Tablet PC Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 18.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 54.00% Paging File free
Paging file location(s): C:\pagefile.sys 1500 3000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.99 Gb Total Space | 94.24 Gb Free Space | 65.45% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MDP_TOSHIBA
Current User Name: Mike Petrushka
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mike Petrushka\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe (Sunbelt Software)
PRC - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe (Sunbelt Software)
PRC - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe (Sunbelt Software)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Documents and Settings\Mike Petrushka\Application Data\Dropbox\bin\Dropbox.exe ()
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
PRC - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\Program Files\Flip Video\FlipShare\FlipShareService.exe ()
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\system32\wisptis.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\tabtip.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\tcserver.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\keyboardsurrogate.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\TTPDSRV.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
PRC - C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc)
PRC - C:\WINDOWS\system32\TPSODDCtl.exe (TOSHIBA Corporation)
PRC - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
PRC - C:\Program Files\Smart PDF Creator\sspdfagentd.exe ()
PRC - C:\WINDOWS\system32\igfxext.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
PRC - C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe (TOSHIBA)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\TPSBattM.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
PRC - C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Intel\AMT\UNS.exe (Intel Corporation)
PRC - C:\Program Files\Intel\AMT\atchksrv.exe (Intel Corporation)
PRC - C:\Program Files\Intel\AMT\LMS.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe ()
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\TrueSuite Access Manager\usbnotify.exe ()
PRC - C:\Program Files\TrueSuite Access Manager\CssSvr.exe (Arachnoid Biometrics Identification Group Corp.)
PRC - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
PRC - C:\Program Files\Toshiba\TOSHIBA Direct Disc Writer\DDWMon.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Sprint\Pantech\Sprint Mobile Broadband (Pantech)\PWIUtilityService.exe (Sprint Spectrum, L.L.C)
PRC - C:\TOSHIBA\IVP\ISM\pinger.exe ()
PRC - C:\TOSHIBA\IVP\ISM\Ivpsvmgr.exe (TOSHIBA Corporation)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe (SEIKO EPSON CORPORATION)
PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
PRC - C:\Program Files\Toshiba\TAudEffect\TAudEff.exe (TOSHIBA)
PRC - C:\Program Files\Toshiba\TOSHIBA Rotation Utility\TRot.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\TME3\TMERzCtl.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\TFNF5.exe (TOSHIBA Corp.)
PRC - C:\Program Files\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\TME3\TMESRV31.exe (TOSHIBA)
PRC - C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\TouchED\TouchED.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\Program Files\Toshiba\Acceleration Utilities\TAcelMgr\TAcelMgr.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\Acceleration Utilities\Shaker\TSkrMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\TME3\TMETEMnu.exe (TOSHIBA)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\tabbtnu.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Mike Petrushka\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Common Files\Microsoft Shared\Ink\tiptsf.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Microsoft Shared\Ink\tipcomponentsps.dll (Microsoft Corporation)
MOD - C:\WINDOWS\ime\sptip.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msctfp.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\xpsp2res.dll (Microsoft Corporation)
MOD - C:\WINDOWS\ime\spgrmr.dll (Microsoft Corporation)
MOD - C:\Program Files\Windows Journal\nbmaptip.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (SBAMSvc) – C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe (Sunbelt Software)
SRV - (SBPIMSvc) – C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe (Sunbelt Software)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (QBCFMonitorService) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (FlipShare Service) – C:\Program Files\Flip Video\FlipShare\FlipShareService.exe ()
SRV - (TTPDSrv) – C:\WINDOWS\system32\TTPDSRV.exe (TOSHIBA Corporation)
SRV - (FingerprintServer) – C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc)
SRV - (Swupdtmr) – c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
SRV - (Authentec memory manager) – C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
SRV - (EvtEng) Intel® – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (S24EventMonitor) Intel® – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel® – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (Thpsrv) – C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
SRV - (UNS) Intel® – C:\Program Files\Intel\AMT\UNS.exe (Intel Corporation)
SRV - (atchksrv) Intel® – C:\Program Files\Intel\AMT\atchksrv.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files\Intel\AMT\LMS.exe (Intel Corporation)
SRV - (CVPND) – C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (Pantech Utility Service) – C:\Program Files\Sprint\Pantech\Sprint Mobile Broadband (Pantech)\PWIUtilityService.exe (Sprint Spectrum, L.L.C)
SRV - (pinger) – C:\TOSHIBA\IVP\ISM\pinger.exe ()
SRV - (EpsonBidirectionalService) – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe (SEIKO EPSON CORPORATION)
SRV - (QBFCService) – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (AgereModemAudio) – C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
SRV - (TODDSrv) – C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (Tmesrv) – C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe (TOSHIBA)
SRV - (CFSvcs) – C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (MSSQL$ACT7) – C:\Program Files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$ACT7) – C:\Program Files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlagent.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (tbiosdrv) – C:\tbiosdrv.sys File not found
DRV - (qfxtjjho) – C:\WINDOWS\System32\01.tmp File not found
DRV - (PalmUSBD) – C:\WINDOWS\System32\drivers\PalmUSBD.sys File not found
DRV - (SBRE) – C:\WINDOWS\system32\drivers\SBREDrv.sys (Sunbelt Software)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (SbTis) – C:\WINDOWS\system32\drivers\sbtis.sys (Sunbelt Software, Inc.)
DRV - (sbapifs) – C:\WINDOWS\system32\drivers\sbapifs.sys (Sunbelt Software)
DRV - (sbaphd) – C:\WINDOWS\system32\drivers\sbaphd.sys (Sunbelt Software)
DRV - (NuidFltr) – C:\WINDOWS\system32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) – C:\WINDOWS\system32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (pxfhmdm) – C:\WINDOWS\system32\drivers\pxfhmdm.sys (MCCI)
DRV - (pxfhserd) PANTECH PC Card Diagnostic Serial Port (WDM) – C:\WINDOWS\system32\drivers\pxfhserd.sys (MCCI)
DRV - (pxfhbus) PANTECH PC Card Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\pxfhbus.sys (MCCI)
DRV - (pxfhmdfl) – C:\WINDOWS\system32\drivers\pxfhmdfl.sys (MCCI)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (AlfaFF) – C:\WINDOWS\system32\Drivers\AlfaFF.sys (Alfa Corporation)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (NETw4x32) Intel® – C:\WINDOWS\system32\drivers\NETw4x32.sys (Intel Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (CVPNDRVA) – C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (HECI) Intel® – C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (ialm) – C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (Thpdrv) – C:\WINDOWS\system32\DRIVERS\thpdrv.sys (TOSHIBA Corporation)
DRV - (UVCFTR) – C:\WINDOWS\system32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (e1express) Intel® – C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (tdudf) – C:\WINDOWS\system32\drivers\tdudf.sys (TOSHIBA Corporation)
DRV - (Thpevm) – C:\WINDOWS\system32\DRIVERS\Thpevm.SYS (TOSHIBA Corporation)
DRV - (tdcmdpst) – C:\WINDOWS\system32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (TEchoCan) – C:\WINDOWS\system32\drivers\TEchoCan.sys (TOSHIBA Corporation)
DRV - (trudf) – C:\WINDOWS\system32\drivers\trudf.sys (TOSHIBA Corporation)
DRV - (TVALZ) – C:\WINDOWS\system32\DRIVERS\TVALZ.SYS (TOSHIBA Corporation)
DRV - (iaStor) – C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (DNE) – C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (IFXTPM) – C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (CVirtA) – C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (tosrfec) – C:\WINDOWS\system32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Zone Labs LLC)
DRV - (TMEI3E) – C:\WINDOWS\system32\drivers\TMEI3E.sys (Toshiba Corporation)
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (TBtnKey) – C:\WINDOWS\system32\drivers\TBtnKey.sys (TOSHIBA)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://m.www.yahoo.com/?r472=1254844908
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://dsl.sbc.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.87

