pc was gift need help to cean up

Hi guys and thanks for taking the time to look this over. I just got this system from a friend.

The system specs are: compaq presario 6000 / xp home sp3 / AMD Athlon XP 1800+ processor / 512 ram

device manager reports no hardware conflicts. Event viewer reports the following:
******The following boot-start or system-start driver(s) failed to load:
AmdK7 - processor
Fips - MS kernel mode crytographic module
kl1 - may be ZA associated
KLlF - concern based on location … may be Kaspersky associated, however the current security
Zone Alarm AV is Kasperksy driven
File in question located in search for KLiF is:

C:\WINDOWS\system32\CatRoot\{127DA1D-4EF2-11D1-8608-OOCO4FC295EE}

The name "WORKGROUP :1d" could not be registered on the Interface with IP address 192168.1.2. The machine with the IP address 192168.1.3 did not allow the name to be claimed by this machine.
Failed auto update retrieval of third-party root list sequence number from <http://www.download. windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot preform the requested operation.
Fault bucket 1180947459.
***************

Current symptoms include random but less frequent system freezes and system must be powered down manually (push i/o button),when system freezes … occasionally on re-boot, internet wireless software is unrecognized and hence re-installed (3 or 4 times), however, it could sometimes be fixed by running disk clean up and restarting the pc. I have received e-mails from myself that i did not send. The e-mails contained links to an on-line drug store.

I have run the following and received clean reports from Zone Alarm, MalwareBytes, ATF Cleaner and CCleaner. Erunt has been run, system defragged, disc clean and Windows Defender reports clean.

In an earlier post it was recommended that i download and install Regseeker. Using that i was making progress with cleaning up this system until MalwareBytes identified the Regseeker program as a Trojan and subsequently removed it.
items in this HJT marked with –> got my attention as mysterious. Thanks for your attention and assistance. araviss

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:14:05 AM, on 9/18/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Admin\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Yahoo! Companion BHO - {13F537F0-AF09-11d6-9029-0002B31F9E59} - C:\Program Files\Yahoo!\Common\ycomp5,0,8,0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,0,8,0.dll
–> O3 - Toolbar: (no name) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
–> O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
–> O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h20364.www2.hp.com/CSMWeb/Customer/…DataManager.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1262049563240
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1262049529911
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/popc…aploader_v6.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ZoneAlarm ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 8131 bytes

******************************************

Also, from a listing of the directory, many of the following entries indicate infections when googled and i'm not sure how or which to remove. Please advise.


C:\Documents and Settings\Admin\ml1.srt
C:\Documents and Settings\Admin\ml2.srt
C:\Documents and Settings\Admin\tempdiff.txt
C:\Documents and Settings\Admin\oobecmt.ini
C:\Documents and Settings\Admin\SIFerrorlog.txt
C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\cookies.sqlite
C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions.ini
C:\Documents and Settings\Admin\Application Data\Real\rnadmin
C:\Documents and Settings\Admin\Application Data\Real\rnadmin\rnsystem.dat
C:\Documents and Settings\Admin\Application Data\Sun\Java\Deployment\tmp\si
C:\Documents and Settings\Admin\Application Data\Uniblue\RegistryBooster
C:\Documents and Settings\Admin\Application Data\Uniblue\RegistryBooster\backup
C:\Documents and Settings\Admin\Application Data\Uniblue\RegistryBooster\error.log
C:\Documents and Settings\Admin\Application Data\Uniblue\RegistryBooster\history
C:\Documents and Settings\Admin\Application Data\Uniblue\RegistryBooster\last_scan.dat
C:\Documents and Settings\Admin\Application Data\Uniblue\RegistryBooster\settings.dat
C:\Documents and Settings\Admin\Application Data\Uniblue\RegistryBooster\_temp
C:\Documents and Settings\Admin\Application Data\Uniblue\RegistryBooster\history\latest_scan_results.html
C:\Documents and Settings\Admin\Application Data\VERITAS\Update Manager
C:\Documents and Settings\Admin\Application Data\VERITAS\Update Manager\sumdb.dat
C:\Documents and Settings\Admin\Desktop\resume_files\imsdk_2.swf
C:\Documents and Settings\Admin\Favorites\CreditReport.com Credit Center.url
C:\Documents and Settings\Admin\Favorites\Compaq Favorites\Netsmartz.url
C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Money\10.0
C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Money\10.0\urlmap.db
C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Windows Media\11.0\WMSDKNS.DTD
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp
C:\Documents and Settings\Admin\Local Settings\Temp\jusched.log
C:\Documents and Settings\Admin\Local Settings\Temp\MAR1.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR10.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR11.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR12.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR13.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR14.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR15.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR16.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR17.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR18.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR19.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR1A.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR2.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR3.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR3B.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR3C.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR3D.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR3E.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR3F.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR4.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR40.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR5.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR6.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR7.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR8.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MAR9.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MARA.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MARB.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MARC.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MARD.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MARE.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\MARF.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\RedboxLog.txt
C:\Documents and Settings\Admin\Local Settings\Temp\~DF1B36.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\~DF48BE.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\~DF57D0.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\~DF6AD8.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\~DF88FE.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\~DF8906.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\~DFAD9C.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\~DFC6AF.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\~DFE88E.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\PA
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\WH
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\AK_DLL.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\CPLic.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\FFApi.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWAK.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWDMP.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWFRAME.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWFWMON.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWGUI.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWMENUS.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWSHEX.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWSPYSCAN.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWSTATS.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWUILIB.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWUL.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWUL_MIN.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWUPD.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\ISWVEXT.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\Logs\SiteChecker.swl
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\PA\2f7fb469b38f8ae1e9c72c2b0e209141
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\PA\af7b8ad67db3546d993b55aa9999992d
C:\Documents and Settings\Admin\Local Settings\Temp\IswTmp\WH\0
C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\index.dat
C:\Documents and Settings\Admin\My Documents\RegSeeker

Ok here's all the things that you asked for. I don't know if this matters or not, but should i have gone in and shown all hidden files and such? Just wanting to make sure that i didn't mess things up worse than they already are. If there is anything else i need to do just let me know. And thanks again for your assistence.



MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0200001d

Kernel Drivers (total 121):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806FF000 \WINDOWS\system32\hal.dll
0xF7A09000 \WINDOWS\system32\KDCOM.DLL
0xF7919000 \WINDOWS\system32\BOOTVID.dll
0xF74BA000 ACPI.sys
0xF7A0B000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF74A9000 pci.sys
0xF7509000 isapnp.sys
0xF791D000 compbatt.sys
0xF7921000 \WINDOWS\System32\DRIVERS\BATTC.SYS
0xF7A0D000 viaide.sys
0xF7789000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF7519000 MountMgr.sys
0xF748A000 ftdisk.sys
0xF7791000 PartMgr.sys
0xF7529000 VolSnap.sys
0xF7472000 atapi.sys
0xF7539000 disk.sys
0xF7549000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF7452000 fltmgr.sys
0xF7440000 sr.sys
0xF7429000 KSecDD.sys
0xF7416000 WudfPf.sys
0xF7389000 Ntfs.sys
0xF735C000 NDIS.sys
0xF7799000 viaagp1.sys
0xF77A1000 SISAGP.sys
0xF7342000 Mup.sys
0xF6E22000 kl1.sys
0xF77A9000 \WINDOWS\System32\DRIVERS\TDI.SYS
0xF7559000 agp440.sys
0xF76D9000 \SystemRoot\System32\DRIVERS\amdk7.sys
0xF6DB1000 \SystemRoot\System32\DRIVERS\s3gnbm.sys
0xF6D9D000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF7821000 \SystemRoot\System32\DRIVERS\RTL8139.SYS
0xF7829000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF6D79000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF7831000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF76E9000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF79B9000 \SystemRoot\system32\drivers\pfc.sys
0xF76F9000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF7709000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF6D56000 \SystemRoot\System32\DRIVERS\ks.sys
0xF6B29000 \SystemRoot\system32\drivers\ALCXWDM.SYS
0xF6B05000 \SystemRoot\system32\drivers\portcls.sys
0xF7719000 \SystemRoot\system32\drivers\drmk.sys
0xF7839000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF7729000 \SystemRoot\System32\DRIVERS\serial.sys
0xF79C1000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF6AF1000 \SystemRoot\System32\DRIVERS\parport.sys
0xF7739000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF7841000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF7849000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF7A19000 \SystemRoot\System32\DRIVERS\serscan.sys
0xF7C25000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF7749000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF79C5000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF6AC9000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF7759000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF7769000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF6AB8000 \SystemRoot\System32\DRIVERS\psched.sys
0xF7779000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF7851000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF7859000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF7599000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF7A1B000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF6997000 \SystemRoot\System32\DRIVERS\update.sys
0xF79D1000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF75A9000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF75D9000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF7A21000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF7871000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF416F000 \SystemRoot\system32\DRIVERS\klif.sys
0xF7A23000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7B1F000 \SystemRoot\System32\Drivers\Null.SYS
0xF7A25000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7881000 \SystemRoot\System32\drivers\vga.sys
0xF7A27000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7A29000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7889000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7891000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF6DFA000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xF4114000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xF40BB000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xF4093000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF4013000 \SystemRoot\System32\vsdatant.sys
0xF3FED000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF3FCB000 \SystemRoot\System32\drivers\afd.sys
0xF7609000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF3FA0000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xF3F30000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF7629000 \SystemRoot\System32\Drivers\Fips.SYS
0xF7639000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF3798000 \SystemRoot\system32\DRIVERS\wg111v3.sys
0xF78A9000 \SystemRoot\System32\DRIVERS\usbccgp.sys
0xF6A98000 \SystemRoot\system32\drivers\usbaudio.sys
0xF79B5000 \SystemRoot\System32\DRIVERS\hidusb.sys
0xF6A88000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
0xF78B1000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xF3177000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF315F000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7A4D000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF3F20000 \SystemRoot\System32\drivers\Dxapi.sys
0xF77D1000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7B20000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\s3gnb.dll
0xF77E9000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xF75C9000 \SystemRoot\system32\DRIVERS\EAPPkt.sys
0xF0B07000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xF77F9000 \??\C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
0xF088A000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF084D000 \SystemRoot\system32\drivers\wdmaud.sys
0xF7699000 \SystemRoot\system32\drivers\sysaudio.sys
0xF7A93000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF0520000 \SystemRoot\System32\DRIVERS\srv.sys
0xF03A8000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF00A7000 \SystemRoot\System32\Drivers\HTTP.sys
0xEFB2C000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 41):
0 System Idle Process
4 System
584 C:\WINDOWS\system32\smss.exe
640 csrss.exe
664 C:\WINDOWS\system32\winlogon.exe
708 C:\WINDOWS\system32\services.exe
720 C:\WINDOWS\system32\lsass.exe
868 C:\WINDOWS\system32\svchost.exe
912 svchost.exe
948 C:\Program Files\Windows Defender\MsMpEng.exe
992 C:\WINDOWS\system32\svchost.exe
1032 C:\WINDOWS\system32\svchost.exe
1256 svchost.exe
1308 svchost.exe
1436 C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
1500 C:\WINDOWS\system32\spoolsv.exe
1720 svchost.exe
1768 C:\WINDOWS\explorer.exe
1932 C:\WINDOWS\system32\svchost.exe
1948 C:\WINDOWS\system32\svchost.exe
1980 C:\Program Files\Java\jre6\bin\jqs.exe
2036 C:\WINDOWS\system32\svchost.exe
124 C:\WINDOWS\system32\svchost.exe
216 C:\WINDOWS\system32\tcpsvcs.exe
248 C:\WINDOWS\system32\svchost.exe
456 C:\WINDOWS\system32\wuauclt.exe
1264 C:\WINDOWS\system\hpsysdrv.exe
1372 C:\Program Files\Windows Defender\MSASCui.exe
1408 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1416 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
1552 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
1616 C:\WINDOWS\system32\ctfmon.exe
1632 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
1648 C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
2116 alg.exe
2356 C:\WINDOWS\system32\wscntfy.exe
4060 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
376 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
1228 C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
1016 C:\WINDOWS\system32\svchost.exe
3912 C:\Documents and Settings\Admin\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`dd05e000 (NTFS)
\\.\D: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)

PhysicalDrive0 Model Number: SAMSUNGSV4002H, Rev: QP100-07

Size Device Name MBR Status
——————————————–
37 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 7D48A7E764A5D83438A39192BFF3677448B54B84


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!




DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 22:45:35.23 on Sun 09/19/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.170 [GMT -4:00]

AV: ZoneAlarm Extreme Security Antivirus *On-access scanning enabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: PC Live Guard *On-access scanning enabled* (Updated) {760259B0-BF35-4CE8-B3FD-A5C7BD8AF6B0}
FW: PC Live Guard *enabled* {0F80880A-2526-4585-AE87-FC5C27C1C071}
FW: ZoneAlarm Extreme Security Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\windows\system\hpsysdrv.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Admin\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://srch-qus7.hpwis.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Yahoo! Companion BHO: {13f537f0-af09-11d6-9029-0002b31f9e59} - c:\program files\yahoo!\common\ycomp5,0,8,0.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: ZoneAlarm Toolbar Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Yahoo! Companion: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\common\ycomp5,0,8,0.dll
TB: {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - No File
TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\program files\yahoo!\messenger\yhexbmes.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [WCOLOREAL] "c:\program files\compaq\coloreal\coloreal.exe"
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [VTPreset] VTPreset.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [REGSHAVE] c:\program files\regshave\REGSHAVE.EXE /AUTORUN
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v3\WG111v3.exe
mPolicies-explorer: =
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2499216C-4BA5-11D5-BD9C-000103C116D5} - {2499216C-4BA5-11D5-BD9C-000103C116D5} - c:\program files\yahoo!\common\ylogin.dll
IE: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - {4C171D40-8277-11D5-AD55-00010333D0AD} - c:\program files\yahoo!\messenger\yhexbmes.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxp://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262049563240
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1262049529911
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
IFEO: image file execution options - svchost.exe

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admin\applic~1\mozilla\firefox\profiles\q6qlul0d.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\MozillaDownload.dll
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\MozillaExtensions.dll
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBook.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBookDB.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpNeoLogger.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSaturn.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSeymour.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartSelect.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSWPOperation.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPLogging.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTC.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTL.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXREStub.dll
FF - plugin: c:\documents and settings\admin\application data\mozilla\firefox\profiles\q6qlul0d.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\plugins\nphpclipbook.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 kl1;kl1;c:\windows\system32\drivers\kl1.sys [2010-8-3 128016]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2010-8-3 317072]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-1-22 528128]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2007-10-9 38144]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2009-10-14 26352]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2009-10-14 493032]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [2007-12-28 287232]
S3 icsak;icsak;c:\program files\checkpoint\zaforcefield\ak\icsak.sys [2009-10-14 35568]
S3 msCMTSrvc;Content Monitoring Tool; [x]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2002-11-16 14336]
S3 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?]

=============== Created Last 30 ================

2010-09-20 02:40:33 0 —-atw- c:\windows\system32\HP_169.254.50.217_CN99U3209Y05GV
2010-09-05 18:28:56 0 d—–w- C:\OEMSettings

==================== Find3M ====================

2010-09-20 02:14:46 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-08-17 13:17:06 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-04 23:02:32 201501 —-a-w- c:\windows\hpoins40.dat
2010-07-22 15:49:15 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57:20 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 01:22:56 72704 —-a-w- c:\windows\zllsputility.exe
2010-07-21 01:22:46 1238528 —-a-w- c:\windows\system32\zpeng25.dll
2010-07-17 09:00:04 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-06-30 12:31:35 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22:03 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44:04 1851904 —-a-w- c:\windows\system32\win32k.sys
2007-12-28 19:02:12 287232 —-a-w- c:\windows\inf\wg111v3\wg111v3.sys
2007-12-28 18:59:30 342528 —-a-w- c:\windows\inf\wg111v3\vista64\wg111v3.sys
2007-11-27 21:53:58 63488 —-a-w- c:\windows\inf\wg111v3\SetDrv64.exe
2007-11-27 21:52:44 32768 —-a-w- c:\windows\inf\wg111v3\SetDrv.exe
2006-12-15 15:30:36 98304 —-a-w- c:\windows\inf\wg111v3\UScanM.exe
2006-12-15 15:30:36 315392 —-a-w- c:\windows\inf\wg111v3\InstallDriver.exe
2006-12-15 15:30:36 212992 —-a-w- c:\windows\inf\wg111v3\CopyWHQLDriver.exe
2006-12-15 15:30:36 20480 —-a-w- c:\windows\inf\wg111v3\RTWUPath.exe
2006-12-15 15:30:36 19968 —-a-w- c:\windows\inf\wg111v3\RTWREFU.EXE
2008-05-19 04:34:59 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008051920080520\index.dat

============= FINISH: 22:46:47.51 ===============





UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 12/17/2007 9:17:07 PM
System Uptime: 9/19/2010 10:38:58 PM (0 hours ago)

Motherboard: | | KM266-8235
Processor: AMD Athlon™ XP 1800+ | Socket A | 1532/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 34 GiB total, 22.772 GiB free.
D: is FIXED (FAT32) - 3 GiB total, 0.694 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}
Description: Photosmart Plus B209a-m
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Photosmart Plus B209a-m
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:

==== System Restore Points ===================

RP186: 8/12/2010 3:38:45 PM - Software Distribution Service 3.0
RP187: 8/13/2010 5:04:49 PM - System Checkpoint
RP188: 8/14/2010 11:58:29 AM - Software Distribution Service 3.0
RP189: 8/15/2010 12:15:31 PM - System Checkpoint
RP190: 8/16/2010 8:47:43 PM - System Checkpoint
RP191: 8/18/2010 2:05:07 AM - Software Distribution Service 3.0
RP192: 8/19/2010 7:36:26 PM - System Checkpoint
RP193: 8/20/2010 4:11:15 PM - Configured NETGEAR WG111v3 wireless USB 2.0 adapter
RP194: 8/20/2010 4:21:04 PM - Installed NETGEAR WG111v3 wireless USB 2.0 adapter
RP195: 8/21/2010 5:52:26 PM - System Checkpoint
RP196: 8/23/2010 1:02:00 PM - System Checkpoint
RP197: 8/24/2010 1:45:17 PM - System Checkpoint
RP198: 8/24/2010 1:46:12 PM - Software Distribution Service 3.0
RP199: 8/25/2010 7:27:37 PM - System Checkpoint
RP200: 8/26/2010 7:48:44 PM - System Checkpoint
RP201: 8/28/2010 9:35:10 AM - System Checkpoint
RP202: 8/29/2010 5:26:07 PM - System Checkpoint
RP203: 8/30/2010 6:24:08 PM - System Checkpoint
RP204: 8/31/2010 11:06:41 PM - System Checkpoint
RP205: 9/1/2010 11:21:41 PM - System Checkpoint
RP206: 9/3/2010 1:33:43 AM - Software Distribution Service 3.0
RP207: 9/4/2010 11:49:39 AM - System Checkpoint
RP208: 9/5/2010 2:19:57 PM - Configured NETGEAR WG111v3 wireless USB 2.0 adapter
RP209: 9/5/2010 2:27:56 PM - Installed NETGEAR WG111v3 wireless USB 2.0 adapter
RP210: 9/6/2010 3:12:46 PM - System Checkpoint
RP211: 9/7/2010 12:43:33 PM - Installed Adobe Reader 9.3.4.
RP212: 9/7/2010 1:58:55 PM - Software Distribution Service 3.0
RP213: 9/11/2010 5:42:27 PM - System Checkpoint
RP214: 9/13/2010 2:29:29 AM - Software Distribution Service 3.0
RP215: 9/14/2010 3:24:21 AM - System Checkpoint
RP216: 9/15/2010 1:32:45 AM - Software Distribution Service 3.0
RP217: 9/15/2010 11:30:48 AM - Software Distribution Service 3.0
RP218: 9/17/2010 10:53:48 AM - System Checkpoint
RP219: 9/18/2010 1:56:32 AM - Software Distribution Service 3.0
RP220: 9/18/2010 1:48:07 PM - Removed Scan
RP221: 9/18/2010 1:49:26 PM - Removed Destinations
RP222: 9/18/2010 1:50:31 PM - Installed Scan
RP223: 9/18/2010 1:51:20 PM - Installed Destinations
RP224: 9/19/2010 4:05:08 PM - System Checkpoint

==== Installed Programs ======================


32 Bit HP CIO Components Installer
7-Zip 4.65
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.4
B209a-m
BufferChm
CCleaner
Coloreal
Destinations
DeviceDiscovery
DeviceFunctionQFolder
ERUNT 1.1j
FinePixViewer Ver.4.3
FUJIFILM USB Driver
GPBaseService2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 13.0
HP Image Zone Express
HP Imaging Device Functions 13.0
HP Photosmart Plus B209a-m All-In-One Driver Software 13.0 Rel .6
HP Print Projects 1.0
HP Smart Web Printing 4.5
HP Solution Center 13.0
HP Update
hpPrintProjects
HPProductAssistant
HPSSupply
hpWLPGInstaller
Indeo® Software
Intel® 82845G Graphics Driver Software
Java Auto Updater
Java™ 6 Update 21
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works 7.0
Mozilla Firefox (3.6.10)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NETGEAR WG111v3 wireless USB 2.0 adapter
Network
ParetoLogic FileCure
PC-Doctor for Windows
PS_AIO_06_B209a-m_SW_Min
PS2
RAW FILE CONVERTER LE
S3Display
S3Gamma2
S3Info2
S3Overlay
Scan
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Shop for HP Supplies
SmartWebPrinting
SolutionCenter
Status
Toolbox
TrayApp
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC 9.0 Runtime
WebFldrs XP
WebReg
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
Yahoo! Companion
Yahoo! Essentials
Yahoo! Internet Mail
Yahoo! Login
Yahoo! Messenger
Yahoo! Messenger Explorer Bar
ZoneAlarm Extreme Security
ZoneAlarm Spy Blocker

==== Event Viewer Messages From Past Week ========

9/16/2010 11:43:23 PM, error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the Interface with IP address 192.168.1.2. The machine with the IP address 192.168.1.3 did not allow the name to be claimed by this machine.
9/15/2010 12:02:30 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
9/15/2010 11:13:08 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 Fips kl1 KLIF
9/15/2010 11:12:25 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

==== End Of File ===========================




GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-20 03:04:43
Windows 5.1.2600 Service Pack 3
Running: hdj3f6ns.exe; Driver: C:\DOCUME~1\Admin\LOCALS~1\Temp\kgldypog.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xF41DA542]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwClose [0xF41DADBA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwConnectPort [0xF41DB8CC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateEvent [0xF41DBDCC]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xF404B8CC]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0xF406D0E6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateMutant [0xF41DBCA4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xF41DA148]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreatePort [0xF41DBB60]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateSection [0xF41DA304]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateSemaphore [0xF41DBEFE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xF41DD784]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateThread [0xF41DAA58]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xF41DBC02]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xF41DD176]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xF404C78E]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xF406EB8E]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xF406E484]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xF41DB524]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwDuplicateObject [0xF41DE146]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwEnumerateKey [0xF41D9E80]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xF41D9F2A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwFsControlFile [0xF41DB330]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwLoadDriver [0xF41DD208]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0xF406F558]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xF406F796]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwMapViewOfSection [0xF41DD838]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xF41DA076]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenEvent [0xF41DBE6E]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xF404C280]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenKey [0xF41D9592]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenMutant [0xF41DBD3C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenProcess [0xF41DA740]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenSection [0xF41DD7AE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenSemaphore [0xF41DBFA0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenThread [0xF41DA664]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryKey [0xF41D9FD4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xF41D9BFC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQuerySection [0xF41DDB50]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryValueKey [0xF41D984C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueueApcThread [0xF41DD49E]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0xF407061E]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xF406FF12]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwReplyPort [0xF41DC32A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xF41DC1F0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xF41DCE9C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xF407107E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwResumeThread [0xF41DE028]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSaveKey [0xF41D91FE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSecureConnectPort [0xF41DB60A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetContextThread [0xF41DAC76]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xF404CB98]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetInformationToken [0xF41DC86C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xF4070BA6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetSystemInformation [0xF41DDC90]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xF406DBA8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSuspendProcess [0xF41DDD74]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSuspendThread [0xF41DDE9C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSystemDebugControl [0xF41DD0A2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwTerminateProcess [0xF41DA8B8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwTerminateThread [0xF41DA80E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xF41DDA06]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xF41DA998]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) IoIsOperationSynchronous

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution + 13E 804E4998 16 Bytes [04, A3, 1D, F4, FE, BE, 1D, …] {ADD AL, 0xa3; SBB EAX, 0x1dbefef4; HLT ; TEST BH, DL; SBB EAX, 0x1daa58f4; HLT }
.text ntoskrnl.exe!ZwYieldExecution + 1FA 804E4A54 12 Bytes [08, D2, 1D, F4, 58, F5, 06, …]
.text ntoskrnl.exe!ZwYieldExecution + 376 804E4BD0 16 Bytes [1E, 06, 07, F4, 12, FF, 06, …] {PUSH DS; PUSH ES; POP ES; HLT ; ADC BH, BH; PUSH ES; HLT ; SUB AL, BL; SBB EAX, 0x1dc1f0f4; HLT }
.text ntoskrnl.exe!ZwYieldExecution + 46A 804E4CC4 12 Bytes [74, DD, 1D, F4, 9C, DE, 1D, …]
.text ntoskrnl.exe!IoIsOperationSynchronous 804EAFCE 5 Bytes JMP F41CFDAE \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 804F45B3 5 Bytes JMP F41CF9D4 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab)

