IR Hijacked - won't start

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:54:05 PM, on 9/23/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Emmet Smith\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pctools.com/mrc/fix_homepage/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100920083416.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O3 - Toolbar: Avery Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [gddiijmf] C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\iijauhgot\okeptnstssd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [yebvxfxj] C:\Documents and Settings\NetworkService\Local Settings\Application Data\rrkgxqfsk\phnotddtssd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [wqguyyoc] C:\Documents and Settings\NetworkService\Local Settings\Application Data\elwfmpede\kbpqqvotssd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ryhyeilg] C:\Documents and Settings\NetworkService\Local Settings\Application Data\qdhjgyxqc\miuvxnttssd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ekbrbbgi] C:\Documents and Settings\NetworkService\Local Settings\Application Data\xgntsevih\ocdidnatssd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [gddiijmf] C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\iijauhgot\okeptnstssd.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6770.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1254091013500
O16 - DPF: {8BBDC81D-81B3-49EE-87E8-47B7A707FAE8} (GoToMeeting Web Starter) - https://www1.gotomeeting.com/default/applets/g2mdlax.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{26FE9057-D82E-4A03-B091-0E49DD630A76}: NameServer = 205.188.146.145
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: l,C:\WINDOWS\system32\syspol32.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\615\G2AWinLogon.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Acronis System Backup (acrosysbackup_exFfWBCzg-mL) - Unknown owner - C:\WINDOWS\system32\wirepots.exe (file missing)
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: dlcd_device - - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\615\g2aservice.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 11499 bytes

Please do the following

Open Hijackthis and select Do a system scan only

Place a check against the following entries

04 - HKUS\S-1-5-18\..\Run: [gddiijmf] C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\iijauhgot\okeptnstssd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [yebvxfxj] C:\Documents and Settings\NetworkService\Local Settings\Application Data\rrkgxqfsk\phnotddtssd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [wqguyyoc] C:\Documents and Settings\NetworkService\Local Settings\Application Data\elwfmpede\kbpqqvotssd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ryhyeilg] C:\Documents and Settings\NetworkService\Local Settings\Application Data\qdhjgyxqc\miuvxnttssd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ekbrbbgi] C:\Documents and Settings\NetworkService\Local Settings\Application Data\xgntsevih\ocdidnatssd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [gddiijmf] C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\iijauhgot\okeptnstssd.exe (User 'Default user')
O20 - AppInit_DLLs: l,C:\WINDOWS\system32\syspol32.dll
O23 - Service: Acronis System Backup (acrosysbackup_exFfWBCzg-mL) - Unknown owner - C:\WINDOWS\system32\wirepots.exe (file missing)

Close all open windows except Hijackthis and click Fix checked.Close Hijackthis.

Reboot the computer

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  
  netsvcs
  drivers32
  %SYSTEMDRIVE%\*.*
  %systemroot%\Fonts\*.com
  %systemroot%\Fonts\*.dll
  %systemroot%\Fonts\*.ini
  %systemroot%\Fonts\*.ini2
  %systemroot%\Fonts\*.exe
  %systemroot%\system32\spool\prtprocs\w32x86\*.*
  %systemroot%\REPAIR\*.bak1
  %systemroot%\REPAIR\*.ini
  %systemroot%\system32\*.jpg
  %systemroot%\*.jpg
  %systemroot%\*.png
  %systemroot%\*.scr
  %systemroot%\*._sy
  %APPDATA%\Adobe\Update\*.*
  %ALLUSERSPROFILE%\Favorites\*.*
  %APPDATA%\Microsoft\*.*
  %PROGRAMFILES%\*.*
  %APPDATA%\Update\*.*
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\System32\config\*.sav
  %PROGRAMFILES%\bak. /s
  %systemroot%\system32\bak. /s
  %ALLUSERSPROFILE%\Start Menu\*.lnk /x
  %systemroot%\system32\config\systemprofile\*.dat /x
  %systemroot%\*.config
  %systemroot%\system32\*.db
  %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
  %USERPROFILE%\Desktop\*.exe
  %PROGRAMFILES%\Common Files\*.*
  %systemroot%\*.src
  %systemroot%\install\*.*
  %systemroot%\system32\DLL\*.*
  %systemroot%\system32\HelpFiles\*.*
  %systemroot%\system32\rundll\*.*
  %systemroot%\winn32\*.*
  %systemroot%\Java\*.*
  %systemroot%\system32\test\*.*
  %systemroot%\system32\Rundll32\*.*
  %systemroot%\AppPatch\Custom\*.*
  %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
  %PROGRAMFILES%\PC-Doctor\Downloads\*.*
  %PROGRAMFILES%\Internet Explorer\*.tmp
  %PROGRAMFILES%\Internet Explorer\*.dat
  %USERPROFILE%\My Documents\*.exe
  %USERPROFILE%\*.exe
  %systemroot%\ADDINS\*.*
  %systemroot%\assembly\*.bak2
  %systemroot%\Config\*.*
  %systemroot%\REPAIR\*.bak2
  %systemroot%\SECURITY\Database\*.sdb /x
  %systemroot%\SYSTEM\*.bak2
  %systemroot%\Web\*.bak2
  %systemroot%\Driver Cache\*.*
  %PROGRAMFILES%\Mozilla Firefox\0*.exe
  %ProgramFiles%\Microsoft Common\*.*
  %ProgramFiles%\TinyProxy.
  %USERPROFILE%\Favorites\*.url /x
  %systemroot%\system32\*.bk
  %systemroot%\*.te
  %systemroot%\system32\system32\*.*
  %ALLUSERSPROFILE%\*.dat /x
  %systemroot%\system32\drivers\*.rmv
  dir /b "%systemroot%\system32\*.exe" | find /i " " /c
  dir /b "%systemroot%\*.exe" | find /i " " /c
  %PROGRAMFILES%\Microsoft\*.*
  %systemroot%\System32\Wbem\proquota.exe
  %PROGRAMFILES%\Mozilla Firefox\*.dat
  %USERPROFILE%\Cookies\*.txt /x
  %SystemRoot%\system32\fonts\*.*
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER won't run try with devices unchecked.If still no go try in safe mode.