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/05/12 10:06:26 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/29 11:07:39 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/29 11:09:22 | 000,000,000 | —D | M]

[2008/07/19 18:23:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Mike Petrushka\Application Data\Mozilla\Extensions
[2010/07/29 12:38:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Mike Petrushka\Application Data\Mozilla\Firefox\Profiles\8jdyznpw.default\extensions
[2009/09/02 08:20:57 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Mike Petrushka\Application Data\Mozilla\Firefox\Profiles\8jdyznpw.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/29 11:09:13 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Mike Petrushka\Application Data\Mozilla\Firefox\Profiles\8jdyznpw.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/07/29 11:07:36 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/12/19 09:36:55 | 000,027,976 | —- | M] (WebEx Communications, Inc) – C:\Program Files\Mozilla Firefox\plugins\atgpcdec.dll
[2008/12/19 09:36:55 | 000,126,360 | —- | M] (WebEx Communications, Inc) – C:\Program Files\Mozilla Firefox\plugins\atgpcext.dll
[2008/12/19 09:37:10 | 000,046,408 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\atmccli.dll
[2008/12/19 09:37:18 | 000,098,712 | —- | M] (WebEx Communications, Inc) – C:\Program Files\Mozilla Firefox\plugins\ieatgpc.dll
[2008/12/19 09:36:53 | 000,060,824 | —- | M] (WebEx Communications, Inc) – C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll

O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Act! Preloader] C:\Program Files\ACT\ACT for Windows\Act8.exe (Sage Software SB, Inc)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [CrossMenu] C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe (TOSHIBA)
O4 - HKLM..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [FingerPrintNotifer] C:\Program Files\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe ()
O4 - HKLM..\Run: [PwdBank] C:\Program Files\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SBAMTray] C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe (Sunbelt Software)
O4 - HKLM..\Run: [SmartSoft PDF Printer (demo) Agent] C:\Program Files\Smart PDF Creator\sspdfagentd.exe ()
O4 - HKLM..\Run: [SmartSoft PDF Printer (demo) virtual printer agent] C:\Program Files\Smart PDF Creator\sspdfagentd.exe ()
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TabletTip] C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TabletWizard] C:\WINDOWS\Help\splshwrp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TAcelMgr] C:\Program Files\Toshiba\Acceleration Utilities\TAcelMgr\TAcelMgr.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TAudEffect] C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy] File not found
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TOSDCR] C:\WINDOWS\System32\TOSDCR.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TouchED] C:\Program Files\Toshiba\TouchED\TouchED.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPSODDCtl] C:\WINDOWS\System32\TPSODDCtl.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TRot.exe] c:\Program Files\Toshiba\TOSHIBA Rotation Utility\TRot.exe (TOSHIBA)
O4 - HKLM..\Run: [TSkrMain] C:\Program Files\Toshiba\Acceleration Utilities\Shaker\TSkrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [UsbMonitor] C:\Program Files\TrueSuite Access Manager\usbnotify.exe ()
O4 - HKCU..\Run: [Epson Stylus NX420(Network)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIGCA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKLM..\RunOnce: [Uninstall Adobe Download Manager] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe (Research In Motion Limited)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINDOWS\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico ()
O4 - Startup: C:\Documents and Settings\Mike Petrushka\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Mike Petrushka\Application Data\Dropbox\bin\Dropbox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\ATFUS: DllName - C:\WINDOWS\system32\FpWinLogonNp.dll - C:\WINDOWS\system32\FpWinlogonNp.dll (AuthenTec,Inc)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\loginkey: DllName - C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll - C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll (Microsoft Corporation)
O20 - Winlogon\Notify\TabBtnWL: DllName - TabBtnWL.dll - C:\WINDOWS\System32\tabbtnwl.dll (Microsoft Corporation)
O20 - Winlogon\Notify\TosBtNP: DllName - TosBtNP.dll - C:\WINDOWS\System32\TosBtNP.dll (TOSHIBA CORPORATION)
O20 - Winlogon\Notify\tpgwlnotify: DllName - tpgwlnot.dll - C:\WINDOWS\System32\tpgwlnot.dll (Microsoft Corporation)
O20 - Winlogon\Notify\TSigNP: DllName - TSigNP.dll - C:\WINDOWS\System32\TSigNP.dll (TOSHIBA)
O24 - Desktop WallPaper: C:\Documents and Settings\Mike Petrushka\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Mike Petrushka\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/23 21:59:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{0246e12f-7eb7-11df-ae35-001f3b4494df}\Shell\AutoRun\command - "" = E:\Setup_FlipShare.exe – File not found
O33 - MountPoints2\{0246e12f-7eb7-11df-ae35-001f3b4494df}\Shell\Setup FlipShare\command - "" = E:\Setup_FlipShare.exe – File not found
O33 - MountPoints2\{6f052e66-a3e1-11dd-ad8b-001f3b4494df}\Shell - "" = AutoRun
O33 - MountPoints2\{6f052e66-a3e1-11dd-ad8b-001f3b4494df}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{6f052e66-a3e1-11dd-ad8b-001f3b4494df}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O33 - MountPoints2\{8c91d71f-0432-11de-adab-001f3b4494df}\Shell - "" = AutoRun
O33 - MountPoints2\{8c91d71f-0432-11de-adab-001f3b4494df}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{b4cd8f6c-fab7-11dd-ada9-001f3b4494df}\Shell\AutoRun\command - "" = TASCPIP2008.exe
O33 - MountPoints2\{efe7caf0-37c3-11df-ae1f-001f3b4494df}\Shell - "" = AutoRun
O33 - MountPoints2\{efe7caf0-37c3-11df-ae1f-001f3b4494df}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{efe7caf0-37c3-11df-ae1f-001f3b4494df}\Shell\AutoRun\command - "" = E:\HPLauncher.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: azdlb - C:\WINDOWS\System32\gxzooqir.dll File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.3IV2 - C:\WINDOWS\System32\3ivxVfWCodec.dll (3ivx Technologies Pty. Ltd.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