—- Devices - GMER 1.0.15 —-

Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Mass Storage
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Mass Storage@DeviceInterface {53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Portable Audio Players
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Portable Audio Players@DeviceInterface {F33FDC04-D1AC-4E8E-9A30-19BBD4B108AE}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Portable Audio Players@FilterParameter UseExtendedWmdm
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Windows CE
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Windows CE@DeviceInterface {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Windows CE RNDIS
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Windows CE RNDIS@DeviceInterface {ad498944-762f-11d0-8dcb-00c04fc3358c}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDevices\WinCEDevice
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDevices\WinCEDevice@DeviceInterface {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDevices\WinCEDevice@WMDMSPCLSID {067B4B81-B1EC-489f-B111-940EBDC44EBE}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDevices\WinCEDeviceRNDIS
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDevices\WinCEDeviceRNDIS@DeviceInterface {ad498944-762f-11d0-8dcb-00c04fc3358c}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\KnownDevices\WinCEDeviceRNDIS@WMDMSPCLSID {067B4B81-B1EC-489f-B111-940EBDC44EBE}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\Plugins\SCP\SCPTRANS@ProgID MsScp.SCPTRANS.1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\Plugins\SP\MSPMSP\KBDeviceList@SanDiskIM SanDisk ;ImageMate III ;2.3
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\Plugins\SP\MSPMSP\KBDeviceList@SanDiskIMb E-USB Fl;ash ;
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\Plugins\SP\MSPMSP\KBDeviceList@Lexmark Parallel; Flash Unit;
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\Plugins\SP\WMDMCESP@ProgID WMDMCESP.WMDMCESP
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\Plugins\SP\WPDSp@PnPAware 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Device Manager\Plugins\SP\WPDSp@ProgID WPDSp.WPDServiceProvider
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\shell\open
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\shell\open\command
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\shell\open\command@ "C:\Program Files\Real\RealOne Player\realplay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mp3
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.m3u
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.cda
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mpg
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mpeg
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mpv
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mps
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.m2v
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.m1v
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mpe
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mpa
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.avi
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mp4
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.m4e
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.wma
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.wav
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mp2
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mp1
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mpga
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.pls
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.xpl
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.smi
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.smil
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rt
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rnx
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rmp
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mns
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mnd
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rms
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rjs
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.ra
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rm
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rmvb
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rp
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.ram
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rmm
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.ssm
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rsml
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rv
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rmj
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.sdp
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.au
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.aif
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.aiff
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.r3t
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.mid
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.midi
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rmi
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.acp
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.lmsff
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.lqt
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.lavs
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.lar
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.la1
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rjt
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rmx
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.vpg
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rec
Reg HKLM\SOFTWARE\Classes\Applications\RealPlay.exe\SupportedTypes@.rpm
Reg HKLM\SOFTWARE\Classes\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\DefaultIcon@ C:\Program Files\OEMLink\bin\blank.ico
Reg HKLM\SOFTWARE\Classes\Intuit.Quicken\CLSID@ {C79C91A1-DB06-11D2-9E0C-00105A26F05D}
Reg HKLM\SOFTWARE\Classes\Intuit.Quicken.1\CLSID@ {C79C91A1-DB06-11D2-9E0C-00105A26F05D}
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1\shell\open
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1\shell\open
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPEG.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPEG.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPEG.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPEG.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPEG.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPEG.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6\shell\open\command
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6\shell\open\command@ "C:\Program Files\Real\RealOne Player\RealPlay.exe" "%1"
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6\shellex\ContextMenuHandlers
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6\shellex\ContextMenuHandlers\RealPlayerHandler
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6\shellex\ContextMenuHandlers\RealPlayerHandler@ {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
Reg HKLM\SOFTWARE\Classes\secondlife\shell\open
Reg HKLM\SOFTWARE\Classes\secondlife\shell\open\command
Reg HKLM\SOFTWARE\Classes\secondlife\shell\open\command@ "C:\Program Files\SecondLife\SecondLife.exe" -set SystemLanguage en-us -url "%1"

—- EOF - GMER 1.0.15 —-

CatByte, funny you should ask … GM is a good friend who actually gave me this computer shortly after i arrived. We do share the same internet connection (she is wired/ i am wireless) … how did you know to ask, the connection?
here is the report you requested and thanks for your help.
araviss

ComboFix 10-09-20.02 - Admin 09/20/2010 19:33:08.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.287 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: ZoneAlarm Extreme Security Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\54ea435
c:\documents and settings\All Users\Application Data\54ea435\6143.mof
c:\documents and settings\All Users\Application Data\54ea435\BackUp\HP Digital Imaging Monitor.lnk
c:\documents and settings\All Users\Application Data\54ea435\BackUp\Quicken Scheduled Updates.lnk
c:\documents and settings\All Users\Application Data\54ea435\PCLG.ico
c:\documents and settings\All Users\Application Data\54ea435\PCLGSys\vd952342.bd
C:\kmd.exe
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\fonts
c:\windows\system32\fonts\ACADEMY_.PFB
c:\windows\system32\fonts\ACADEMY_.PFM
c:\windows\system32\fonts\ACADEMY_.TTF
D:\AUTORUN.INF

.
((((((((((((((((((((((((( Files Created from 2010-08-20 to 2010-09-20 )))))))))))))))))))))))))))))))
.

2010-09-20 23:24 . 2010-09-20 23:27 ——– d—–r- C:\32788R22FWJFW
2010-09-07 16:37 . 2010-09-07 16:37 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-09-07 16:35 . 2010-09-07 16:35 ——– d—–w- c:\program files\NOS
2010-09-07 16:35 . 2010-08-13 13:13 35136 —-a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-09-07 16:35 . 2010-08-13 13:13 32032 —-a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-09-05 18:28 . 2010-09-05 18:28 ——– d—–w- C:\OEMSettings

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-20 23:19 . 2007-12-18 17:38 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-09-20 23:10 . 2010-08-04 23:22 ——– d—–w- c:\documents and settings\Admin\Application Data\HPAppData
2010-09-20 23:03 . 2010-01-22 17:24 144 —-a-w- c:\windows\system32\pdfl.dat
2010-09-18 17:53 . 2010-09-18 17:57 2163712 —-a-w- c:\windows\Internet Logs\xDB25.tmp
2010-09-18 17:51 . 2010-08-04 18:24 ——– d—–w- c:\program files\HP
2010-09-17 22:40 . 2010-09-18 02:41 2152448 —-a-w- c:\windows\Internet Logs\xDB7B.tmp
2010-09-07 16:46 . 2002-10-29 21:48 ——– d—–w- c:\program files\Common Files\Adobe
2010-09-07 16:36 . 2010-07-08 20:04 77184 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-09-07 16:36 . 2010-01-31 17:24 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-09-06 04:08 . 2008-03-21 13:30 ——– d—–w- c:\program files\CCleaner
2010-09-06 03:01 . 2010-09-06 03:52 2121216 —-a-w- c:\windows\Internet Logs\xDB24.tmp
2010-09-05 18:37 . 2010-09-05 18:39 2116608 —-a-w- c:\windows\Internet Logs\xDB23.tmp
2010-09-05 18:37 . 2010-09-05 18:39 41984 —-a-w- c:\windows\Internet Logs\xDB20.tmp
2010-09-05 18:29 . 2002-10-29 21:38 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-09-04 11:53 . 2010-09-05 18:31 2116096 —-a-w- c:\windows\Internet Logs\xDB22.tmp
2010-09-04 11:53 . 2010-09-05 18:31 2262016 —-a-w- c:\windows\Internet Logs\xDB21.tmp
2010-08-28 12:32 . 2010-08-28 12:31 21082243 —-a-w- c:\windows\Internet Logs\vsmon_on_demand_crt_term_2010_08_27_18_50_01_full.dmp.zip
2010-08-28 12:31 . 2010-08-28 12:30 21081991 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_49_26_full.dmp.zip
2010-08-28 12:30 . 2010-08-28 12:29 21082119 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_48_38_full.dmp.zip
2010-08-28 12:29 . 2010-08-28 12:28 21079618 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_46_22_full.dmp.zip
2010-08-27 05:28 . 2010-08-27 12:34 2095104 —-a-w- c:\windows\Internet Logs\xDB1F.tmp
2010-08-22 14:05 . 2010-08-22 19:42 2075136 —-a-w- c:\windows\Internet Logs\xDB1E.tmp
2010-08-21 05:30 . 2010-08-21 11:53 2075648 —-a-w- c:\windows\Internet Logs\xDB2B.tmp
2010-08-19 15:29 . 2010-08-19 15:54 2067456 —-a-w- c:\windows\Internet Logs\xDB1D.tmp
2010-08-17 13:17 . 2005-06-10 23:55 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-14 16:54 . 2010-08-14 16:54 ——– d—–w- c:\documents and settings\All Users\Application Data\CheckPoint
2010-08-13 14:11 . 2010-07-14 05:36 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-11 14:32 . 2010-08-11 14:33 1994240 —-a-w- c:\windows\Internet Logs\xDB1C.tmp
2010-08-11 14:28 . 2010-07-19 14:52 3399098 —-a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-08-09 05:07 . 2010-08-09 05:08 1981440 —-a-w- c:\windows\Internet Logs\xDB1B.tmp
2010-08-07 21:57 . 2010-08-07 21:57 ——– d—–w- c:\documents and settings\Admin\Application Data\FUJIFILM
2010-08-07 17:53 . 2010-08-07 17:55 1976832 —-a-w- c:\windows\Internet Logs\xDB1A.tmp
2010-08-05 17:48 . 2008-04-25 01:35 ——– d—–w- c:\program files\Windows Media Connect 2
2010-08-05 17:06 . 2010-08-05 17:07 1935360 —-a-w- c:\windows\Internet Logs\xDB19.tmp
2010-08-04 23:49 . 2007-12-23 02:32 ——– d—–w- c:\program files\FinePixViewer
2010-08-04 23:47 . 2010-08-04 23:47 ——– d—–w- c:\program files\REGSHAVE
2010-08-04 23:02 . 2010-08-04 22:34 201501 —-a-w- c:\windows\hpoins40.dat
2010-08-04 22:57 . 2010-07-09 02:20 ——– d—–w- c:\documents and settings\Admin\Application Data\HP
2010-08-04 22:57 . 2008-03-26 14:07 31536 -c–a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-04 22:50 . 2007-12-23 02:07 ——– d—–w- c:\documents and settings\All Users\Application Data\HP
2010-08-04 22:49 . 2010-08-04 22:49 ——– d—–w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2010-08-04 17:24 . 2010-08-04 17:25 1872384 —-a-w- c:\windows\Internet Logs\xDB18.tmp
2010-08-04 15:05 . 2002-10-29 21:49 ——– d—–w- c:\program files\Quicken
2010-08-04 04:29 . 2010-08-04 14:25 1868800 —-a-w- c:\windows\Internet Logs\xDB17.tmp
2010-08-03 11:56 . 2010-08-03 11:56 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\msvcp71.dll
2010-08-03 11:56 . 2010-08-03 11:56 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\jmc.dll
2010-08-03 11:56 . 2010-08-03 11:56 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\msvcr71.dll
2010-08-03 11:56 . 2010-08-03 11:56 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3d4d3209-n\decora-sse.dll
2010-08-03 11:56 . 2010-08-03 11:56 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3d4d3209-n\decora-d3d.dll
2010-08-03 11:43 . 2010-08-03 11:49 817664 —-a-w- c:\windows\Internet Logs\xDB16.tmp
2010-07-29 21:44 . 2010-07-30 21:55 1794048 —-a-w- c:\windows\Internet Logs\xDB15.tmp
2010-07-28 23:21 . 2007-12-18 02:13 ——– d—–w- c:\program files\Encarta Online
2010-07-28 23:12 . 2010-07-28 23:12 ——– d—–w- c:\documents and settings\Admin\Application Data\Image Zone Express
2010-07-28 22:33 . 2010-07-28 22:33 ——– d—–w- c:\program files\Common Files\Java
2010-07-28 19:22 . 2010-07-09 05:47 ——– d—–w- c:\program files\Java
2010-07-26 00:28 . 2010-07-26 00:27 ——– d—–w- c:\program files\ERUNT
2010-07-25 16:03 . 2010-07-25 16:04 1684992 —-a-w- c:\windows\Internet Logs\xDB14.tmp
2010-07-25 14:56 . 2010-07-25 14:56 305361 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2010_07_25_10_30_44_small.dmp.zip
2010-07-25 07:48 . 2010-07-25 11:07 1682944 —-a-w- c:\windows\Internet Logs\xDB11.tmp
2010-07-25 07:03 . 2010-07-25 11:20 1682944 —-a-w- c:\windows\Internet Logs\xDB13.tmp
2010-07-25 06:43 . 2010-07-25 11:20 338432 —-a-w- c:\windows\Internet Logs\xDB12.tmp
2010-07-22 15:49 . 2004-03-06 02:16 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-12-29 01:28 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 01:22 . 2010-01-22 17:24 72704 —-a-w- c:\windows\zllsputility.exe
2010-07-21 01:22 . 2010-08-03 05:46 1238528 —-a-w- c:\windows\system32\zpeng25.dll
2010-07-21 01:22 . 2010-08-03 05:46 69120 —-a-w- c:\windows\system32\zlcomm.dll
2010-07-21 01:22 . 2010-08-03 05:46 103936 —-a-w- c:\windows\system32\zlcommdb.dll
2010-07-20 23:25 . 2010-07-20 23:26 1692160 —-a-w- c:\windows\Internet Logs\xDBF.tmp
2010-07-20 23:25 . 2010-07-20 23:26 1692160 —-a-w- c:\windows\Internet Logs\xDB10.tmp
2010-07-17 09:00 . 2010-07-09 05:48 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-17 00:44 . 2010-07-17 00:46 1687040 —-a-w- c:\windows\Internet Logs\xDBE.tmp
2010-07-16 23:32 . 2010-07-16 23:33 1681920 —-a-w- c:\windows\Internet Logs\xDBD.tmp
2010-07-16 23:01 . 2010-07-16 23:03 1679872 —-a-w- c:\windows\Internet Logs\xDBC.tmp
2010-07-13 11:57 . 2010-07-13 12:01 1750016 —-a-w- c:\windows\Internet Logs\xDBA.tmp
2010-07-13 11:57 . 2010-07-13 12:01 1750016 —-a-w- c:\windows\Internet Logs\xDBB.tmp
2010-07-09 06:59 . 2010-07-09 07:01 25088 —-a-w- c:\windows\Internet Logs\xDB8.tmp
2010-07-09 06:59 . 2010-07-09 07:01 1735168 —-a-w- c:\windows\Internet Logs\xDB9.tmp
2010-07-09 06:03 . 2010-07-09 06:04 1732096 —-a-w- c:\windows\Internet Logs\xDB7.tmp
2010-07-09 06:03 . 2010-07-09 06:04 95744 —-a-w- c:\windows\Internet Logs\xDB6.tmp
2010-07-09 05:49 . 2010-07-09 05:49 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\msvcp71.dll
2010-07-09 05:49 . 2010-07-09 05:49 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\jmc.dll
2010-07-09 05:49 . 2010-07-09 05:49 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\msvcr71.dll
2010-07-09 05:49 . 2010-07-09 05:49 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ca48066-n\decora-d3d.dll
2010-07-09 05:49 . 2010-07-09 05:49 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ca48066-n\decora-sse.dll
2010-07-09 03:07 . 2010-07-09 03:07 51257 —-a-w- c:\windows\Internet Logs\zlclient_2nd_2010_07_08_22_57_33_small.dmp.zip
2010-07-08 00:50 . 2010-07-08 03:43 240128 —-a-w- c:\windows\Internet Logs\xDB4.tmp
2010-07-08 00:50 . 2010-07-08 03:43 1792512 —-a-w- c:\windows\Internet Logs\xDB5.tmp
2010-07-07 19:22 . 2010-07-07 19:22 32000 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:31 . 2002-11-16 07:31 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2006-06-23 16:33 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2002-11-16 07:32 1851904 —-a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-09-09 114688]
"WCOLOREAL"="c:\program files\COMPAQ\Coloreal\coloreal.exe" [2002-02-21 143360]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 55824]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2008-7-1 2326528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [10/9/2007 2:13 PM 38144]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 9:30 AM 26352]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 9:30 AM 493032]
R3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [10/14/2009 9:29 AM 35568]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [12/28/2007 4:02 PM 287232]
S3 msCMTSrvc;Content Monitoring Tool; [x]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [11/16/2002 3:31 AM 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-08-29 c:\windows\Tasks\FileCure Default.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]