In your next reply please post the following.

• Both OTL logs
• GMER log

DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 17:51:51.53 on Fri 09/24/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.169 [GMT -4:00] AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\System32\svchost.exe -k NetworkService C:\WINDOWS\System32\svchost.exe -k LocalService C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe -k LocalService C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe c:\PROGRA~1\mcafee\SITEAD~1\McSACore.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\wanmpsvc.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Emmet Smith\Desktop\dds.pif C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.comcast.net/ mStart Page = hxxp://www.pctools.com/mrc/fix_homepage/ uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20100920083416.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Avery Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll TB: Avery Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [BCMSMMSG] BCMSMMSG.exe mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\americ~1.lnk - c:\program files\america online 9.0\aoltray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE mPolicies-system: EnableLUA = 0 (0x0) IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll Trusted Zone: internet Trusted Zone: mcafee.com DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/Dcode/ActiveX/MSDcode.cab DPF: {32505657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1254091013500 DPF: {8BBDC81D-81B3-49EE-87E8-47B7A707FAE8} - hxxps://www1.gotomeeting.com/default/applets/g2mdlax.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Notify: GoToAssist - c:\program files\citrix\gotoassist\615\G2AWinLogon.dll LSA: Authentication Packages = msv1_0 iihhgd.dll ============= SERVICES / DRIVERS =============== R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-5-31 386712] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-4-14 218592] R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-9-13 84072] R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-4 98304] R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2010-4-14 198608] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\McSACore.exe [2010-9-13 88176] R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-9-13 171168] R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-9-13 188136] R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-9-13 141792] R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-4 118784] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-9-13 152992] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-9-13 52104] R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-9-13 312904] R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-9-13 88544] S1 94OG747;94OG747;c:\windows\system32\drivers\94og747.sys –> c:\windows\system32\drivers\94OG747.sys [?] S1 dcsilel;dcsilel;c:\windows\system32\drivers\dcsilel.sys [2002-9-3 302336] S2 acrosysbackup_exFfWBCzg-mL;Acronis System Backup;c:\windows\system32\wirepots.exe –> c:\windows\system32\wirepots.exe [?] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-6 135664] S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-9-13 55840] S3 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service –> c:\windows\system32\dlcdcoms.exe -service [?] S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-9-13 88544] S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-9-20 84264] S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2010-8-4 50704] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-4-14 366840] S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-4-14 1142224] S4 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2010-4-14 233136] S4 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2010-4-14 63360] =============== Created Last 30 ================ 2010-09-21 20:39:25 664 —-a-w- c:\windows\system32\d3d9caps.dat 2010-09-21 04:51:46 47616 —ha-w- c:\windows\system32\calcetup.dll 2010-09-20 12:32:39 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys 2010-09-14 17:21:37 54156 —ha-w- c:\windows\QTFont.qfn 2010-09-14 17:21:37 1409 —-a-w- c:\windows\QTFont.for 2010-09-13 17:22:06 0 d—–w- c:\program files\SiteAdvisor 2010-09-13 17:20:50 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys 2010-09-13 17:20:43 88544 —-a-w- c:\windows\system32\drivers\mfendisk.sys 2010-09-13 17:20:43 84264 ——w- c:\windows\system32\drivers\SET1DD.tmp 2010-09-13 17:20:43 84072 —-a-w- c:\windows\system32\drivers\mfetdi2k.sys 2010-09-13 17:20:43 84072 ——w- c:\windows\system32\drivers\SET204.tmp 2010-09-13 17:20:42 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys 2010-09-13 17:20:42 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys 2010-09-13 17:20:42 52104 ——w- c:\windows\system32\drivers\SET205.tmp 2010-09-13 17:20:42 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys 2010-09-13 17:20:42 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys 2010-09-13 17:20:32 0 d—–w- c:\program files\common files\Mcafee 2010-09-13 17:20:11 0 d—–w- c:\program files\McAfee 2010-09-11 05:12:46 0 d—–w- c:\windows\McAfee.com 2010-09-10 21:56:56 55456 ——w- c:\windows\system32\drivers\SET43C.tmp 2010-09-02 16:03:39 40772 —-a-w- c:\windows\exe.exe ==================== Find3M ==================== 2010-08-24 18:57:38 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys 2010-08-24 18:57:38 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys 2010-08-22 16:49:55 77808 —-a-w- c:\docume~1\emmets~1\applic~1\GDIPFONTCACHEV1.DAT 2010-08-04 12:09:06 50704 —-a-w- c:\windows\system32\drivers\npf.sys 2010-08-04 12:09:05 281104 —-a-w- c:\windows\system32\wpcap.dll 2010-08-04 12:09:04 100880 —-a-w- c:\windows\system32\Packet.dll 2010-07-27 22:37:55 140288 —-a-w- c:\windows\system32\pcre3.dll 2010-07-21 12:47:36 767928 —-a-w- c:\windows\BDTSupport.dll 2010-07-19 07:26:11 149456 —-a-w- c:\windows\SGDetectionTool.dll 2010-07-19 07:26:10 264144 —-a-w- c:\windows\PCTBDRes.dll 2010-07-19 07:26:09 1435600 —-a-w- c:\windows\PCTBDCore.dll 2009-10-14 14:00:22 245760 –sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat 2009-10-10 18:29:17 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009092120090928\index.dat 2009-10-10 18:29:17 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009101020091011\index.dat ============= FINISH: 18:14:19.04 ===============

here is the ComboFix log :