Here is the second part of the OTL txt report



CREATERESTOREPOINT
Restore point Set: OTL Restore Point (69537874164318208)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/29 16:42:09 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Mike Petrushka\Desktop\OTL.exe
[2010/07/29 16:28:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Mike Petrushka\My Documents\Downloads
[2010/07/29 11:09:33 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2010/07/29 11:06:45 | 008,573,648 | —- | C] (Mozilla) – C:\Documents and Settings\Mike Petrushka\Desktop\Firefox Setup 3.6.8.exe
[2010/07/29 10:30:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Mike Petrushka\My Documents\Hijackthis log
[2010/07/29 10:27:31 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/07/29 07:41:20 | 000,064,288 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/07/29 07:16:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Mike Petrushka\Local Settings\Application Data\Sunbelt Software
[2010/07/29 07:09:50 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
[2010/07/29 07:09:17 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/07/29 07:09:17 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2010/07/29 06:59:49 | 128,750,008 | —- | C] (Lavasoft ) – C:\Documents and Settings\Mike Petrushka\Desktop\Ad-AwareInstall.exe
[2010/07/29 06:48:13 | 000,532,480 | —- | C] (Trend Micro Incorporated) – C:\Documents and Settings\Mike Petrushka\Desktop\cwshredder.exe
[2010/07/29 03:25:25 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/07/28 22:48:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Mike Petrushka\Application Data\Malwarebytes
[2010/07/28 22:48:29 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/28 22:48:28 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/28 22:48:28 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/28 22:48:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/28 22:47:20 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Mike Petrushka\Desktop\mbam-setup-1.46.exe
[2010/07/28 16:35:41 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/07/28 15:59:25 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/07/28 15:59:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/07/28 15:55:49 | 016,409,960 | —- | C] (Safer Networking Limited ) – C:\Documents and Settings\Mike Petrushka\Desktop\spybotsd162.exe
[2010/07/27 15:59:35 | 000,069,720 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\sbapifs.sys
[2010/07/27 15:59:35 | 000,013,400 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\sbaphd.sys
[2010/07/27 15:51:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Mike Petrushka\Application Data\Sunbelt
[2010/07/27 15:49:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sunbelt
[2010/07/27 15:47:36 | 000,204,632 | —- | C] (Sunbelt Software, Inc.) – C:\WINDOWS\System32\drivers\sbtis.sys
[2010/07/27 15:47:27 | 000,000,000 | —D | C] – C:\Program Files\Sunbelt Software
[2010/07/27 15:33:14 | 016,474,016 | —- | C] (Sunbelt Software ) – C:\Documents and Settings\Mike Petrushka\Desktop\vipre.exe
[2010/07/27 15:15:53 | 016,883,056 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Mike Petrushka\Desktop\IE8-WindowsXP-x86-ENU.exe
[2010/07/27 15:15:11 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Mike Petrushka\Recent
[2010/07/27 14:21:58 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/27 14:21:56 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/26 23:14:01 | 000,277,784 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\niexerpl.sys
[2010/07/26 21:33:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Mike Petrushka\Application Data\Epson
[2010/07/26 12:26:26 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/07/26 12:26:22 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/07/24 12:16:31 | 000,135,168 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EEBAPI.dll
[2010/07/24 12:16:31 | 000,110,592 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EEBDSCVR.dll
[2010/07/24 12:16:31 | 000,077,824 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EBAPI.dll
[2010/07/24 12:16:31 | 000,065,536 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EEBUtil.dll
[2010/07/24 12:16:31 | 000,055,808 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EEBSDKIF.dll
[2010/07/24 12:14:06 | 000,474,892 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\ensppmon.dll
[2010/07/24 12:14:06 | 000,474,892 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\enppmon.dll
[2010/07/24 12:14:06 | 000,457,611 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\ensppui.dll
[2010/07/24 12:14:06 | 000,457,611 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\enppui.dll
[2010/07/24 12:14:06 | 000,249,344 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\enspres.dll
[2010/07/24 12:14:06 | 000,249,344 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\enpres.dll
[2010/07/24 12:14:05 | 000,000,000 | —D | C] – C:\Program Files\EpsonNet
[2010/07/24 12:13:46 | 000,501,912 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\PICSDK2.dll
[2010/07/24 12:13:46 | 000,108,704 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\PICEntry.dll
[2010/07/24 12:13:46 | 000,080,024 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\PICSDK.dll
[2010/07/24 12:13:46 | 000,051,360 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EpPicPrt.dll
[2010/07/24 12:13:46 | 000,000,000 | —D | C] – C:\Program Files\Common Files\EPSON
[2010/07/24 12:13:45 | 000,051,360 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EpPicMgr.dll
[2010/07/24 12:13:16 | 000,093,696 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\E_FLBGCA.DLL
[2010/07/24 12:13:16 | 000,063,488 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\E_FD4BGCA.DLL
[2010/07/24 12:12:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\EPSON
[2010/07/24 12:12:07 | 000,000,000 | —D | C] – C:\Program Files\Epson Software
[2010/07/24 12:11:21 | 000,342,016 | —- | C] (Seiko Epson Corporation) – C:\WINDOWS\System32\eswiaud.dll
[2010/07/24 12:11:21 | 000,128,392 | —- | C] (Seiko Epson Corporation) – C:\WINDOWS\System32\esdevapp.exe
[2010/07/24 12:11:21 | 000,015,872 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\escdev.dll
[2010/07/24 12:11:14 | 000,000,000 | —D | C] – C:\Program Files\epson
[2010/07/20 23:50:46 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/07/20 23:50:36 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/07/13 22:26:55 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2007/11/23 23:17:53 | 000,049,152 | —- | C] ( ) – C:\WINDOWS\System32\BrigthDL.dll
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Mike Petrushka\My Documents\*.tmp files -> C:\Documents and Settings\Mike Petrushka\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/29 16:42:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Mike Petrushka\Desktop\OTL.exe
[2010/07/29 16:17:29 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/29 16:02:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/29 13:04:52 | 000,002,465 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Desktop\HiJackThis.lnk
[2010/07/29 11:17:07 | 007,077,888 | —- | M] () – C:\Documents and Settings\Mike Petrushka\ntuser.dat
[2010/07/29 11:07:42 | 000,001,631 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/07/29 11:07:42 | 000,001,613 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/07/29 11:06:45 | 008,573,648 | —- | M] (Mozilla) – C:\Documents and Settings\Mike Petrushka\Desktop\Firefox Setup 3.6.8.exe
[2010/07/29 09:45:50 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/07/29 07:49:33 | 000,000,256 | —- | M] () – C:\WINDOWS\System32\pool.bin
[2010/07/29 07:49:01 | 000,001,890 | -HS- | M] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2010/07/29 07:48:27 | 000,002,447 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
[2010/07/29 07:46:13 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/29 07:45:43 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/29 07:45:36 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/29 07:45:34 | 2104,332,288 | -HS- | M] () – C:\hiberfil.sys
[2010/07/29 07:41:17 | 000,095,024 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/07/29 07:09:49 | 000,000,896 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/07/29 07:09:49 | 000,000,878 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/07/29 06:59:59 | 128,750,008 | —- | M] (Lavasoft ) – C:\Documents and Settings\Mike Petrushka\Desktop\Ad-AwareInstall.exe
[2010/07/29 06:50:47 | 001,402,880 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Desktop\HiJackThis.msi
[2010/07/29 06:48:14 | 000,532,480 | —- | M] (Trend Micro Incorporated) – C:\Documents and Settings\Mike Petrushka\Desktop\cwshredder.exe
[2010/07/28 22:48:32 | 000,000,707 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/28 22:47:30 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Mike Petrushka\Desktop\mbam-setup-1.46.exe
[2010/07/28 18:00:00 | 000,000,462 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Registration3.job
[2010/07/28 15:59:30 | 000,000,962 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/07/28 15:59:30 | 000,000,944 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Desktop\Spybot - Search & Destroy.lnk
[2010/07/28 15:55:50 | 016,409,960 | —- | M] (Safer Networking Limited ) – C:\Documents and Settings\Mike Petrushka\Desktop\spybotsd162.exe
[2010/07/28 08:21:22 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Mike Petrushka\ntuser.ini
[2010/07/27 23:37:07 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/27 15:47:34 | 000,001,751 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VIPRE.lnk
[2010/07/27 15:33:14 | 016,474,016 | —- | M] (Sunbelt Software ) – C:\Documents and Settings\Mike Petrushka\Desktop\vipre.exe
[2010/07/27 15:15:53 | 016,883,056 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Mike Petrushka\Desktop\IE8-WindowsXP-x86-ENU.exe
[2010/07/26 23:34:34 | 000,000,000 | —- | M] () – C:\WINDOWS\EEventManager.INI
[2010/07/26 23:22:48 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/26 23:14:01 | 000,277,784 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\niexerpl.sys
[2010/07/26 11:58:12 | 000,000,530 | —- | M] () – C:\Documents and Settings\Mike Petrushka\My Documents\cc_20100726_115808.reg
[2010/07/24 12:19:25 | 000,000,071 | —- | M] () – C:\WINDOWS\ENX420.ini
[2010/07/24 12:11:24 | 000,000,676 | —- | M] () – C:\Documents and Settings\All Users\Desktop\EPSON Scan.lnk
[2010/07/23 15:10:26 | 000,008,236 | —- | M] () – C:\Documents and Settings\Mike Petrushka\My Documents\cc_20100723_151021.reg
[2010/07/21 07:30:39 | 044,497,656 | —- | M] () – C:\Documents and Settings\Mike Petrushka\My Documents\PS_AIO_Corporate_NonNetwork_DVD_NB.exe
[2010/07/20 23:51:52 | 000,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/07/15 21:12:20 | 000,000,759 | —- | M] () – C:\WINDOWS\win.ini
[2010/07/14 11:26:59 | 000,000,803 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2010/07/14 08:21:46 | 000,000,552 | —- | M] () – C:\WINDOWS\System32\DO_NOT_DELETE.backupSetID
[2010/07/13 19:19:37 | 000,193,270 | —- | M] () – C:\Documents and Settings\Mike Petrushka\My Documents\YWCA EES Brochure_FY10.pdf
[2010/07/12 03:55:39 | 000,064,288 | —- | M] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/07/12 03:55:38 | 000,015,880 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2010/07/11 16:29:43 | 000,066,048 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/08 20:14:17 | 003,168,431 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Desktop\LJ Graduation 010.JPG
[2010/07/08 20:13:23 | 004,952,412 | —- | M] () – C:\Documents and Settings\Mike Petrushka\Desktop\0701Rabat_024.JPG
[2010/07/07 20:44:22 | 000,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[2010/07/07 00:31:23 | 000,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2010/07/05 21:52:20 | 000,002,838 | —- | M] () – C:\WINDOWS\machine.ver
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Mike Petrushka\My Documents\*.tmp files -> C:\Documents and Settings\Mike Petrushka\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