2010-09-20 c:\windows\Tasks\FileCure Startup.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]

2010-09-20 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2010-07-08 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]

2010-09-20 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://srch-qus7.hpwis.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaDownload.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaExtensions.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll
FF - plugin: c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-20 19:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\EN]
@DACL=(02 0000)
"OnLineServicesDirName"="Online Services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\FR]
@DACL=(02 0000)
"OnLineServicesDirName"="Services en ligne"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\MX]
@DACL=(02 0000)
"OnLineServicesDirName"="Servicios en línea"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\NL]
@DACL=(02 0000)
"OnLineServicesDirName"="Online Services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\NW]
@DACL=(02 0000)
"OnLineServicesDirName"="Online tjenster"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\SP]
@DACL=(02 0000)
"OnLineServicesDirName"="Servicios en línea"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\SW]
@DACL=(02 0000)
"OnLineServicesDirName"="Online tjänster"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\UK]
@DACL=(02 0000)
"OnLineServicesDirName"="Online services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\US]
@DACL=(02 0000)
"OnLineServicesDirName"="Online Services"

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\AppEvents\Schemes\Apps\Quicken\Activity Bar Item]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\AppEvents\Schemes\Apps\Quicken\Activity Bar Menu]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\AppEvents\Schemes\Apps\Quicken\Click]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\AppEvents\Schemes\Apps\Quicken\Delete]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\AppEvents\Schemes\Apps\Quicken\Memorize]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\AppEvents\Schemes\Apps\Quicken\Open Program]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\AppEvents\Schemes\Apps\Quicken\Record]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\Mozilla\CompuServe 7.0\Bin\shell]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\Applications\RealPlay.exe\shell]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\Applications\RealPlay.exe\SupportedTypes]
@DACL=(02 0000)
@SACL=
@=""
".mp3"=""
".m3u"=""
".cda"=""
".mpg"=""
".mpeg"=""
".mpv"=""
".mps"=""
".m2v"=""
".m1v"=""
".mpe"=""
".mpa"=""
".avi"=""
".mp4"=""
".m4e"=""
".wma"=""
".wav"=""
".mp2"=""
".mp1"=""
".mpga"=""
".pls"=""
".xpl"=""
".smi"=""
".smil"=""
".rt"=""
".rnx"=""
".rmp"=""
".mns"=""
".mnd"=""
".rms"=""
".rjs"=""
".ra"=""
".rm"=""
".rmvb"=""
".rp"=""
".ram"=""
".rmm"=""
".ssm"=""
".rsml"=""
".rv"=""
".rmj"=""
".sdp"=""
".au"=""
".aif"=""
".aiff"=""
".r3t"=""
".mid"=""
".midi"=""
".rmi"=""
".acp"=""
".lmsff"=""
".lqt"=""
".lavs"=""
".lar"=""
".la1"=""
".rjt"=""
".rmx"=""
".vpg"=""
".rec"=""
".rpm"=""

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\DefaultIcon]
@DACL=(02 0000)
@SACL=
@="c:\\Program Files\\OEMLink\\bin\\blank.ico"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Intuit.Quicken\CLSID]
@DACL=(02 0000)
@SACL=
@="{C79C91A1-DB06-11D2-9E0C-00105A26F05D}"

[HKEY_LOCAL_MACHINE\software\Classes\Intuit.Quicken.1\CLSID]
@DACL=(02 0000)
@SACL=
@="{C79C91A1-DB06-11D2-9E0C-00105A26F05D}"

[HKEY_LOCAL_MACHINE\software\Classes\RealJukebox.CDA.1\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealJukebox.CDA.1\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealJukebox.wma.1\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealJukebox.wma.1\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AIFF.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AIFF.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AU.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AU.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AVI.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AVI.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP2.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP2.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP3.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP3.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP3PL.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP3PL.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MPA.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MPA.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MPEG.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MPEG.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.WAV.6\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.WAV.6\shellex]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\secondlife\shell]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\COMPAQ\Coloreal]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Compaq Computer Corp.\msCMT]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\FUJI PHOTO FILM CO.,LTD.\FinePixViewer]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\InterVideo\Common\AudioDec]
@DACL=(02 0000)
@SACL=
"DsContinuousRate"=dword:00000000

[HKEY_LOCAL_MACHINE\software\InterVideo\Common\VideoDec]
@DACL=(02 0000)
@SACL=
"VgaVendorID"=dword:00008086
"VgaDeviceID"=dword:00002562
"VgaQuery"=dword:00000000
"VgaDriverName"=""
"DsContinuousRate"=dword:00000000
"VMR"=dword:00000000
"DXVA"=dword:00000001
"HWMC"=dword:00000000

[HKEY_LOCAL_MACHINE\software\knight\settings]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\Java VM\Security]
@DACL=(02 0000)
"EditCustomPermissions"=hex:00,00,00,00

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\11.0]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\9.0]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\FilterShimDllExclusionList]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\FilterShimDllInclusionList]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\FilterShimExclusionList]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\FilterShimInclusionList]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\NodeCLSIDs\{13A7995E-7D8F-45B4-9C77-819265225763}]
@DACL=(02 0000)
@SACL=
"Priority"=dword:00000001
"AutoInsert"=dword:00000001
"Name"="WMPlayer Spectrum Analyzer DMO"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\NodeCLSIDs\{95037DA1-6ED9-4B27-8CFF-9AD3DFB0B2F2}]
@DACL=(02 0000)
@SACL=
"Priority"=dword:fffffffb
"AutoInsert"=dword:00000001
"Name"="WMPlayer SRSWow DMO"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\NodeCLSIDs\{974BF3BF-C9AE-4476-8003-5FE544DF458C}]
@DACL=(02 0000)
@SACL=
"Priority"=dword:fffffffe
"AutoInsert"=dword:00000001
"Name"="WMPlayer Video Processing DMO"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\NodeCLSIDs\{B2DBA270-9F49-4513-AC13-76496D6EBA3A}]
@DACL=(02 0000)
@SACL=
"Priority"=dword:00000002
"AutoInsert"=dword:00000000
"Name"="Speaker Enhancement DMO"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\NodeCLSIDs\{D01BC8E2-70AD-4976-9612-21B37ED5C8E8}]
@DACL=(02 0000)
@SACL=
"Priority"=dword:00000003
"AutoInsert"=dword:00000001
"Name"="WMPlayer Equalizer DMO"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\NodeCLSIDs\{D7E9C0B4-0E4D-46B4-BC46-1D0222F92C6F}]
@DACL=(02 0000)
"Priority"=dword:fffffffc
"AutoInsert"=dword:00000001
"Name"="Seamless Audio DMO"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\NodeCLSIDs\{E5A8C40E-654B-44D4-ACBB-DBE6D3B3333B}]
@DACL=(02 0000)
"Priority"=dword:fffffffd
"AutoInsert"=dword:00000001
"Name"="Volume Normalization DMO"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\NodeCLSIDs\{FB02E8EF-ACFE-4CC0-96DF-8B5C7098272C}]
@DACL=(02 0000)
"Priority"=dword:fffffffe
"AutoInsert"=dword:00000001
"Name"="WMPlayer Time Compression DMO"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Alchemy]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Services]
@DACL=(02 0000)
"NoServices"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Settings]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Setup\Installed Versions]
@DACL=(02 0000)
"wmp.dll"=hex:00,00,0b,00,94,14,59,16
"wmploc.dll"=hex:00,00,0b,00,19,14,59,16
"wmplayer.exe"=hex:00,00,0b,00,19,14,59,16

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimDllExclusionList]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimDllInclusionList]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimExclusionList]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\FIREFOX.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\SmartPlaylist]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{0890F930-4F80-4646-BAB1-4B6E5571FB89}]
@DACL=(02 0000)
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1491"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{1F32514F-1561-4922-A604-8A1F478B5A42}]
@DACL=(02 0000)
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1495"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{52903d79-f993-4de6-8317-20c9c176d823}]
@DACL=(02 0000)
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1496"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{59E7BF52-E5C9-4382-A39A-522DEE9AFDFD}]
@DACL=(02 0000)
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1497"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{5DF031B7-6A37-42D9-8802-E27F4F224332}]
@DACL=(02 0000)
"Capabilities"=dword:00000003
"FriendlyName"="Viz Plug-in"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{5F4BB5C9-4652-489B-8601-EEC0C3C32E2E}]
@DACL=(02 0000)
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1494"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{7F2B1D6B-1357-402C-A1C8-67E59583B41D}]
@DACL=(02 0000)
"Description"="Captions plugin description"
"Capabilities"=dword:000000f0
"FriendlyName"="Captions plugin name"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{93075F62-16B3-43EC-A53B-FFAD0E01D5E7}]
@DACL=(02 0000)
"Capabilities"=dword:00000003
"FriendlyName"="res://wmploc.dll/RT_STRING/#209"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{9695AEF9-9D03-4671-8F2F-FF49D1BB01C4}]
@DACL=(02 0000)
"Description"="Media Information description"
"Capabilities"=dword:00000005
"FriendlyName"="res://wmploc.dll/RT_STRING/#1407"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{976ABECA-93F7-4d81-9187-2A6137829675}]
@DACL=(02 0000)
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1490"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{99DB05E3-F81E-4C8A-A252-F396306AB6FE}]
@DACL=(02 0000)
"Description"="Banner plugin description"
"Capabilities"=dword:000000f0
"FriendlyName"="Banner plugin name"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{9F9562EB-15B6-46C6-A7CB-0A66FC65130E}]
@DACL=(02 0000)
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1493"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{9FA014E3-076F-4865-A73C-117131B8E292}]
@DACL=(02 0000)
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1492"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{D5E49195-ED19-40fb-9EE0-E6625A808B77}]
@DACL=(02 0000)
"Capabilities"=dword:00000003
"FriendlyName"="Video Plug-in"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{E641D09E-E500-4c09-8260-F1CD7B902E9C}]
@DACL=(02 0000)
"FriendlyName"="WM View plugin name"
"Description"="WM View plugin description"
"Capabilities"=dword:000000f0

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{F24A1BC2-2331-4B91-8A13-5A549DA56E9D}]
@DACL=(02 0000)
"Capabilities"=dword:00000003
"FriendlyName"="Border Plug-in"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{FD981763-B6BB-4d51-9143-6D372A0ED56F}]
@DACL=(02 0000)
"FriendlyName"="res://wmploc.dll/RT_STRING/#5822"
"Description"="res://wmploc.dll/RT_STRING/#5823"
"Capabilities"=dword:00000003

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDeviceClasses]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDevices]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\Plugins\SCP\SCPTRANS]
@DACL=(02 0000)
"ProgID"="MsScp.SCPTRANS.1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\Plugins\SP\MSPMSP\KBDeviceList]
@DACL=(02 0000)
"SanDiskIM"="SanDisk ;ImageMate III ;2.3"
"SanDiskIMb"="E-USB Fl;ash ; "
"Lexmark"="Parallel; Flash Unit;"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\Plugins\SP\WMDMCESP]
@DACL=(02 0000)
"ProgID"="WMDMCESP.WMDMCESP"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\Plugins\SP\WPDSp]
@DACL=(02 0000)
"PnPAware"=dword:00000001
"ProgID"="WPDSp.WPDServiceProvider"

[HKEY_LOCAL_MACHINE\software\PepiMK Software\SpybotSnD]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Safer Networking Limited\SpybotSnD]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Xing Technology Corp.\SharedDlls]







@DACL=(02 0000)
@SACL=
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(668)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll

- - - - - - - > 'lsass.exe'(724)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll

- - - - - - - > 'csrss.exe'(644)
c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
.
Completion time: 2010-09-20 19:52:44
ComboFix-quarantined-files.txt 2010-09-20 23:52

Pre-Run: 24,172,077,056 bytes free
Post-Run: 24,326,856,704 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 40BAB6E96DDCB667DE1C31415D95A86C

Ok i ran Combofix in safe mode and here is the log file you requested. However i had to reboot to normal mode in order to post the log file to you. For some reason even though i was in safe mode with networking i could not connect to the net.