ComboFix 10-09-24.05 - Emmet Smith 09/25/2010 12:21:48.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.310 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Emmet Smith\Local Settings\Application Data\Desktop Cleanup Wizard
c:\documents and settings\Joanne\Application Data\Atzy
c:\documents and settings\Joanne\Application Data\Atzy\iwmo.exe
c:\documents and settings\Joanne\Application Data\Wogyoc
c:\documents and settings\Joanne\Application Data\Wogyoc\ibra.ewi
c:\documents and settings\Joanne\Application Data\Yvce
c:\documents and settings\Joanne\Application Data\Yvce\ixom.exe
c:\windows\Downloaded Program Files\ODCTOOLS
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\wpcap.dll

Infected copy of c:\windows\system32\drivers\tcpip.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_NPF
——-\Service_NPF


((((((((((((((((((((((((( Files Created from 2010-08-25 to 2010-09-25 )))))))))))))))))))))))))))))))
.

2010-09-25 14:55 . 2008-11-12 21:12 1370528 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\msvc9rt.exe
2010-09-25 14:55 . 2008-07-23 18:35 74536 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\instSup.dll
2010-09-25 14:55 . 2006-07-31 18:41 474184 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\gui.dll
2010-09-25 14:55 . 2006-04-06 15:33 25088 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\EEStart.exe
2010-09-25 14:55 . 2008-12-03 16:09 59184 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\toolbarsud.exe
2010-09-25 14:55 . 2008-11-06 14:42 2100984 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\aol_toolbar_dual.exe
2010-09-25 14:55 . 2006-04-06 15:33 81000 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\ProgUpd.dll
2010-09-25 14:55 . 2006-04-06 15:33 156264 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\setup.exe
2010-09-25 14:55 . 2006-04-06 15:33 33896 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\postproc.exe
2010-09-25 14:55 . 2008-12-02 18:34 2316392 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\ocpinst.exe
2010-09-25 14:55 . 2008-07-23 18:35 62248 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\ocpgc.exe
2010-09-25 14:55 . 2008-07-23 18:35 15144 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\ocpchk.dll
2010-09-25 14:50 . 2009-12-14 21:00 106496 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_Almaak.dll
2010-09-25 14:50 . 2009-12-16 12:07 136528 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\AOLSetup.exe
2010-09-25 14:50 . 2009-12-15 11:14 95568 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\RunOnce.exe
2010-09-25 14:50 . 2009-12-16 12:07 136528 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\Vercopy.exe
2010-09-25 14:50 . 2009-12-17 05:09 49241 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_BunkerHill.dll
2010-09-25 14:50 . 2009-12-15 11:33 120144 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\SBFix.exe
2010-09-25 14:50 . 2009-12-15 09:35 106496 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_Raga_Refresh.dll
2010-09-25 14:50 . 2009-12-14 19:06 106496 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_Thailand.dll
2010-09-25 14:50 . 2009-12-14 19:03 106496 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_Strauss.dll
2010-09-25 06:11 . 2010-09-25 06:11 ——– d—–w- c:\documents and settings\Joanne\Local Settings\Application Data\AOL
2010-09-25 04:06 . 2010-09-25 04:06 ——– d—–w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\AOL
2010-09-25 04:05 . 2007-07-23 19:58 2223544 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\ocpinst.exe
2010-09-25 04:05 . 2007-06-08 21:01 54832 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\ocpgc.exe
2010-09-25 04:05 . 2007-06-08 21:01 15920 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\ocpchk.dll
2010-09-25 04:05 . 2007-06-08 21:01 67120 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\instsup.dll
2010-09-25 04:05 . 2007-05-09 15:30 98304 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\regwrite.exe
2010-09-25 04:05 . 2006-04-06 15:49 81000 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\progupd.dll
2010-09-25 04:05 . 2006-04-06 15:49 33896 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\postproc.exe
2010-09-25 04:05 . 2006-04-06 15:49 156264 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\setup.exe
2010-09-25 04:05 . 2006-07-31 18:57 474184 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\gui.dll
2010-09-25 04:05 . 2006-04-06 15:49 25088 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\eestart.exe
2010-09-25 04:05 . 2010-09-25 04:05 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL Downloads
2010-09-24 22:23 . 2010-09-24 22:23 ——– d—–w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\WinZip
2010-09-23 15:54 . 2010-09-23 15:54 ——– d—–w- c:\documents and settings\LocalService\Application Data\AdobeUM
2010-09-21 20:39 . 2010-09-25 11:22 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-09-20 12:32 . 2010-08-24 18:57 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2010-09-13 17:22 . 2010-09-13 17:22 ——– d—–w- c:\program files\SiteAdvisor
2010-09-13 17:20 . 2010-08-24 18:57 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-09-13 17:20 . 2010-08-24 18:57 88544 —-a-w- c:\windows\system32\drivers\mfendisk.sys
2010-09-13 17:20 . 2010-08-24 18:57 84072 —-a-w- c:\windows\system32\drivers\mfetdi2k.sys
2010-09-13 17:20 . 2010-08-24 18:57 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys
2010-09-13 17:20 . 2010-08-24 18:57 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-09-13 17:20 . 2010-08-24 18:57 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2010-09-13 17:20 . 2010-08-24 18:57 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-09-13 17:20 . 2010-09-24 20:49 ——– d—–w- c:\program files\Common Files\Mcafee