Hi,

Please follow these steps.

– Step 1 –

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent malware removal tools from fixing certain things.
Please disable TeaTimer for now until you are clean.

• Open Spybot Search & Destroy.
• In the Mode menu click "Advanced mode" if not already selected.
• Choose "Yes" at the Warning prompt.
• Expand the "Tools" menu.
• Click "Resident".
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
• In the File menu click "Exit" to exit Spybot Search & Destroy.

– Step 2 –

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  DRV - (qfxtjjho) – C:\WINDOWS\System32\01.tmp File not found
  O4 - HKLM..\Run: []  File not found
  O33 - MountPoints2\{0246e12f-7eb7-11df-ae35-001f3b4494df}\Shell\AutoRun\command - "" = E:\Setup_FlipShare.exe – File not found
  O33 - MountPoints2\{0246e12f-7eb7-11df-ae35-001f3b4494df}\Shell\Setup FlipShare\command - "" = E:\Setup_FlipShare.exe – File not found
  O33 - MountPoints2\{6f052e66-a3e1-11dd-ad8b-001f3b4494df}\Shell - "" = AutoRun
  O33 - MountPoints2\{6f052e66-a3e1-11dd-ad8b-001f3b4494df}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{6f052e66-a3e1-11dd-ad8b-001f3b4494df}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
  O33 - MountPoints2\{8c91d71f-0432-11de-adab-001f3b4494df}\Shell - "" = AutoRun
  O33 - MountPoints2\{8c91d71f-0432-11de-adab-001f3b4494df}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{b4cd8f6c-fab7-11dd-ada9-001f3b4494df}\Shell\AutoRun\command - "" = TASCPIP2008.exe
  O33 - MountPoints2\{efe7caf0-37c3-11df-ae1f-001f3b4494df}\Shell - "" = AutoRun
  O33 - MountPoints2\{efe7caf0-37c3-11df-ae1f-001f3b4494df}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{efe7caf0-37c3-11df-ae1f-001f3b4494df}\Shell\AutoRun\command - "" = E:\HPLauncher.exe – File not found
  
  :Services
  
  :Reg
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [start explorer]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• This fix will produce a report. Please add this to your reply.

– Step 3 –

Download TDSSKiller and save it to your Desktop.

• Extract the file and run it.
• Once completed it will create a log in the root directory (usually C:\).
• Please post the contents of that log in your next reply.