ComboFix 10-09-20.02 - Admin 09/21/2010 12:00:54.5.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.173 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: ZoneAlarm Extreme Security Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2010-08-21 to 2010-09-21 )))))))))))))))))))))))))))))))
.

2010-09-07 16:37 . 2010-09-07 16:37 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-09-07 16:35 . 2010-09-07 16:35 ——– d—–w- c:\program files\NOS
2010-09-07 16:35 . 2010-08-13 13:13 35136 —-a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-09-07 16:35 . 2010-08-13 13:13 32032 —-a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-09-05 18:28 . 2010-09-05 18:28 ——– d—–w- C:\OEMSettings

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-21 15:58 . 2010-08-04 23:22 ——– d—–w- c:\documents and settings\Admin\Application Data\HPAppData
2010-09-21 14:22 . 2007-12-18 17:38 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-09-21 14:07 . 2010-01-22 17:24 144 —-a-w- c:\windows\system32\pdfl.dat
2010-09-21 00:02 . 2010-09-21 00:01 20010386 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_09_20_19_25_45_full.dmp.zip
2010-09-18 17:53 . 2010-09-18 17:57 2163712 —-a-w- c:\windows\Internet Logs\xDB25.tmp
2010-09-18 17:51 . 2010-08-04 18:24 ——– d—–w- c:\program files\HP
2010-09-17 22:40 . 2010-09-18 02:41 2152448 —-a-w- c:\windows\Internet Logs\xDB7B.tmp
2010-09-07 16:46 . 2002-10-29 21:48 ——– d—–w- c:\program files\Common Files\Adobe
2010-09-07 16:36 . 2010-07-08 20:04 77184 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-09-07 16:36 . 2010-01-31 17:24 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-09-06 04:08 . 2008-03-21 13:30 ——– d—–w- c:\program files\CCleaner
2010-09-06 03:01 . 2010-09-06 03:52 2121216 —-a-w- c:\windows\Internet Logs\xDB24.tmp
2010-09-05 18:37 . 2010-09-05 18:39 2116608 —-a-w- c:\windows\Internet Logs\xDB23.tmp
2010-09-05 18:37 . 2010-09-05 18:39 41984 —-a-w- c:\windows\Internet Logs\xDB20.tmp
2010-09-05 18:29 . 2002-10-29 21:38 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-09-04 11:53 . 2010-09-05 18:31 2116096 —-a-w- c:\windows\Internet Logs\xDB22.tmp
2010-09-04 11:53 . 2010-09-05 18:31 2262016 —-a-w- c:\windows\Internet Logs\xDB21.tmp
2010-08-28 12:32 . 2010-08-28 12:31 21082243 —-a-w- c:\windows\Internet Logs\vsmon_on_demand_crt_term_2010_08_27_18_50_01_full.dmp.zip
2010-08-28 12:31 . 2010-08-28 12:30 21081991 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_49_26_full.dmp.zip
2010-08-28 12:30 . 2010-08-28 12:29 21082119 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_48_38_full.dmp.zip
2010-08-28 12:29 . 2010-08-28 12:28 21079618 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_46_22_full.dmp.zip
2010-08-27 05:28 . 2010-08-27 12:34 2095104 —-a-w- c:\windows\Internet Logs\xDB1F.tmp
2010-08-22 14:05 . 2010-08-22 19:42 2075136 —-a-w- c:\windows\Internet Logs\xDB1E.tmp
2010-08-21 05:30 . 2010-08-21 11:53 2075648 —-a-w- c:\windows\Internet Logs\xDB2B.tmp
2010-08-19 15:29 . 2010-08-19 15:54 2067456 —-a-w- c:\windows\Internet Logs\xDB1D.tmp
2010-08-17 13:17 . 2005-06-10 23:55 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-14 16:54 . 2010-08-14 16:54 ——– d—–w- c:\documents and settings\All Users\Application Data\CheckPoint
2010-08-13 14:11 . 2010-07-14 05:36 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-11 14:32 . 2010-08-11 14:33 1994240 —-a-w- c:\windows\Internet Logs\xDB1C.tmp
2010-08-11 14:28 . 2010-07-19 14:52 3399098 —-a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-08-09 05:07 . 2010-08-09 05:08 1981440 —-a-w- c:\windows\Internet Logs\xDB1B.tmp
2010-08-07 21:57 . 2010-08-07 21:57 ——– d—–w- c:\documents and settings\Admin\Application Data\FUJIFILM
2010-08-07 17:53 . 2010-08-07 17:55 1976832 —-a-w- c:\windows\Internet Logs\xDB1A.tmp
2010-08-05 17:48 . 2008-04-25 01:35 ——– d—–w- c:\program files\Windows Media Connect 2
2010-08-05 17:06 . 2010-08-05 17:07 1935360 —-a-w- c:\windows\Internet Logs\xDB19.tmp
2010-08-04 23:49 . 2007-12-23 02:32 ——– d—–w- c:\program files\FinePixViewer
2010-08-04 23:47 . 2010-08-04 23:47 ——– d—–w- c:\program files\REGSHAVE
2010-08-04 23:02 . 2010-08-04 22:34 201501 —-a-w- c:\windows\hpoins40.dat
2010-08-04 22:57 . 2010-07-09 02:20 ——– d—–w- c:\documents and settings\Admin\Application Data\HP
2010-08-04 22:57 . 2008-03-26 14:07 31536 -c–a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-04 22:50 . 2007-12-23 02:07 ——– d—–w- c:\documents and settings\All Users\Application Data\HP
2010-08-04 22:49 . 2010-08-04 22:49 ——– d—–w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2010-08-04 17:24 . 2010-08-04 17:25 1872384 —-a-w- c:\windows\Internet Logs\xDB18.tmp
2010-08-04 15:05 . 2002-10-29 21:49 ——– d—–w- c:\program files\Quicken
2010-08-04 04:29 . 2010-08-04 14:25 1868800 —-a-w- c:\windows\Internet Logs\xDB17.tmp
2010-08-03 11:56 . 2010-08-03 11:56 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\msvcp71.dll
2010-08-03 11:56 . 2010-08-03 11:56 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\jmc.dll
2010-08-03 11:56 . 2010-08-03 11:56 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\msvcr71.dll
2010-08-03 11:56 . 2010-08-03 11:56 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3d4d3209-n\decora-sse.dll
2010-08-03 11:56 . 2010-08-03 11:56 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3d4d3209-n\decora-d3d.dll
2010-08-03 11:43 . 2010-08-03 11:49 817664 —-a-w- c:\windows\Internet Logs\xDB16.tmp
2010-07-29 21:44 . 2010-07-30 21:55 1794048 —-a-w- c:\windows\Internet Logs\xDB15.tmp
2010-07-28 23:21 . 2007-12-18 02:13 ——– d—–w- c:\program files\Encarta Online
2010-07-28 23:12 . 2010-07-28 23:12 ——– d—–w- c:\documents and settings\Admin\Application Data\Image Zone Express
2010-07-28 22:33 . 2010-07-28 22:33 ——– d—–w- c:\program files\Common Files\Java
2010-07-28 19:22 . 2010-07-09 05:47 ——– d—–w- c:\program files\Java
2010-07-26 00:28 . 2010-07-26 00:27 ——– d—–w- c:\program files\ERUNT
2010-07-25 16:03 . 2010-07-25 16:04 1684992 —-a-w- c:\windows\Internet Logs\xDB14.tmp
2010-07-25 14:56 . 2010-07-25 14:56 305361 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2010_07_25_10_30_44_small.dmp.zip
2010-07-25 07:48 . 2010-07-25 11:07 1682944 —-a-w- c:\windows\Internet Logs\xDB11.tmp
2010-07-25 07:03 . 2010-07-25 11:20 1682944 —-a-w- c:\windows\Internet Logs\xDB13.tmp
2010-07-25 06:43 . 2010-07-25 11:20 338432 —-a-w- c:\windows\Internet Logs\xDB12.tmp
2010-07-22 15:49 . 2004-03-06 02:16 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-12-29 01:28 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 01:22 . 2010-01-22 17:24 72704 —-a-w- c:\windows\zllsputility.exe
2010-07-21 01:22 . 2010-08-03 05:46 1238528 —-a-w- c:\windows\system32\zpeng25.dll
2010-07-21 01:22 . 2010-08-03 05:46 69120 —-a-w- c:\windows\system32\zlcomm.dll
2010-07-21 01:22 . 2010-08-03 05:46 103936 —-a-w- c:\windows\system32\zlcommdb.dll
2010-07-20 23:25 . 2010-07-20 23:26 1692160 —-a-w- c:\windows\Internet Logs\xDBF.tmp
2010-07-20 23:25 . 2010-07-20 23:26 1692160 —-a-w- c:\windows\Internet Logs\xDB10.tmp
2010-07-17 09:00 . 2010-07-09 05:48 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-17 00:44 . 2010-07-17 00:46 1687040 —-a-w- c:\windows\Internet Logs\xDBE.tmp
2010-07-16 23:32 . 2010-07-16 23:33 1681920 —-a-w- c:\windows\Internet Logs\xDBD.tmp
2010-07-16 23:01 . 2010-07-16 23:03 1679872 —-a-w- c:\windows\Internet Logs\xDBC.tmp
2010-07-13 11:57 . 2010-07-13 12:01 1750016 —-a-w- c:\windows\Internet Logs\xDBA.tmp
2010-07-13 11:57 . 2010-07-13 12:01 1750016 —-a-w- c:\windows\Internet Logs\xDBB.tmp
2010-07-09 06:59 . 2010-07-09 07:01 25088 —-a-w- c:\windows\Internet Logs\xDB8.tmp
2010-07-09 06:59 . 2010-07-09 07:01 1735168 —-a-w- c:\windows\Internet Logs\xDB9.tmp
2010-07-09 06:03 . 2010-07-09 06:04 1732096 —-a-w- c:\windows\Internet Logs\xDB7.tmp
2010-07-09 06:03 . 2010-07-09 06:04 95744 —-a-w- c:\windows\Internet Logs\xDB6.tmp
2010-07-09 05:49 . 2010-07-09 05:49 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\msvcp71.dll
2010-07-09 05:49 . 2010-07-09 05:49 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\jmc.dll
2010-07-09 05:49 . 2010-07-09 05:49 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\msvcr71.dll
2010-07-09 05:49 . 2010-07-09 05:49 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ca48066-n\decora-d3d.dll
2010-07-09 05:49 . 2010-07-09 05:49 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ca48066-n\decora-sse.dll
2010-07-09 03:07 . 2010-07-09 03:07 51257 —-a-w- c:\windows\Internet Logs\zlclient_2nd_2010_07_08_22_57_33_small.dmp.zip
2010-07-08 00:50 . 2010-07-08 03:43 240128 —-a-w- c:\windows\Internet Logs\xDB4.tmp
2010-07-08 00:50 . 2010-07-08 03:43 1792512 —-a-w- c:\windows\Internet Logs\xDB5.tmp
2010-07-07 19:22 . 2010-07-07 19:22 32000 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:31 . 2002-11-16 07:31 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2006-06-23 16:33 916480 —-a-w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-09-20_23.44.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-13 18:45 . 2010-09-21 13:08 39046 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0012.dat
+ 2010-08-26 12:38 . 2010-09-21 13:08 23156 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\blst\bl0021.dat
+ 2010-08-13 18:45 . 2010-09-21 13:08 39046 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0012.dat
+ 2010-08-26 12:39 . 2010-09-21 13:08 23156 c:\windows\system32\ZoneLabs\avsys\bases\bl0021.dat
+ 2010-09-18 16:38 . 2010-09-21 13:08 1837 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0014.dat
+ 2010-09-18 16:38 . 2010-09-21 13:08 1837 c:\windows\system32\ZoneLabs\avsys\bases\apu0014.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-09-09 114688]
"WCOLOREAL"="c:\program files\COMPAQ\Coloreal\coloreal.exe" [2002-02-21 143360]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 55824]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2008-7-1 2326528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [12/28/2007 4:02 PM 287232]
S2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [10/9/2007 2:13 PM 38144]
S2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 9:30 AM 26352]
S2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 9:30 AM 493032]
S3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [10/14/2009 9:29 AM 35568]
S3 msCMTSrvc;Content Monitoring Tool; [x]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [11/16/2002 3:31 AM 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-08-29 c:\windows\Tasks\FileCure Default.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]

2010-09-21 c:\windows\Tasks\FileCure Startup.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]

2010-09-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2010-07-08 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]

2010-09-21 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://srch-qus7.hpwis.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaDownload.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaExtensions.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll
FF - plugin: c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-21 12:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\Mozilla\CompuServe 7.0\Bin\shell\open\command]
@DACL=(02 0000)
@SACL=
@="c:\\Program Files\\CompuServe 7.0\\cs.exe "

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\DesktopManagement]
@DACL=(02 0000)
@SACL=
"DefaultDesktop"="Default"

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\Hotkeys]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\SystemSubMenu]
@DACL=(02 0000)
@SACL=
"Maximize to desktop"=dword:00000001
"Send window to monitor"=dword:00000001
"Send window to desktop"=dword:00000001
"Send application to monitor"=dword:00000001
"Send application to desktop"=dword:00000001
@=dword:00000001
"Transparent"=dword:00000001
"Always on top"=dword:00000001
"Position memory"=dword:00000001
"Visible on all desktops"=dword:00000001
"Collapse to this desktop"=dword:00000001
"Individual settings"=dword:00000001
"Open IE client on"=dword:00000001

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\Tweak]
@DACL=(02 0000)
@SACL=
"RawTransDuration"=dword:000011fd
"TransLatency"=dword:00000f47