2010-09-13 17:20 . 2010-09-24 20:49 ——– d—–w- c:\program files\McAfee
2010-09-11 16:03 . 2010-09-23 15:54 ——– d—–w- c:\program files\Windows Live Safety Center
2010-09-11 06:07 . 2010-09-11 06:07 77808 —-a-w- c:\documents and settings\Joanne\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-11 05:12 . 2010-09-11 05:12 ——– d—–w- c:\windows\McAfee.com
2010-09-02 16:03 . 2010-09-02 16:03 40772 —-a-w- c:\windows\exe.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-25 16:47 . 2010-04-14 19:43 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-25 15:49 . 2010-04-14 19:44 ——– d—–w- c:\program files\Spyware Doctor
2010-09-25 04:06 . 2009-09-29 02:04 ——– d—–w- c:\program files\Common Files\AOL
2010-09-25 04:05 . 2009-09-29 02:04 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL
2010-09-24 20:51 . 2009-09-27 23:04 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-09-23 15:54 . 2009-09-29 02:04 ——– d—–w- c:\program files\America Online 9.0
2010-09-23 15:54 . 2009-09-15 20:05 ——– d—–w- c:\documents and settings\Emmet Smith\Application Data\U3
2010-09-22 04:18 . 2009-11-12 14:48 ——– d—–w- c:\documents and settings\Joanne\Application Data\Okfoaz
2010-09-22 01:10 . 2010-05-13 01:03 72080 —-a-w- c:\windows\java\g2mdlhlpx.exe
2010-09-14 14:51 . 2009-11-16 01:14 ——– d—–w- c:\program files\Common Files\Adobe
2010-09-11 13:15 . 2009-09-28 01:21 77808 —-a-w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-26 19:12 . 2009-11-14 07:10 ——– d—–w- c:\documents and settings\Emmet Smith\Application Data\Uwxeo
2010-08-26 18:23 . 2010-04-02 09:16 ——– d—–w- c:\documents and settings\Emmet Smith\Application Data\Evvoob
2010-08-24 18:57 . 2010-09-13 17:20 84264 ——w- c:\windows\system32\drivers\SET1DD.tmp
2010-08-24 18:57 . 2010-09-13 17:20 84072 ——w- c:\windows\system32\drivers\SET204.tmp
2010-08-24 18:57 . 2010-09-13 17:20 52104 ——w- c:\windows\system32\drivers\SET205.tmp
2010-08-24 18:57 . 2010-06-01 00:32 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 18:57 . 2010-06-01 00:32 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-13 21:46 . 2010-08-13 21:46 ——– d—–w- c:\program files\Avery
2010-08-13 21:42 . 2010-08-13 21:42 ——– d—–w- c:\program files\Ask.com
2010-08-08 14:20 . 2010-04-19 00:37 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 22:37 . 2010-07-27 22:37 140288 —-a-w- c:\windows\system32\pcre3.dll
2010-07-21 12:47 . 2010-04-14 19:46 767928 —-a-w- c:\windows\BDTSupport.dll
2010-07-19 07:26 . 2010-04-14 19:46 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-07-19 07:26 . 2010-04-14 19:46 192 —-a-w- c:\windows\UDB.zip
2010-07-19 07:26 . 2010-04-14 19:46 264144 —-a-w- c:\windows\PCTBDRes.dll
2010-07-19 07:26 . 2010-04-14 19:46 1435600 —-a-w- c:\windows\PCTBDCore.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-01-20 14:34 1197448 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-03 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"nwiz"="nwiz.exe" [2003-10-06 741376]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2009-09-29 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-29 77824]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"HostManager"="c:\program files\Common Files\AOL\1285387552\ee\AOLSoftware.exe" [2006-09-26 50736]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-4 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2009-9-28 36954]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2010-09-11 05:55 13672 —-a-w- c:\program files\Citrix\GoToAssist\615\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\system32\\lsass.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [4/14/2010 3:45 PM 218592]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [9/13/2010 1:20 PM 84072]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [10/4/2004 5:47 AM 98304]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [4/14/2010 3:46 PM 198608]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\McSACore.exe [9/13/2010 1:21 PM 88176]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [9/13/2010 1:21 PM 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\Mcafee\SystemCore\mfevtps.exe [9/13/2010 1:20 PM 141792]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [10/4/2004 4:40 AM 118784]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [9/13/2010 1:20 PM 312904]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [9/13/2010 1:20 PM 88544]
S1 94OG747;94OG747;c:\windows\system32\drivers\94OG747.sys –> c:\windows\system32\drivers\94OG747.sys [?]
S1 dcsilel;dcsilel;c:\windows\system32\drivers\dcsilel.sys [9/3/2002 3:50 PM 302336]
S2 acrosysbackup_exFfWBCzg-mL;Acronis System Backup;c:\windows\system32\wirepots.exe –> c:\windows\system32\wirepots.exe [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/6/2010 3:46 PM 135664]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [9/13/2010 1:20 PM 55840]
S3 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service –> c:\windows\system32\dlcdcoms.exe -service [?]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [9/13/2010 1:20 PM 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [9/20/2010 8:32 AM 84264]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/14/2010 3:44 PM 366840]
S4 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [4/14/2010 3:45 PM 233136]
S4 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [4/14/2010 3:44 PM 63360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 19:46]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 19:46]