– Step 4 –

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Hammerman

OK - rebooted (actually hard shutdown w/ power button) then restarted then ran Combofix again.

I think I had adaware running and didn't shut it down - my bad.

Regardless, Combofix executed, here is the result:

ComboFix 10-07-30.01 - Mike Petrushka 07/30/2010 20:00:03.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2007.1007 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Sunbelt VIPRE *On-access scanning disabled* (Updated) {964FCE60-0B18-4D30-ADD6-EB178909041C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\ACT! 2006
c:\documents and settings\All Users\Start Menu\Programs\ACT! 2006 \ACT! 2006 .lnk
c:\documents and settings\All Users\Start Menu\Programs\ACT! 2006 \Read Me.lnk
c:\documents and settings\All Users\Start Menu\Programs\ACT! 2006 \Uninstall.lnk
c:\documents and settings\All Users\Start Menu\Programs\ACT! 2006 \User Guide.lnk
c:\documents and settings\Mike Petrushka\g2mdlhlpx.exe
c:\documents and settings\Mike Petrushka\System
c:\documents and settings\Mike Petrushka\System\win_qs8.jqx
c:\windows\system32\bszip.dll

.
((((((((((((((((((((((((( Files Created from 2010-06-28 to 2010-07-31 )))))))))))))))))))))))))))))))
.