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement]
@DACL=(02 0000)
@SACL=
"DesktopAll"=dword:00000000
"DesktopMask"=dword:00000000
"MaxButton"=dword:00000000
"PositionMemory"=dword:00000000
"Reposition"=dword:00000000
"RepositionMonitor"=dword:00000001
"RepositionX"=dword:00000000
"RepositionY"=dword:00000000
"Spanning"=dword:00000001
"SpanningChild"=dword:00000001
"SystemMenu"=dword:00000001
"TransparentWindow"=dword:00000000
"TransparentWindowPct"=dword:00000032
"TransparentWindowDrag"=dword:00000000
"TransparentWindowDragPct"=dword:00000032
"TransparentMenu"=dword:00000000
"TransparentMenuPct"=dword:00000032
"PositionMemoryX"=dword:00000000
"PositionMemoryY"=dword:00000000
"PositionMemoryDX"=dword:00000000
"PositionMemoryDY"=dword:00000000
"AlwaysOnTop"=dword:00000000
"IndividualSettings"=dword:00000001

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\ZoomWindow]
@DACL=(02 0000)
@SACL=
"PositionX"=dword:00000000
"PositionY"=dword:00000000
"Width"=dword:00000280
"Height"=dword:000001e0
"ZoomLevel"=dword:00000002
"ZoomRefresh"=dword:0000001e
"ZoomMagnify"=dword:00000000
"ZoomCenter"=dword:00000001
"ZoomWheelEnabled"=dword:00000000
"ZoomWheelShift"=dword:00000000
"ZoomWheelCtrl"=dword:00000000
"ZoomWheelAlt"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Classes\Applications\RealPlay.exe\shell\open]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\RealJukebox.CDA.1\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealJukebox.CDA.1\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealJukebox.wma.1\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealJukebox.wma.1\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AIFF.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AIFF.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AU.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AU.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AVI.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.AVI.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP2.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP2.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP3.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP3.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP3PL.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MP3PL.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MPA.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MPA.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MPEG.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.MPEG.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.WAV.6\shell\open]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\RealPlayer.WAV.6\shellex\ContextMenuHandlers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\secondlife\shell\open\command]
@DACL=(02 0000)
@=expand:"\"c:\\Program Files\\SecondLife\\SecondLife.exe\" -set SystemLanguage en-us -url \"%1\""

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\11.0\Registration]
@DACL=(02 0000)
"UDBVersion"="11.0.5721.5145"
"UDBRev"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\9.0\Registration]
@DACL=(02 0000)
"UDBVersion"="9.0.0.3126"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Alchemy\Properties]
@DACL=(02 0000)
"classid"="{0AA02E8D-F851-4CB0-9F64-BBA9BE7A983D}"
"name"="res://mpvis.dll/RT_STRING/#100"
"description"="res://mpvis.dll/RT_STRING/#100"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Settings\MP3Encoding]
@DACL=(02 0000)
"LowRate"=dword:0001f400
"MediumRate"=dword:0002ee00
"MediumHighRate"=dword:0003e800
"HighRate"=dword:0004e200
"PreferredCodecName"="mp3"
"PreferredCodecPath"="c:\\WINDOWS\\system32\\l3codecp.acm"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimDllExclusionList\FMPLAYER.DLL]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimDllExclusionList\HWAUDIO.DLL]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimDllExclusionList\XACTMP.DLL]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimExclusionList\ENC2002.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimExclusionList\EXCEL.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimExclusionList\MPLAYER2.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimExclusionList\NHL2003.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimExclusionList\NHL2003DEMO.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimExclusionList\POWERPNT.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimExclusionList\WINWORD.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\AOLTRAY.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\FIREFOX.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\MSN6.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\NETSCAPE.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\NETSCP.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\NETSCP6.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\WAOL.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\SmartPlaylist\NonSourceFilters]
@DACL=(02 0000)
"{BC5E21B0-504C-46F6-82BF-FB975C911AD6}"=""

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\SmartPlaylist\SourceFilters]
@DACL=(02 0000)
"{4202947A-A563-4B05-A754-A1B4B5989849}"=""
"{B2D9BDDC-8E49-444B-9BA4-193ABF9C7870}"=""
"{CC823400-A8E4-4081-B073-D3B6D952FE69}"=""
"{E5415A66-7763-4BDE-B97F-5557CA73C303}"=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Mass Storage]
@DACL=(02 0000)
"DeviceInterface"="{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Portable Audio Players]
@DACL=(02 0000)
"DeviceInterface"="{F33FDC04-D1AC-4E8E-9A30-19BBD4B108AE}"
"FilterParameter"="UseExtendedWmdm"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Windows CE]
@DACL=(02 0000)
"DeviceInterface"="{25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDeviceClasses\Windows CE RNDIS]
@DACL=(02 0000)
"DeviceInterface"="{ad498944-762f-11d0-8dcb-00c04fc3358c}"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDevices\WinCEDevice]
@DACL=(02 0000)
"DeviceInterface"="{25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}"
"WMDMSPCLSID"="{067B4B81-B1EC-489f-B111-940EBDC44EBE}"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDevices\WinCEDeviceRNDIS]
@DACL=(02 0000)
"DeviceInterface"="{ad498944-762f-11d0-8dcb-00c04fc3358c}"
"WMDMSPCLSID"="{067B4B81-B1EC-489f-B111-940EBDC44EBE}"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1828)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2010-09-21 12:14:21
ComboFix-quarantined-files.txt 2010-09-21 16:14
ComboFix2.txt 2010-09-20 23:52

Pre-Run: 25,097,859,072 bytes free
Post-Run: 25,235,415,040 bytes free

- - End Of File - - 3448FACC811E270C156C2F0035D5C46D

Hi sorry that it has taken me so long to respond to you. I was able to run the CFScript as instructed. The log for that is listed below as is the MBAM log. I have been unsuccessful in running the Kaspersky online scanner. The problem is that the system freezes during it's downloading of the database definitions. the first time it froze during this process it froze at around 57,000 kb out of 96,414kb. On my last attempt to run the scan it froze at around 59,000kb out of 96,414kb. Again i am sorry for the delay in my response.



ComboFix 10-09-21.01 - Admin 09/21/2010 19:33:29.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.272 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Admin\Desktop\CFScript.txt
FW: ZoneAlarm Extreme Security Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2010-08-21 to 2010-09-21 )))))))))))))))))))))))))))))))
.

2010-09-07 16:37 . 2010-09-07 16:37 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-09-07 16:35 . 2010-09-07 16:35 ——– d—–w- c:\program files\NOS
2010-09-07 16:35 . 2010-08-13 13:13 35136 —-a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-09-07 16:35 . 2010-08-13 13:13 32032 —-a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-09-05 18:28 . 2010-09-05 18:28 ——– d—–w- C:\OEMSettings

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-21 23:26 . 2010-08-04 23:22 ——– d—–w- c:\documents and settings\Admin\Application Data\HPAppData
2010-09-21 16:37 . 2007-12-18 17:38 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-09-21 16:21 . 2010-01-22 17:24 144 —-a-w- c:\windows\system32\pdfl.dat
2010-09-21 00:02 . 2010-09-21 00:01 20010386 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_09_20_19_25_45_full.dmp.zip
2010-09-18 17:53 . 2010-09-18 17:57 2163712 —-a-w- c:\windows\Internet Logs\xDB25.tmp
2010-09-18 17:51 . 2010-08-04 18:24 ——– d—–w- c:\program files\HP
2010-09-17 22:40 . 2010-09-18 02:41 2152448 —-a-w- c:\windows\Internet Logs\xDB7B.tmp
2010-09-07 16:46 . 2002-10-29 21:48 ——– d—–w- c:\program files\Common Files\Adobe
2010-09-07 16:36 . 2010-07-08 20:04 77184 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-09-07 16:36 . 2010-01-31 17:24 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-09-06 04:08 . 2008-03-21 13:30 ——– d—–w- c:\program files\CCleaner
2010-09-06 03:01 . 2010-09-06 03:52 2121216 —-a-w- c:\windows\Internet Logs\xDB24.tmp
2010-09-05 18:37 . 2010-09-05 18:39 2116608 —-a-w- c:\windows\Internet Logs\xDB23.tmp
2010-09-05 18:37 . 2010-09-05 18:39 41984 —-a-w- c:\windows\Internet Logs\xDB20.tmp
2010-09-05 18:29 . 2002-10-29 21:38 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-09-04 11:53 . 2010-09-05 18:31 2116096 —-a-w- c:\windows\Internet Logs\xDB22.tmp
2010-09-04 11:53 . 2010-09-05 18:31 2262016 —-a-w- c:\windows\Internet Logs\xDB21.tmp
2010-08-28 12:32 . 2010-08-28 12:31 21082243 —-a-w- c:\windows\Internet Logs\vsmon_on_demand_crt_term_2010_08_27_18_50_01_full.dmp.zip
2010-08-28 12:31 . 2010-08-28 12:30 21081991 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_49_26_full.dmp.zip
2010-08-28 12:30 . 2010-08-28 12:29 21082119 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_48_38_full.dmp.zip
2010-08-28 12:29 . 2010-08-28 12:28 21079618 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_46_22_full.dmp.zip
2010-08-27 05:28 . 2010-08-27 12:34 2095104 —-a-w- c:\windows\Internet Logs\xDB1F.tmp
2010-08-22 14:05 . 2010-08-22 19:42 2075136 —-a-w- c:\windows\Internet Logs\xDB1E.tmp
2010-08-21 05:30 . 2010-08-21 11:53 2075648 —-a-w- c:\windows\Internet Logs\xDB2B.tmp
2010-08-19 15:29 . 2010-08-19 15:54 2067456 —-a-w- c:\windows\Internet Logs\xDB1D.tmp
2010-08-17 13:17 . 2005-06-10 23:55 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-14 16:54 . 2010-08-14 16:54 ——– d—–w- c:\documents and settings\All Users\Application Data\CheckPoint
2010-08-13 14:11 . 2010-07-14 05:36 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-11 14:32 . 2010-08-11 14:33 1994240 —-a-w- c:\windows\Internet Logs\xDB1C.tmp
2010-08-11 14:28 . 2010-07-19 14:52 3399098 —-a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-08-09 05:07 . 2010-08-09 05:08 1981440 —-a-w- c:\windows\Internet Logs\xDB1B.tmp
2010-08-07 21:57 . 2010-08-07 21:57 ——– d—–w- c:\documents and settings\Admin\Application Data\FUJIFILM
2010-08-07 17:53 . 2010-08-07 17:55 1976832 —-a-w- c:\windows\Internet Logs\xDB1A.tmp
2010-08-05 17:48 . 2008-04-25 01:35 ——– d—–w- c:\program files\Windows Media Connect 2
2010-08-05 17:06 . 2010-08-05 17:07 1935360 —-a-w- c:\windows\Internet Logs\xDB19.tmp
2010-08-04 23:49 . 2007-12-23 02:32 ——– d—–w- c:\program files\FinePixViewer
2010-08-04 23:47 . 2010-08-04 23:47 ——– d—–w- c:\program files\REGSHAVE
2010-08-04 23:02 . 2010-08-04 22:34 201501 —-a-w- c:\windows\hpoins40.dat
2010-08-04 22:57 . 2010-07-09 02:20 ——– d—–w- c:\documents and settings\Admin\Application Data\HP
2010-08-04 22:57 . 2008-03-26 14:07 31536 -c–a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-04 22:50 . 2007-12-23 02:07 ——– d—–w- c:\documents and settings\All Users\Application Data\HP
2010-08-04 22:49 . 2010-08-04 22:49 ——– d—–w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2010-08-04 17:24 . 2010-08-04 17:25 1872384 —-a-w- c:\windows\Internet Logs\xDB18.tmp
2010-08-04 15:05 . 2002-10-29 21:49 ——– d—–w- c:\program files\Quicken
2010-08-04 04:29 . 2010-08-04 14:25 1868800 —-a-w- c:\windows\Internet Logs\xDB17.tmp
2010-08-03 11:56 . 2010-08-03 11:56 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\msvcp71.dll
2010-08-03 11:56 . 2010-08-03 11:56 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\jmc.dll
2010-08-03 11:56 . 2010-08-03 11:56 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\msvcr71.dll
2010-08-03 11:56 . 2010-08-03 11:56 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3d4d3209-n\decora-sse.dll
2010-08-03 11:56 . 2010-08-03 11:56 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3d4d3209-n\decora-d3d.dll
2010-08-03 11:43 . 2010-08-03 11:49 817664 —-a-w- c:\windows\Internet Logs\xDB16.tmp
2010-07-29 21:44 . 2010-07-30 21:55 1794048 —-a-w- c:\windows\Internet Logs\xDB15.tmp
2010-07-28 23:21 . 2007-12-18 02:13 ——– d—–w- c:\program files\Encarta Online
2010-07-28 23:12 . 2010-07-28 23:12 ——– d—–w- c:\documents and settings\Admin\Application Data\Image Zone Express
2010-07-28 22:33 . 2010-07-28 22:33 ——– d—–w- c:\program files\Common Files\Java
2010-07-28 19:22 . 2010-07-09 05:47 ——– d—–w- c:\program files\Java
2010-07-26 00:28 . 2010-07-26 00:27 ——– d—–w- c:\program files\ERUNT
2010-07-25 16:03 . 2010-07-25 16:04 1684992 —-a-w- c:\windows\Internet Logs\xDB14.tmp
2010-07-25 14:56 . 2010-07-25 14:56 305361 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2010_07_25_10_30_44_small.dmp.zip
2010-07-25 07:48 . 2010-07-25 11:07 1682944 —-a-w- c:\windows\Internet Logs\xDB11.tmp
2010-07-25 07:03 . 2010-07-25 11:20 1682944 —-a-w- c:\windows\Internet Logs\xDB13.tmp
2010-07-25 06:43 . 2010-07-25 11:20 338432 —-a-w- c:\windows\Internet Logs\xDB12.tmp
2010-07-22 15:49 . 2004-03-06 02:16 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-12-29 01:28 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 01:22 . 2010-01-22 17:24 72704 —-a-w- c:\windows\zllsputility.exe
2010-07-21 01:22 . 2010-08-03 05:46 1238528 —-a-w- c:\windows\system32\zpeng25.dll
2010-07-21 01:22 . 2010-08-03 05:46 69120 —-a-w- c:\windows\system32\zlcomm.dll
2010-07-21 01:22 . 2010-08-03 05:46 103936 —-a-w- c:\windows\system32\zlcommdb.dll
2010-07-20 23:25 . 2010-07-20 23:26 1692160 —-a-w- c:\windows\Internet Logs\xDBF.tmp
2010-07-20 23:25 . 2010-07-20 23:26 1692160 —-a-w- c:\windows\Internet Logs\xDB10.tmp
2010-07-17 09:00 . 2010-07-09 05:48 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-17 00:44 . 2010-07-17 00:46 1687040 —-a-w- c:\windows\Internet Logs\xDBE.tmp
2010-07-16 23:32 . 2010-07-16 23:33 1681920 —-a-w- c:\windows\Internet Logs\xDBD.tmp
2010-07-16 23:01 . 2010-07-16 23:03 1679872 —-a-w- c:\windows\Internet Logs\xDBC.tmp
2010-07-13 11:57 . 2010-07-13 12:01 1750016 —-a-w- c:\windows\Internet Logs\xDBA.tmp
2010-07-13 11:57 . 2010-07-13 12:01 1750016 —-a-w- c:\windows\Internet Logs\xDBB.tmp
2010-07-09 06:59 . 2010-07-09 07:01 25088 —-a-w- c:\windows\Internet Logs\xDB8.tmp
2010-07-09 06:59 . 2010-07-09 07:01 1735168 —-a-w- c:\windows\Internet Logs\xDB9.tmp
2010-07-09 06:03 . 2010-07-09 06:04 1732096 —-a-w- c:\windows\Internet Logs\xDB7.tmp
2010-07-09 06:03 . 2010-07-09 06:04 95744 —-a-w- c:\windows\Internet Logs\xDB6.tmp
2010-07-09 05:49 . 2010-07-09 05:49 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\msvcp71.dll
2010-07-09 05:49 . 2010-07-09 05:49 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\jmc.dll
2010-07-09 05:49 . 2010-07-09 05:49 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\msvcr71.dll
2010-07-09 05:49 . 2010-07-09 05:49 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ca48066-n\decora-d3d.dll
2010-07-09 05:49 . 2010-07-09 05:49 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ca48066-n\decora-sse.dll
2010-07-09 03:07 . 2010-07-09 03:07 51257 —-a-w- c:\windows\Internet Logs\zlclient_2nd_2010_07_08_22_57_33_small.dmp.zip
2010-07-08 00:50 . 2010-07-08 03:43 240128 —-a-w- c:\windows\Internet Logs\xDB4.tmp
2010-07-08 00:50 . 2010-07-08 03:43 1792512 —-a-w- c:\windows\Internet Logs\xDB5.tmp
2010-07-07 19:22 . 2010-07-07 19:22 32000 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:31 . 2002-11-16 07:31 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2006-06-23 16:33 916480 —-a-w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-09-20_23.44.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-21 16:20 . 2010-09-21 16:20 16384 c:\windows\temp\Perflib_Perfdata_7b8.dat
+ 2010-08-13 18:45 . 2010-09-21 13:08 39046 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0012.dat
+ 2010-08-26 12:38 . 2010-09-21 13:08 23156 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\blst\bl0021.dat
+ 2010-08-13 18:45 . 2010-09-21 13:08 39046 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0012.dat
+ 2010-08-26 12:39 . 2010-09-21 13:08 23156 c:\windows\system32\ZoneLabs\avsys\bases\bl0021.dat
+ 2010-09-21 16:30 . 2010-09-21 16:30 1837 c:\windows\system32\ZoneLabs\avsys\temp\update\rollback\bases\apu\apu0014.dat
+ 2010-09-18 16:38 . 2010-09-21 16:29 2845 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0014.dat
+ 2010-09-18 16:38 . 2010-09-21 16:30 2845 c:\windows\system32\ZoneLabs\avsys\bases\apu0014.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-09-09 114688]
"WCOLOREAL"="c:\program files\COMPAQ\Coloreal\coloreal.exe" [2002-02-21 143360]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 55824]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2008-7-1 2326528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [10/9/2007 2:13 PM 38144]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 9:30 AM 26352]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 9:30 AM 493032]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
R3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [10/14/2009 9:29 AM 35568]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [12/28/2007 4:02 PM 287232]
S3 msCMTSrvc;Content Monitoring Tool; [x]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [11/16/2002 3:31 AM 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-08-29 c:\windows\Tasks\FileCure Default.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]