2010-09-25 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-01-20 14:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/
mStart Page = hxxp://www.pctools.com/mrc/fix_homepage/
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
SafeBoot-94OG747
SafeBoot-dcsilel



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-25 12:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1052)
c:\program files\Citrix\GoToAssist\615\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(644)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\System32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\windows\BCMSMMSG.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-09-25 12:52:40 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-25 16:52

Pre-Run: 105,896,312,832 bytes free
Post-Run: 108,855,603,200 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - C274276EEE30157F4022A076FCCBF217

here is the ComboFix log:

ComboFix 10-09-25.03 - Emmet Smith 09/25/2010 17:21:46.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.246 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Emmet Smith\Desktop\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
FW: McAfee Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"c:\windows\exe.exe"
"c:\windows\system32\drivers\94OG747.sys"
"c:\windows\system32\drivers\dcsilel.sys"
"c:\windows\system32\wirepots.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\exe.exe
c:\windows\system32\drivers\dcsilel.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_94OG747
——-\Service_dcsilel


((((((((((((((((((((((((( Files Created from 2010-08-25 to 2010-09-25 )))))))))))))))))))))))))))))))
.

2010-09-25 18:43 . 2010-09-25 18:43 ——– d—–w- c:\program files\McAfee.com
2010-09-25 06:11 . 2010-09-25 06:11 ——– d—–w- c:\documents and settings\Joanne\Local Settings\Application Data\AOL
2010-09-25 04:06 . 2010-09-25 04:06 ——– d—–w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\AOL
2010-09-25 04:05 . 2010-09-25 04:05 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL Downloads
2010-09-24 22:23 . 2010-09-24 22:23 ——– d—–w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\WinZip
2010-09-23 15:54 . 2010-09-23 15:54 ——– d—–w- c:\documents and settings\LocalService\Application Data\AdobeUM
2010-09-21 20:39 . 2010-09-25 11:22 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-09-20 12:32 . 2010-08-24 18:57 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2010-09-13 17:22 . 2010-09-25 18:44 ——– d—–w- c:\program files\SiteAdvisor
2010-09-13 17:20 . 2010-08-24 18:57 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-09-13 17:20 . 2010-08-24 18:57 88544 —-a-w- c:\windows\system32\drivers\mfendisk.sys
2010-09-13 17:20 . 2010-08-24 18:57 84072 —-a-w- c:\windows\system32\drivers\mfetdi2k.sys
2010-09-13 17:20 . 2010-08-24 18:57 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys
2010-09-13 17:20 . 2010-08-24 18:57 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-09-13 17:20 . 2010-08-24 18:57 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2010-09-13 17:20 . 2010-08-24 18:57 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-09-13 17:20 . 2010-09-25 18:44 ——– d—–w- c:\program files\Common Files\Mcafee
2010-09-13 17:20 . 2010-09-25 18:44 ——– d—–w- c:\program files\McAfee
2010-09-11 16:03 . 2010-09-23 15:54 ——– d—–w- c:\program files\Windows Live Safety Center
2010-09-11 06:07 . 2010-09-11 06:07 77808 —-a-w- c:\documents and settings\Joanne\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-11 05:12 . 2010-09-11 05:12 ——– d—–w- c:\windows\McAfee.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-25 21:34 . 2010-04-14 19:43 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-25 18:50 . 2009-09-27 23:04 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-09-25 18:33 . 2010-04-14 19:44 ——– d—–w- c:\program files\Spyware Doctor
2010-09-25 04:06 . 2009-09-29 02:04 ——– d—–w- c:\program files\Common Files\AOL
2010-09-25 04:05 . 2009-09-29 02:04 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL
2010-09-23 15:54 . 2009-09-29 02:04 ——– d—–w- c:\program files\America Online 9.0
2010-09-23 15:54 . 2009-09-15 20:05 ——– d—–w- c:\documents and settings\Emmet Smith\Application Data\U3
2010-09-22 04:18 . 2009-11-12 14:48 ——– d—–w- c:\documents and settings\Joanne\Application Data\Okfoaz
2010-09-22 01:10 . 2010-05-13 01:03 72080 —-a-w- c:\windows\java\g2mdlhlpx.exe
2010-09-14 14:51 . 2009-11-16 01:14 ——– d—–w- c:\program files\Common Files\Adobe
2010-09-11 13:15 . 2009-09-28 01:21 77808 —-a-w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-26 19:12 . 2009-11-14 07:10 ——– d—–w- c:\documents and settings\Emmet Smith\Application Data\Uwxeo
2010-08-26 18:23 . 2010-04-02 09:16 ——– d—–w- c:\documents and settings\Emmet Smith\Application Data\Evvoob
2010-08-24 18:57 . 2010-09-13 17:20 84264 ——w- c:\windows\system32\drivers\SET1DD.tmp
2010-08-24 18:57 . 2010-09-13 17:20 84072 ——w- c:\windows\system32\drivers\SET204.tmp
2010-08-24 18:57 . 2010-09-13 17:20 52104 ——w- c:\windows\system32\drivers\SET205.tmp
2010-08-24 18:57 . 2010-06-01 00:32 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 18:57 . 2010-06-01 00:32 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-13 21:46 . 2010-08-13 21:46 ——– d—–w- c:\program files\Avery
2010-08-13 21:42 . 2010-08-13 21:42 ——– d—–w- c:\program files\Ask.com
2010-08-08 14:20 . 2010-04-19 00:37 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 22:37 . 2010-07-27 22:37 140288 —-a-w- c:\windows\system32\pcre3.dll
2010-07-21 12:47 . 2010-04-14 19:46 767928 —-a-w- c:\windows\BDTSupport.dll
2010-07-19 07:26 . 2010-04-14 19:46 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-07-19 07:26 . 2010-04-14 19:46 192 —-a-w- c:\windows\UDB.zip
2010-07-19 07:26 . 2010-04-14 19:46 264144 —-a-w- c:\windows\PCTBDRes.dll
2010-07-19 07:26 . 2010-04-14 19:46 1435600 —-a-w- c:\windows\PCTBDCore.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\documents and settings\Emmet Smith\Application Data\Evvoob —-