2010-07-30 17:43 . 2010-07-30 17:43 ——– d—–w- C:\_OTL
2010-07-29 16:09 . 2010-07-29 16:15 ——– d—–w- c:\program files\McAfee Security Scan
2010-07-29 15:27 . 2010-07-29 15:27 388096 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-29 15:27 . 2010-07-29 15:27 ——– d—–w- c:\program files\Trend Micro
2010-07-29 15:02 . 2010-07-12 08:55 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-07-29 12:41 . 2010-07-12 08:55 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-29 12:16 . 2010-07-29 12:16 ——– d—–w- c:\documents and settings\Mike Petrushka\Local Settings\Application Data\Sunbelt Software
2010-07-29 12:09 . 2010-07-29 12:09 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-29 12:09 . 2010-07-12 08:56 2979280 -c–a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe
2010-07-29 12:09 . 2010-07-29 12:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-29 12:09 . 2010-07-29 12:09 ——– d—–w- c:\program files\Lavasoft
2010-07-29 08:25 . 2010-07-29 08:32 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Malwarebytes
2010-07-29 03:48 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-29 03:48 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-28 20:59 . 2010-07-28 22:40 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-28 20:59 . 2010-07-28 21:02 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-07-27 20:59 . 2010-01-04 11:29 69720 —-a-w- c:\windows\system32\drivers\sbapifs.sys
2010-07-27 20:59 . 2010-01-04 11:29 13400 —-a-w- c:\windows\system32\drivers\sbaphd.sys
2010-07-27 20:51 . 2010-07-27 20:51 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Sunbelt
2010-07-27 20:49 . 2010-07-27 20:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Sunbelt
2010-07-27 20:47 . 2010-05-26 18:57 204632 —-a-w- c:\windows\system32\drivers\sbtis.sys
2010-07-27 20:47 . 2010-07-27 20:47 ——– d—–w- c:\program files\Sunbelt Software
2010-07-27 19:22 . 2010-07-27 19:22 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-07-27 04:14 . 2010-07-27 04:14 277784 —-a-w- c:\windows\system32\drivers\niexerpl.sys
2010-07-27 02:33 . 2010-07-27 02:33 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Epson
2010-07-26 16:23 . 2010-07-30 21:23 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-07-24 17:13 . 2006-10-31 05:10 51360 —-a-w- c:\windows\system32\EpPicPrt.dll
2010-07-24 17:12 . 2010-07-24 17:16 ——– d—–w- c:\documents and settings\All Users\Application Data\EPSON
2010-07-24 17:12 . 2010-07-24 17:12 ——– d—–w- c:\program files\Epson Software
2010-07-24 17:11 . 2009-09-17 05:00 342016 —-a-w- c:\windows\system32\eswiaud.dll
2010-07-24 17:11 . 2009-05-01 05:00 15872 —-a-w- c:\windows\system32\escdev.dll
2010-07-24 17:11 . 2009-05-01 05:00 128392 —-a-w- c:\windows\system32\esdevapp.exe
2010-07-24 17:11 . 2010-07-24 17:12 ——– d—–w- c:\program files\epson
2010-07-21 04:50 . 2010-07-21 04:50 ——– d—–w- c:\program files\iPod
2010-07-21 04:50 . 2010-07-21 04:51 ——– d—–w- c:\program files\iTunes
2010-07-21 04:45 . 2010-07-21 04:45 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe
2010-07-14 03:26 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-31 01:06 . 2010-05-10 19:44 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Skype
2010-07-31 00:58 . 2009-01-05 20:17 256 —-a-w- c:\windows\system32\pool.bin
2010-07-31 00:56 . 2010-05-10 19:47 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\skypePM
2010-07-31 00:56 . 2008-09-25 21:23 1890 –sha-w- c:\windows\system32\KGyGaAvL.sys
2010-07-31 00:55 . 2010-02-03 13:01 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox
2010-07-31 00:53 . 2007-11-24 04:49 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-07-29 16:14 . 2007-11-24 16:34 ——– d—–w- c:\program files\Google
2010-07-29 16:09 . 2007-11-24 04:53 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-07-29 12:41 . 2009-10-13 14:02 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-07-27 04:24 . 2010-07-29 08:25 176702 —-a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2010-07-24 17:16 . 2010-07-24 17:13 ——– d—–w- c:\program files\Common Files\EPSON
2010-07-24 17:14 . 2010-07-24 17:14 ——– d—–w- c:\program files\EpsonNet
2010-07-24 17:14 . 2007-11-24 04:09 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-21 04:50 . 2010-01-16 22:05 ——– d—–w- c:\program files\Common Files\Apple
2010-07-20 21:43 . 2009-06-29 17:36 2381 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2007\qbbackup.sys
2010-07-08 01:44 . 2010-06-21 12:51 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdw.DAT
2010-07-07 05:31 . 2010-06-21 12:47 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2010-07-01 23:01 . 2010-05-04 16:34 439816 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Real\Update\setup3.10\setup.exe
2010-06-29 20:35 . 2010-01-16 22:09 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Apple Computer
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\program files\3ivx
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\program files\Flip Video
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Flip Video
2010-06-23 21:11 . 2010-06-23 21:11 501936 —-a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb1D.tmp.exe
2010-06-21 13:05 . 2010-06-21 13:01 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Nikon
2010-06-21 13:05 . 2010-06-21 12:50 ——– d—–w- c:\program files\Common Files\Nikon
2010-06-21 13:00 . 2010-06-21 12:46 ——– d—–w- c:\documents and settings\All Users\Application Data\ArcSoft
2010-06-21 12:54 . 2010-06-21 12:54 49152 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2010-06-21 12:53 . 2010-06-21 12:53 335872 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2010-06-21 12:53 . 2010-06-21 12:53 57344 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2010-06-21 12:52 . 2010-06-21 12:50 ——– d—–w- c:\program files\Nikon
2010-06-21 12:51 . 2010-06-21 12:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Ultima_T15
2010-06-21 12:51 . 2010-06-21 12:47 ——– d—–w- c:\documents and settings\All Users\Application Data\EnterNHelp
2010-06-21 12:50 . 2010-06-21 12:50 ——– d—–w- c:\program files\Common Files\muvee Technologies
2010-06-21 12:50 . 2010-06-21 12:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Nikon
2010-06-21 12:47 . 2003-03-19 01:05 106496 —-a-w- c:\windows\system32\ATL71.DLL
2010-06-21 12:46 . 2010-03-27 10:25 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\ArcSoft
2010-06-21 12:45 . 2010-06-21 12:45 ——– d—–w- c:\program files\Common Files\ArcSoft
2010-06-21 12:45 . 2010-06-21 12:45 ——– d—–w- c:\program files\ArcSoft
2010-06-19 18:49 . 2010-06-19 18:49 ——– d—–w- c:\program files\Bonjour
2010-06-19 18:46 . 2010-06-19 18:46 ——– d—–w- c:\program files\Safari
2010-06-19 18:44 . 2010-06-19 18:44 71992 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-17 17:22 . 2010-06-17 17:22 27984 —-a-w- c:\windows\system32\sbbd.exe
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\documents and settings\All Users\Application Data\FileCure
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\program files\Common Files\ParetoLogic
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\program files\ParetoLogic
2010-06-14 14:31 . 2007-11-24 02:57 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-09 12:26 . 2009-01-05 17:41 ——– d—–w- c:\program files\palmOne
2010-06-09 11:40 . 2007-11-24 04:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-18 21:35 . 2010-05-18 21:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 21:35 . 2010-05-18 21:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-05-10 19:47 . 2010-05-10 19:47 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-05-06 10:41 . 2007-11-24 01:42 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2007-11-24 01:42 1851264 —-a-w- c:\windows\system32\win32k.sys
2008-12-19 14:36 . 2008-12-19 14:36 27976 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-12-19 14:36 . 2008-12-19 14:36 126360 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2008-12-19 14:37 . 2008-12-19 14:37 46408 —-a-w- c:\program files\mozilla firefox\plugins\atmccli.dll
2008-12-19 14:37 . 2008-12-19 14:37 98712 —-a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
2008-09-25 21:23 . 2008-09-25 21:23 56 –sh–r- c:\windows\system32\4753598D8E.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOvrly1]
@="{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}"
[HKEY_CLASSES_ROOT\CLSID\{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}]
2007-04-20 18:40 118784 —-a-w- c:\program files\TrueSuite Access Manager\IconOvrly.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2007-01-09 191552]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-10-15 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-10-15 137752]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-05-22 413696]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe" [2007-09-26 671744]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2007-06-05 94208]
"PwdBank"="c:\program files\TrueSuite Access Manager\PwdBank.exe" [2007-11-09 3152896]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-14 271872]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-03-24 196608]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"CrossMenu"="c:\program files\TOSHIBA\CrossMenu\CrossMenu.exe" [2007-10-12 806912]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2007-08-23 258048]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"NDSTray.exe"="NDSTray.exe" [BU]
"TAcelMgr"="c:\program files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe" [2004-12-16 90112]
"TSkrMain"="c:\program files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe" [2004-07-01 49152]
"TFncKy"="TFncKy.exe" [BU]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-14 311296]
"TFNF5"="TFNF5.exe" [2006-04-11 622592]
"TAudEffect"="c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2006-08-10 344144]
"TMERzCtl.EXE"="c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2006-04-27 90112]
"TMESRV.EXE"="c:\program files\TOSHIBA\TME3\TMESRV31.EXE" [2005-12-14 126976]
"TOSDCR"="TOSDCR.EXE" [2005-12-13 57344]
"TPSODDCtl"="TPSODDCtl.exe" [2007-11-01 126976]
"TPSMain"="TPSMain.exe" [2007-10-16 315392]
"TRot.exe"="c:\program files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe" [2006-07-21 327680]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.exe" [2005-06-29 126976]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-17 49152]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2007-04-10 159744]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2007-01-26 136816]
"Act! Preloader"="c:\program files\ACT\ACT for Windows\Act8.exe" [2006-04-06 1015808]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-12 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SmartSoft PDF Printer (demo) Agent"="c:\program files\Smart PDF Creator\sspdfagentd.exe" [2007-10-22 94208]
"SmartSoft PDF Printer (demo) virtual printer agent"="c:\program files\Smart PDF Creator\sspdfagentd.exe" [2007-10-22 94208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-15 479232]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-16 141608]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"SBAMTray"="c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe" [2010-06-17 1295696]