2010-09-21 c:\windows\Tasks\FileCure Startup.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]

2010-09-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2010-07-08 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]

2010-09-21 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://srch-qus7.hpwis.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaDownload.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaExtensions.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll
FF - plugin: c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-21 19:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\Dialogs\#32770]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\Dialogs\bosa_sdm_Microsoft Word 10.0]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\Dialogs\bosa_sdm_Microsoft Word 9.0]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\Dialogs\bosa_sdm_Mso96]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\Dialogs\bosa_sdm_XL9]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\Dialogs\NewDlgClass]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\dmcpl\Exceptions]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\Exceptions\ConsoleWindowClass]
@DACL=(02 0000)
@SACL=
"DesktopAll"=dword:00000001
"PositionMemory"=dword:00000001

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\explorer\Exceptions]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\freecell\Exceptions]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\rtvscan\Exceptions]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\rundll32\Exceptions]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\smartcenter\Exceptions]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\sol\Exceptions]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\speedy\Exceptions]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\NVIDIA Corporation\Global\nView\WindowManagement\winmine\Exceptions]
@DACL=(02 0000)
@SACL=
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(660)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll

- - - - - - - > 'lsass.exe'(716)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll

- - - - - - - > 'explorer.exe'(3816)
c:\windows\system32\WININET.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll

- - - - - - - > 'csrss.exe'(636)
c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
.
Completion time: 2010-09-21 19:53:16
ComboFix-quarantined-files.txt 2010-09-21 23:53
ComboFix2.txt 2010-09-21 16:14
ComboFix3.txt 2010-09-20 23:52

Pre-Run: 25,163,075,584 bytes free
Post-Run: 25,154,564,096 bytes free

- - End Of File - - 6DCFB067EF00452E9194FB11ACFA671D




Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4672

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/22/2010 11:06:07 AM
mbam-log-2010-09-22 (11-06-07).txt

Scan type: Quick scan
Objects scanned: 150447
Time elapsed: 24 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Alright here are the reports you requested in the order in which you requesred them. Now as to how this thing is reacting. let's see it still runs slow as in takes too long to load a web paige or switch from one paige to another. And now every time i press a button my mouse icon changes fron an arrow to an hourglass.









ComboFix 10-09-24.03 - Admin 09/24/2010 18:20:22.7.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.280 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Admin\Desktop\CFScript.txt
FW: ZoneAlarm Extreme Security Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2010-08-24 to 2010-09-24 )))))))))))))))))))))))))))))))
.

2010-09-07 16:37 . 2010-09-07 16:37 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-09-07 16:35 . 2010-09-07 16:35 ——– d—–w- c:\program files\NOS
2010-09-07 16:35 . 2010-08-13 13:13 35136 —-a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-09-07 16:35 . 2010-08-13 13:13 32032 —-a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-09-05 18:28 . 2010-09-05 18:28 ——– d—–w- C:\OEMSettings