—- Directory of c:\documents and settings\Emmet Smith\Application Data\Uwxeo —-



((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-01-20 14:34 1197448 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-03 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"nwiz"="nwiz.exe" [2003-10-06 741376]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2009-09-29 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-29 77824]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"HostManager"="c:\program files\Common Files\AOL\1285387552\ee\AOLSoftware.exe" [2006-09-26 50736]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-07-01 1193848]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-4 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2009-9-28 36954]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2010-09-11 05:55 13672 —-a-w- c:\program files\Citrix\GoToAssist\615\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\system32\\lsass.exe"=
"c:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [4/14/2010 3:45 PM 218592]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [9/13/2010 1:20 PM 84072]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [10/4/2004 5:47 AM 98304]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [4/14/2010 3:46 PM 198608]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\McSACore.exe [9/13/2010 1:21 PM 93320]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/25/2010 2:43 PM 271480]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/25/2010 2:43 PM 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [9/13/2010 1:21 PM 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\Mcafee\SystemCore\mfevtps.exe [9/13/2010 1:20 PM 141792]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [10/4/2004 4:40 AM 118784]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [9/13/2010 1:20 PM 55840]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [9/13/2010 1:20 PM 312904]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [9/13/2010 1:20 PM 88544]
S2 acrosysbackup_exFfWBCzg-mL;Acronis System Backup;c:\windows\system32\wirepots.exe –> c:\windows\system32\wirepots.exe [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/6/2010 3:46 PM 135664]
S3 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service –> c:\windows\system32\dlcdcoms.exe -service [?]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [9/13/2010 1:20 PM 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [9/20/2010 8:32 AM 84264]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/14/2010 3:44 PM 366840]
S4 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [4/14/2010 3:45 PM 233136]
S4 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [4/14/2010 3:44 PM 63360]

— Other Services/Drivers In Memory —

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 19:46]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 19:46]

2010-09-25 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-01-20 14:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/
mStart Page = hxxp://www.pctools.com/mrc/fix_homepage/
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-25 17:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1044)
c:\program files\Citrix\GoToAssist\615\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(2432)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\System32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\windows\BCMSMMSG.exe
.
**************************************************************************
.
Completion time: 2010-09-25 17:43:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-25 21:43
ComboFix2.txt 2010-09-25 16:52

Pre-Run: 108,401,917,952 bytes free
Post-Run: 108,419,117,056 bytes free

- - End Of File - - 1F808B479A69B49611BA3B5C4CA6E7F4

here is the ComboFix log:

ComboFix 10-09-25.07 - Emmet Smith 09/26/2010 13:37:27.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.232 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Emmet Smith\Desktop\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
FW: McAfee Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"c:\windows\system32\drivers\SET1DD.tmp"
"c:\windows\system32\drivers\SET204.tmp"
"c:\windows\system32\drivers\SET205.tmp"
"c:\windows\system32\pcre3.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Emmet Smith\Application Data\Evvoob
c:\documents and settings\Emmet Smith\Application Data\Uwxeo
c:\windows\system32\drivers\SET1DD.tmp
c:\windows\system32\drivers\SET204.tmp
c:\windows\system32\drivers\SET205.tmp
c:\windows\system32\pcre3.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ACROSYSBACKUP_EXFFWBCZG-ML
——-\Service_acrosysbackup_exFfWBCzg-mL


((((((((((((((((((((((((( Files Created from 2010-08-26 to 2010-09-26 )))))))))))))))))))))))))))))))
.