c:\documents and settings\Mike Petrushka\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2007-11-12 1447184]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-9-16 972064]
VPN Client.lnk - c:\windows\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico [2008-10-31 6144]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATFUS]
2007-11-02 19:42 176128 —-a-w- c:\windows\system32\FpWinlogonNp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 —-a-w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 11:41 11776 —-a-w- c:\windows\system32\tabbtnwl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TosBtNP]
2006-07-22 03:54 65536 —-a-w- c:\windows\system32\TosBtNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 —-a-w- c:\windows\system32\tpgwlnot.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TSigNP]
2007-11-14 05:17 65536 —-a-w- c:\windows\system32\TSigNP.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\ACT\\ACT for Windows\\Act8.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Mike Petrushka\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9844:TCP"= 9844:TCP:adielhla

R0 AlfaFF;AlfaFF mini-filter driver;c:\windows\system32\drivers\AlfaFF.sys [4/15/2008 2:51 PM 43184]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/29/2010 7:41 AM 64288]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [4/27/2007 1:19 PM 21120]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [3/9/2007 6:23 PM 6528]
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [7/27/2010 3:59 PM 13400]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [10/13/2009 9:02 AM 95024]
R1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [7/27/2010 3:47 PM 204632]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [11/23/2007 11:34 PM 5888]
R2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [4/15/2008 2:51 PM 49152]
R2 FingerprintServer;Fingerprint Server;c:\windows\system32\FpLogonServ.exe [4/15/2008 2:51 PM 106496]
R2 MSSQL$ACT7;MSSQL$ACT7;c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe -sACT7 –> c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe -sACT7 [?]
R2 SBAMSvc;VIPRE Antivirus;c:\program files\Sunbelt Software\VIPRE\SBAMSvc.exe [6/17/2010 12:23 PM 2730120]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [7/27/2010 3:59 PM 69720]
R2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\VIPRE\SBPIMSvc.exe [6/17/2010 12:21 PM 181584]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/26/2007 3:22 PM 105856]
R2 Tmesrv;Tmesrv3;c:\program files\Toshiba\TME3\TMESRV31.exe [11/23/2007 11:34 PM 126976]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/19/2007 3:15 PM 134016]
R2 TTPDSrv;TOSHIBA Touch Pad Service;c:\windows\system32\TTPDSRV.exe [11/23/2007 11:09 PM 73728]
R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [4/15/2008 2:43 PM 1464856]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [11/24/2007 1:11 PM 36608]
R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\drivers\TBtnKey.sys [11/23/2007 11:45 PM 8832]
R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [11/23/2007 11:33 PM 435072]
R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [4/15/2008 2:41 PM 14208]
S2 azdlb;fwvoq;c:\windows\system32\svchost.exe -k netsvcs [11/23/2007 8:41 PM 14336]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 4:47 PM 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 3:55 AM 1352832]
S3 SQLAgent$ACT7;SQLAgent$ACT7;c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlagent.EXE -i ACT7 –> c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlagent.EXE -i ACT7 [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - KLMDB
*Deregistered* - klmdb

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
azdlb
.
Contents of the 'Scheduled Tasks' folder

2010-07-31 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 08:55]

2010-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2010-07-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 21:46]

2010-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 21:46]

2010-07-29 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://m.www.yahoo.com/?r472=1254844908
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=SzOIxg3ov9WUdTc6L7kdQmCJ750
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
FF - ProfilePath - c:\documents and settings\Mike Petrushka\Application Data\Mozilla\Firefox\Profiles\8jdyznpw.default\
FF - prefs.js: browser.startup.homepage - hxxp://dsl.sbc.yahoo.com/
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-klmdb.sys
AddRemove-{F46BF5EA-0B4E-4A41-8C4B-3B127346E30F} - c:\documents and settings\Mike Petrushka\Local Settings\Application Data\{2853BFD5-3865-45EB-A4E3-967D4A9B969A}\NBCDirectInstaller.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-30 20:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1400)
c:\windows\system32\FpWinLogonNp.dll
c:\program files\TrueSuite Access Manager\FpSuites.dll
c:\program files\TrueSuite Access Manager\SharedResources.dll
c:\program files\TrueSuite Access Manager\FPResource.dll
c:\windows\system32\TSigNP.dll
c:\windows\system32\netprovcredman.dll
.
Completion time: 2010-07-30 20:07:47
ComboFix-quarantined-files.txt 2010-07-31 01:07

Pre-Run: 101,231,542,272 bytes free
Post-Run: 101,277,716,480 bytes free

- - End Of File - - 2FEDE58B88700BD27D103CEC473F9226