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-24 22:07 . 2010-08-04 23:22 ——– d—–w- c:\documents and settings\Admin\Application Data\HPAppData
2010-09-24 18:19 . 2007-12-18 17:38 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-09-24 18:03 . 2010-01-22 17:24 144 —-a-w- c:\windows\system32\pdfl.dat
2010-09-24 16:22 . 2010-09-24 16:36 2172928 —-a-w- c:\windows\Internet Logs\xDB27.tmp
2010-09-24 16:22 . 2010-09-24 16:36 519680 —-a-w- c:\windows\Internet Logs\xDB26.tmp
2010-09-21 00:02 . 2010-09-21 00:01 20010386 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_09_20_19_25_45_full.dmp.zip
2010-09-18 17:53 . 2010-09-18 17:57 2163712 —-a-w- c:\windows\Internet Logs\xDB25.tmp
2010-09-18 17:51 . 2010-08-04 18:24 ——– d—–w- c:\program files\HP
2010-09-17 22:40 . 2010-09-18 02:41 2152448 —-a-w- c:\windows\Internet Logs\xDB7B.tmp
2010-09-07 16:46 . 2002-10-29 21:48 ——– d—–w- c:\program files\Common Files\Adobe
2010-09-07 16:36 . 2010-07-08 20:04 77184 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-09-07 16:36 . 2010-01-31 17:24 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-09-06 04:08 . 2008-03-21 13:30 ——– d—–w- c:\program files\CCleaner
2010-09-06 03:01 . 2010-09-06 03:52 2121216 —-a-w- c:\windows\Internet Logs\xDB24.tmp
2010-09-05 18:37 . 2010-09-05 18:39 2116608 —-a-w- c:\windows\Internet Logs\xDB23.tmp
2010-09-05 18:37 . 2010-09-05 18:39 41984 —-a-w- c:\windows\Internet Logs\xDB20.tmp
2010-09-05 18:29 . 2002-10-29 21:38 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-09-04 11:53 . 2010-09-05 18:31 2116096 —-a-w- c:\windows\Internet Logs\xDB22.tmp
2010-09-04 11:53 . 2010-09-05 18:31 2262016 —-a-w- c:\windows\Internet Logs\xDB21.tmp
2010-08-28 12:32 . 2010-08-28 12:31 21082243 —-a-w- c:\windows\Internet Logs\vsmon_on_demand_crt_term_2010_08_27_18_50_01_full.dmp.zip
2010-08-28 12:31 . 2010-08-28 12:30 21081991 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_49_26_full.dmp.zip
2010-08-28 12:30 . 2010-08-28 12:29 21082119 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_48_38_full.dmp.zip
2010-08-28 12:29 . 2010-08-28 12:28 21079618 —-a-w- c:\windows\Internet Logs\vsmon_1st_2010_08_27_18_46_22_full.dmp.zip
2010-08-27 05:28 . 2010-08-27 12:34 2095104 —-a-w- c:\windows\Internet Logs\xDB1F.tmp
2010-08-22 14:05 . 2010-08-22 19:42 2075136 —-a-w- c:\windows\Internet Logs\xDB1E.tmp
2010-08-21 05:30 . 2010-08-21 11:53 2075648 —-a-w- c:\windows\Internet Logs\xDB2B.tmp
2010-08-19 15:29 . 2010-08-19 15:54 2067456 —-a-w- c:\windows\Internet Logs\xDB1D.tmp
2010-08-17 13:17 . 2005-06-10 23:55 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-14 16:54 . 2010-08-14 16:54 ——– d—–w- c:\documents and settings\All Users\Application Data\CheckPoint
2010-08-13 14:11 . 2010-07-14 05:36 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-11 14:32 . 2010-08-11 14:33 1994240 —-a-w- c:\windows\Internet Logs\xDB1C.tmp
2010-08-11 14:28 . 2010-07-19 14:52 3399098 —-a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-08-09 05:07 . 2010-08-09 05:08 1981440 —-a-w- c:\windows\Internet Logs\xDB1B.tmp
2010-08-07 21:57 . 2010-08-07 21:57 ——– d—–w- c:\documents and settings\Admin\Application Data\FUJIFILM
2010-08-07 17:53 . 2010-08-07 17:55 1976832 —-a-w- c:\windows\Internet Logs\xDB1A.tmp
2010-08-05 17:48 . 2008-04-25 01:35 ——– d—–w- c:\program files\Windows Media Connect 2
2010-08-05 17:06 . 2010-08-05 17:07 1935360 —-a-w- c:\windows\Internet Logs\xDB19.tmp
2010-08-04 23:49 . 2007-12-23 02:32 ——– d—–w- c:\program files\FinePixViewer
2010-08-04 23:47 . 2010-08-04 23:47 ——– d—–w- c:\program files\REGSHAVE
2010-08-04 23:02 . 2010-08-04 22:34 201501 —-a-w- c:\windows\hpoins40.dat
2010-08-04 22:57 . 2010-07-09 02:20 ——– d—–w- c:\documents and settings\Admin\Application Data\HP
2010-08-04 22:57 . 2008-03-26 14:07 31536 -c–a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-04 22:50 . 2007-12-23 02:07 ——– d—–w- c:\documents and settings\All Users\Application Data\HP
2010-08-04 22:49 . 2010-08-04 22:49 ——– d—–w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2010-08-04 17:24 . 2010-08-04 17:25 1872384 —-a-w- c:\windows\Internet Logs\xDB18.tmp
2010-08-04 15:05 . 2002-10-29 21:49 ——– d—–w- c:\program files\Quicken
2010-08-04 04:29 . 2010-08-04 14:25 1868800 —-a-w- c:\windows\Internet Logs\xDB17.tmp
2010-08-03 11:56 . 2010-08-03 11:56 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\msvcp71.dll
2010-08-03 11:56 . 2010-08-03 11:56 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\jmc.dll
2010-08-03 11:56 . 2010-08-03 11:56 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5c2379bd-n\msvcr71.dll
2010-08-03 11:56 . 2010-08-03 11:56 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3d4d3209-n\decora-sse.dll
2010-08-03 11:56 . 2010-08-03 11:56 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3d4d3209-n\decora-d3d.dll
2010-08-03 11:43 . 2010-08-03 11:49 817664 —-a-w- c:\windows\Internet Logs\xDB16.tmp
2010-07-29 21:44 . 2010-07-30 21:55 1794048 —-a-w- c:\windows\Internet Logs\xDB15.tmp
2010-07-28 23:21 . 2007-12-18 02:13 ——– d—–w- c:\program files\Encarta Online
2010-07-28 23:12 . 2010-07-28 23:12 ——– d—–w- c:\documents and settings\Admin\Application Data\Image Zone Express
2010-07-28 22:33 . 2010-07-28 22:33 ——– d—–w- c:\program files\Common Files\Java
2010-07-28 19:22 . 2010-07-09 05:47 ——– d—–w- c:\program files\Java
2010-07-25 16:03 . 2010-07-25 16:04 1684992 —-a-w- c:\windows\Internet Logs\xDB14.tmp
2010-07-25 14:56 . 2010-07-25 14:56 305361 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2010_07_25_10_30_44_small.dmp.zip
2010-07-25 07:48 . 2010-07-25 11:07 1682944 —-a-w- c:\windows\Internet Logs\xDB11.tmp
2010-07-25 07:03 . 2010-07-25 11:20 1682944 —-a-w- c:\windows\Internet Logs\xDB13.tmp
2010-07-25 06:43 . 2010-07-25 11:20 338432 —-a-w- c:\windows\Internet Logs\xDB12.tmp
2010-07-22 15:49 . 2004-03-06 02:16 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-12-29 01:28 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 01:22 . 2010-01-22 17:24 72704 —-a-w- c:\windows\zllsputility.exe
2010-07-21 01:22 . 2010-08-03 05:46 1238528 —-a-w- c:\windows\system32\zpeng25.dll
2010-07-21 01:22 . 2010-08-03 05:46 69120 —-a-w- c:\windows\system32\zlcomm.dll
2010-07-21 01:22 . 2010-08-03 05:46 103936 —-a-w- c:\windows\system32\zlcommdb.dll
2010-07-20 23:25 . 2010-07-20 23:26 1692160 —-a-w- c:\windows\Internet Logs\xDBF.tmp
2010-07-20 23:25 . 2010-07-20 23:26 1692160 —-a-w- c:\windows\Internet Logs\xDB10.tmp
2010-07-17 09:00 . 2010-07-09 05:48 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-17 00:44 . 2010-07-17 00:46 1687040 —-a-w- c:\windows\Internet Logs\xDBE.tmp
2010-07-16 23:32 . 2010-07-16 23:33 1681920 —-a-w- c:\windows\Internet Logs\xDBD.tmp
2010-07-16 23:01 . 2010-07-16 23:03 1679872 —-a-w- c:\windows\Internet Logs\xDBC.tmp
2010-07-13 11:57 . 2010-07-13 12:01 1750016 —-a-w- c:\windows\Internet Logs\xDBA.tmp
2010-07-13 11:57 . 2010-07-13 12:01 1750016 —-a-w- c:\windows\Internet Logs\xDBB.tmp
2010-07-09 06:59 . 2010-07-09 07:01 25088 —-a-w- c:\windows\Internet Logs\xDB8.tmp
2010-07-09 06:59 . 2010-07-09 07:01 1735168 —-a-w- c:\windows\Internet Logs\xDB9.tmp
2010-07-09 06:03 . 2010-07-09 06:04 1732096 —-a-w- c:\windows\Internet Logs\xDB7.tmp
2010-07-09 06:03 . 2010-07-09 06:04 95744 —-a-w- c:\windows\Internet Logs\xDB6.tmp
2010-07-09 05:49 . 2010-07-09 05:49 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\msvcp71.dll
2010-07-09 05:49 . 2010-07-09 05:49 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\jmc.dll
2010-07-09 05:49 . 2010-07-09 05:49 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4c55ef47-n\msvcr71.dll
2010-07-09 05:49 . 2010-07-09 05:49 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ca48066-n\decora-d3d.dll
2010-07-09 05:49 . 2010-07-09 05:49 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ca48066-n\decora-sse.dll
2010-07-09 03:07 . 2010-07-09 03:07 51257 —-a-w- c:\windows\Internet Logs\zlclient_2nd_2010_07_08_22_57_33_small.dmp.zip
2010-07-08 00:50 . 2010-07-08 03:43 240128 —-a-w- c:\windows\Internet Logs\xDB4.tmp
2010-07-08 00:50 . 2010-07-08 03:43 1792512 —-a-w- c:\windows\Internet Logs\xDB5.tmp
2010-07-07 19:22 . 2010-07-07 19:22 32000 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:31 . 2002-11-16 07:31 149504 —-a-w- c:\windows\system32\schannel.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-09-20_23.44.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-24 18:01 . 2010-09-24 18:01 16384 c:\windows\temp\Perflib_Perfdata_6d4.dat
+ 2010-09-24 21:44 . 2010-09-24 21:44 35272 c:\windows\system32\ZoneLabs\avsys\temp\update\rollback\bases\av\ark\i386\win\mark32.dat
+ 2010-08-13 18:45 . 2010-09-24 18:25 49795 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0012.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90102 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0011.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90112 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0010.dat
+ 2010-01-22 17:37 . 2010-09-24 12:28 90043 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0009.dat
+ 2010-01-22 17:37 . 2010-09-23 12:37 90099 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0008.dat
+ 2010-01-22 17:37 . 2010-09-23 12:37 90076 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0007.dat
+ 2010-01-22 17:37 . 2010-09-23 12:37 90118 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0006.dat
+ 2010-01-22 17:37 . 2010-09-23 12:37 90118 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0005.dat
+ 2010-01-22 17:37 . 2010-09-23 12:37 87252 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0004.dat
+ 2010-01-22 17:37 . 2010-09-22 14:25 41612 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0003.dat
+ 2010-01-22 17:37 . 2010-09-22 14:25 50113 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0002.dat
+ 2010-01-22 17:37 . 2010-09-22 14:25 52292 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\wmuf\wmuf0001.dat
+ 2010-08-26 12:38 . 2010-09-23 12:37 24144 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\blst\bl0021.dat
+ 2010-08-25 00:32 . 2010-09-24 12:28 57549 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\av\qscan\i386\win\klark32.dat
+ 2010-01-22 17:37 . 2010-09-24 12:27 41229 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\av\ark\i386\win\mark32.dat
+ 2010-08-21 19:21 . 2010-09-23 12:37 90029 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0013.dat
+ 2010-08-06 11:30 . 2010-09-23 12:37 90116 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0012.dat
+ 2010-07-22 16:08 . 2010-09-23 12:37 90107 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0011.dat
+ 2010-07-15 02:47 . 2010-09-23 12:37 90092 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0010.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90108 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0009.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90109 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0008.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90087 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0007.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90106 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0006.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90092 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0005.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 89838 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0004.dat
+ 2010-01-22 17:37 . 2010-09-23 12:37 90092 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0003.dat
+ 2010-01-22 17:37 . 2010-09-23 12:37 69918 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0002.dat
+ 2010-01-22 17:37 . 2010-09-23 12:37 63840 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0001.dat
+ 2010-08-13 18:45 . 2010-09-23 12:37 48314 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0012.dat
+ 2010-07-07 15:46 . 2010-09-23 12:37 90102 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0011.dat
+ 2010-07-07 15:46 . 2010-09-23 12:37 90112 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0010.dat
+ 2010-01-22 17:39 . 2010-09-23 12:37 90044 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0009.dat
+ 2010-01-22 17:39 . 2010-09-23 12:37 90099 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0008.dat
+ 2010-01-22 17:23 . 2010-09-23 12:37 90076 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0007.dat
+ 2010-01-22 17:23 . 2010-09-23 12:37 90118 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0006.dat
+ 2010-01-22 17:23 . 2010-09-23 12:37 90118 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0005.dat
+ 2010-01-22 17:23 . 2010-09-23 12:37 87252 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0004.dat
+ 2010-01-22 17:23 . 2010-09-22 14:25 41612 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0003.dat
+ 2010-01-22 17:23 . 2010-09-22 14:25 50113 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0002.dat
+ 2010-01-22 17:23 . 2010-09-22 14:25 52292 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0001.dat
- 2010-01-22 17:23 . 2010-07-07 15:41 35272 c:\windows\system32\ZoneLabs\avsys\bases\mark32.dat
+ 2010-01-22 17:23 . 2010-09-24 21:46 35272 c:\windows\system32\ZoneLabs\avsys\bases\mark32.dat
+ 2010-08-26 12:39 . 2010-09-23 12:37 24144 c:\windows\system32\ZoneLabs\avsys\bases\bl0021.dat
+ 2010-08-21 19:23 . 2010-09-23 12:37 90029 c:\windows\system32\ZoneLabs\avsys\bases\apu0013.dat
+ 2010-09-03 19:19 . 2010-09-23 12:37 90116 c:\windows\system32\ZoneLabs\avsys\bases\apu0012.dat
+ 2010-09-03 19:19 . 2010-09-23 12:37 90107 c:\windows\system32\ZoneLabs\avsys\bases\apu0011.dat
+ 2010-07-15 02:47 . 2010-09-23 12:37 90092 c:\windows\system32\ZoneLabs\avsys\bases\apu0010.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90108 c:\windows\system32\ZoneLabs\avsys\bases\apu0009.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90109 c:\windows\system32\ZoneLabs\avsys\bases\apu0008.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90087 c:\windows\system32\ZoneLabs\avsys\bases\apu0007.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90106 c:\windows\system32\ZoneLabs\avsys\bases\apu0006.dat
+ 2010-07-07 15:41 . 2010-09-23 12:37 90092 c:\windows\system32\ZoneLabs\avsys\bases\apu0005.dat
+ 2010-09-03 19:18 . 2010-09-23 12:37 89838 c:\windows\system32\ZoneLabs\avsys\bases\apu0004.dat
+ 2010-01-22 17:23 . 2010-09-23 12:37 90092 c:\windows\system32\ZoneLabs\avsys\bases\apu0003.dat
+ 2010-01-22 17:23 . 2010-09-23 12:37 69918 c:\windows\system32\ZoneLabs\avsys\bases\apu0002.dat
+ 2010-09-03 19:17 . 2010-09-23 12:37 63840 c:\windows\system32\ZoneLabs\avsys\bases\apu0001.dat
+ 2010-09-24 21:44 . 2010-09-24 21:44 4957 c:\windows\system32\ZoneLabs\avsys\temp\update\rollback\bases\apu\apu0014.dat
+ 2010-09-18 16:38 . 2010-09-24 21:43 6065 c:\windows\system32\ZoneLabs\avsys\temp\temporaryFolder\bases\apu\apu0014.dat
+ 2010-09-18 16:38 . 2010-09-24 21:46 4957 c:\windows\system32\ZoneLabs\avsys\bases\apu0014.dat
+ 2010-09-22 15:24 . 2010-09-22 15:24 232912 c:\windows\system32\Macromed\Flash\FlashUtil10k_Plugin.exe
- 2010-07-14 05:35 . 2010-08-18 05:08 5969360 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2010-07-14 05:35 . 2010-09-22 15:24 5969360 c:\windows\system32\Macromed\Flash\NPSWF32.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-09-09 114688]
"WCOLOREAL"="c:\program files\COMPAQ\Coloreal\coloreal.exe" [2002-02-21 143360]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 55824]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2008-7-1 2326528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [10/9/2007 2:13 PM 38144]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 9:30 AM 26352]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 9:30 AM 493032]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
R3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [10/14/2009 9:29 AM 35568]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [12/28/2007 4:02 PM 287232]
S3 msCMTSrvc;Content Monitoring Tool; [x]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [11/16/2002 3:31 AM 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-08-29 c:\windows\Tasks\FileCure Default.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]

2010-09-24 c:\windows\Tasks\FileCure Startup.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]

2010-09-24 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2010-07-08 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]

2010-09-24 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://srch-qus7.hpwis.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaDownload.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaExtensions.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll
FF - plugin: c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\q6qlul0d.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-24 18:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-4263847086-1552473617-377300773-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(664)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll

- - - - - - - > 'lsass.exe'(720)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll

- - - - - - - > 'explorer.exe'(468)
c:\windows\system32\WININET.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll

- - - - - - - > 'csrss.exe'(640)
c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
.
Completion time: 2010-09-24 18:41:32
ComboFix-quarantined-files.txt 2010-09-24 22:41
ComboFix2.txt 2010-09-21 23:53
ComboFix3.txt 2010-09-21 16:14
ComboFix4.txt 2010-09-20 23:52

Pre-Run: 24,747,450,368 bytes free
Post-Run: 24,929,341,440 bytes free

- - End Of File - - 04226EAE97A10C3986B36AE9266151BE





ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=7f4592443e443d4787366bec95072c25
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-09-24 11:31:42
# local_time=2010-09-24 07:31:42 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16776893 100 77 3634425 5445431 0 0
# scanned=3885
# found=0
# cleaned=0
# scan_time=340
esets_scanner_update returned -1 esets_gle=53251
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=7f4592443e443d4787366bec95072c25
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-09-25 01:43:39
# local_time=2010-09-24 09:43:39 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16776893 100 77 3634961 5445967 0 0
# scanned=71061
# found=2
# cleaned=2
# scan_time=7707
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\54ea435\6143.mof.vir Win32/RogueAV.A trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP224\A0161795.mof Win32/RogueAV.A trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C