2010-09-25 19:33 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-25 19:32 . 2010-06-24 12:21 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2010-09-25 18:43 . 2010-09-25 18:43 ——– d—–w- c:\program files\McAfee.com
2010-09-25 14:55 . 2008-11-12 21:12 1370528 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\msvc9rt.exe
2010-09-25 14:55 . 2008-07-23 18:35 74536 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\instSup.dll
2010-09-25 14:55 . 2006-07-31 18:41 474184 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\gui.dll
2010-09-25 14:55 . 2006-04-06 15:33 25088 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\EEStart.exe
2010-09-25 14:55 . 2008-12-03 16:09 59184 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\toolbarsud.exe
2010-09-25 14:55 . 2008-11-06 14:42 2100984 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\aol_toolbar_dual.exe
2010-09-25 14:55 . 2006-04-06 15:33 81000 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\ProgUpd.dll
2010-09-25 14:55 . 2006-04-06 15:33 156264 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\setup.exe
2010-09-25 14:55 . 2006-04-06 15:33 33896 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\postproc.exe
2010-09-25 14:55 . 2008-12-02 18:34 2316392 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\ocpinst.exe
2010-09-25 14:55 . 2008-07-23 18:35 62248 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\ocpgc.exe
2010-09-25 14:55 . 2008-07-23 18:35 15144 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4384.1.4\ocpchk.dll
2010-09-25 14:50 . 2009-12-14 21:00 106496 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_Almaak.dll
2010-09-25 14:50 . 2009-12-16 12:07 136528 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\AOLSetup.exe
2010-09-25 14:50 . 2009-12-15 11:14 95568 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\RunOnce.exe
2010-09-25 14:50 . 2009-12-16 12:07 136528 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\Vercopy.exe
2010-09-25 14:50 . 2009-12-17 05:09 49241 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_BunkerHill.dll
2010-09-25 14:50 . 2009-12-15 11:33 120144 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\SBFix.exe
2010-09-25 14:50 . 2009-12-15 09:35 106496 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_Raga_Refresh.dll
2010-09-25 14:50 . 2009-12-14 19:06 106496 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_Thailand.dll
2010-09-25 14:50 . 2009-12-14 19:03 106496 ——w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\CACHE\4482.14.4\sb_Strauss.dll
2010-09-25 06:11 . 2010-09-25 06:11 ——– d—–w- c:\documents and settings\Joanne\Local Settings\Application Data\AOL
2010-09-25 04:06 . 2010-09-25 04:06 ——– d—–w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\AOL
2010-09-25 04:05 . 2007-07-23 19:58 2223544 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\ocpinst.exe
2010-09-25 04:05 . 2007-06-08 21:01 54832 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\ocpgc.exe
2010-09-25 04:05 . 2007-06-08 21:01 15920 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\ocpchk.dll
2010-09-25 04:05 . 2007-06-08 21:01 67120 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\instsup.dll
2010-09-25 04:05 . 2007-05-09 15:30 98304 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\regwrite.exe
2010-09-25 04:05 . 2006-04-06 15:49 81000 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\progupd.dll
2010-09-25 04:05 . 2006-04-06 15:49 33896 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\postproc.exe
2010-09-25 04:05 . 2006-04-06 15:49 156264 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\setup.exe
2010-09-25 04:05 . 2006-07-31 18:57 474184 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\gui.dll
2010-09-25 04:05 . 2006-04-06 15:49 25088 —-a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\TOD4071\eestart.exe
2010-09-25 04:05 . 2010-09-25 04:05 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL Downloads
2010-09-24 22:23 . 2010-09-24 22:23 ——– d—–w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\WinZip
2010-09-23 15:54 . 2010-09-23 15:54 ——– d—–w- c:\documents and settings\LocalService\Application Data\AdobeUM
2010-09-21 20:39 . 2010-09-25 11:22 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-09-20 12:32 . 2010-08-24 18:57 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2010-09-13 17:22 . 2010-09-25 18:44 ——– d—–w- c:\program files\SiteAdvisor
2010-09-13 17:20 . 2010-08-24 18:57 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-09-13 17:20 . 2010-08-24 18:57 88544 —-a-w- c:\windows\system32\drivers\mfendisk.sys
2010-09-13 17:20 . 2010-08-24 18:57 84072 —-a-w- c:\windows\system32\drivers\mfetdi2k.sys
2010-09-13 17:20 . 2010-08-24 18:57 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys
2010-09-13 17:20 . 2010-08-24 18:57 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-09-13 17:20 . 2010-08-24 18:57 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2010-09-13 17:20 . 2010-08-24 18:57 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-09-13 17:20 . 2010-09-25 18:44 ——– d—–w- c:\program files\Common Files\Mcafee
2010-09-13 17:20 . 2010-09-25 18:44 ——– d—–w- c:\program files\McAfee
2010-09-11 16:03 . 2010-09-23 15:54 ——– d—–w- c:\program files\Windows Live Safety Center
2010-09-11 06:07 . 2010-09-11 06:07 77808 —-a-w- c:\documents and settings\Joanne\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-11 05:12 . 2010-09-11 05:12 ——– d—–w- c:\windows\McAfee.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-26 17:49 . 2010-04-14 19:43 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-25 21:52 . 2009-09-27 23:04 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-09-25 18:33 . 2010-04-14 19:44 ——– d—–w- c:\program files\Spyware Doctor
2010-09-25 04:06 . 2009-09-29 02:04 ——– d—–w- c:\program files\Common Files\AOL
2010-09-25 04:05 . 2009-09-29 02:04 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL
2010-09-23 15:54 . 2009-09-29 02:04 ——– d—–w- c:\program files\America Online 9.0
2010-09-23 15:54 . 2009-09-15 20:05 ——– d—–w- c:\documents and settings\Emmet Smith\Application Data\U3
2010-09-22 04:18 . 2009-11-12 14:48 ——– d—–w- c:\documents and settings\Joanne\Application Data\Okfoaz
2010-09-22 01:10 . 2010-05-13 01:03 72080 —-a-w- c:\windows\java\g2mdlhlpx.exe
2010-09-14 14:51 . 2009-11-16 01:14 ——– d—–w- c:\program files\Common Files\Adobe
2010-09-11 13:15 . 2009-09-28 01:21 77808 —-a-w- c:\documents and settings\Emmet Smith\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-24 18:57 . 2010-06-01 00:32 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 18:57 . 2010-06-01 00:32 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-17 13:17 . 2005-06-10 23:55 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-13 21:46 . 2010-08-13 21:46 ——– d—–w- c:\program files\Avery
2010-08-13 21:42 . 2010-08-13 21:42 ——– d—–w- c:\program files\Ask.com
2010-08-08 14:20 . 2010-04-19 00:37 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-22 15:49 . 2004-03-06 02:16 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-09-28 18:59 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 12:47 . 2010-04-14 19:46 767928 —-a-w- c:\windows\BDTSupport.dll
2010-07-19 07:26 . 2010-04-14 19:46 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-07-19 07:26 . 2010-04-14 19:46 192 —-a-w- c:\windows\UDB.zip
2010-07-19 07:26 . 2010-04-14 19:46 264144 —-a-w- c:\windows\PCTBDRes.dll
2010-07-19 07:26 . 2010-04-14 19:46 1435600 —-a-w- c:\windows\PCTBDCore.dll
2010-06-30 12:31 . 2002-09-03 19:54 149504 —-a-w- c:\windows\system32\schannel.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\documents and settings\Joanne\Application Data\Okfoaz —-



((((((((((((((((((((((((((((( SnapShot@2010-09-25_16.48.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-08 08:31 . 2010-06-24 12:21 55296 c:\windows\system32\msfeedsbs.dll
- 2009-03-08 08:31 . 2010-02-25 06:24 55296 c:\windows\system32\msfeedsbs.dll
- 2002-09-03 19:41 . 2010-02-25 06:24 25600 c:\windows\system32\jsproxy.dll
+ 2002-09-03 19:41 . 2010-06-24 12:21 25600 c:\windows\system32\jsproxy.dll
+ 2002-09-03 19:39 . 2010-06-17 14:03 80384 c:\windows\system32\iccvid.dll
- 2002-09-03 19:39 . 2008-04-14 00:11 80384 c:\windows\system32\iccvid.dll
+ 2009-10-03 15:33 . 2010-06-24 12:22 12800 c:\windows\system32\dllcache\xpshims.dll
- 2009-10-03 15:33 . 2010-02-25 06:24 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2010-08-17 13:17 . 2010-08-17 13:17 58880 c:\windows\system32\dllcache\spoolsv.exe
+ 2009-10-03 15:33 . 2010-06-24 12:21 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2009-10-03 15:33 . 2010-02-25 06:24 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2009-06-26 16:18 . 2010-02-25 06:24 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2009-06-26 16:18 . 2010-06-24 12:21 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2010-03-05 14:37 . 2010-03-05 14:37 65536 c:\windows\system32\dllcache\asycfilt.dll
+ 2009-09-14 05:03 . 2010-09-26 16:55 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-09-14 05:03 . 2010-09-25 12:11 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-09-14 05:03 . 2010-09-25 12:11 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-09-25 23:22 . 2010-09-26 16:55 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2002-09-03 19:33 . 2010-03-05 14:37 65536 c:\windows\system32\asycfilt.dll
+ 2010-09-26 07:06 . 2010-09-26 07:06 34632 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
- 2010-04-28 07:00 . 2010-04-28 07:00 34632 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2010-09-26 07:04 . 2010-02-25 06:24 12800 c:\windows\ie8updates\KB2183461-IE8\xpshims.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 55296 c:\windows\ie8updates\KB2183461-IE8\msfeedsbs.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 25600 c:\windows\ie8updates\KB2183461-IE8\jsproxy.dll
+ 2002-09-03 20:03 . 2010-06-18 17:45 293376 c:\windows\system32\winsrv.dll
- 2002-09-03 20:03 . 2008-04-14 00:12 293376 c:\windows\system32\winsrv.dll
- 2006-06-23 15:33 . 2010-02-25 06:24 916480 c:\windows\system32\wininet.dll
+ 2006-06-23 15:33 . 2010-06-24 12:22 916480 c:\windows\system32\wininet.dll
- 2002-09-03 20:00 . 2008-04-14 00:12 406016 c:\windows\system32\usp10.dll
+ 2002-09-03 20:00 . 2010-04-16 15:36 406016 c:\windows\system32\usp10.dll
- 2002-09-03 19:50 . 2010-02-25 06:24 206848 c:\windows\system32\occache.dll
+ 2002-09-03 19:50 . 2010-06-24 12:22 206848 c:\windows\system32\occache.dll
+ 2002-09-03 19:48 . 2010-06-24 12:22 611840 c:\windows\system32\mstime.dll
- 2002-09-03 19:48 . 2010-02-25 06:24 611840 c:\windows\system32\mstime.dll
+ 2009-03-08 08:32 . 2010-06-24 12:21 599040 c:\windows\system32\msfeeds.dll
- 2004-08-04 07:56 . 2008-04-14 00:11 384512 c:\windows\system32\mp4sdmod.dll
+ 2004-08-04 07:56 . 2010-04-05 15:54 384512 c:\windows\system32\mp4sdmod.dll
+ 2009-09-14 04:59 . 2010-06-09 07:43 692736 c:\windows\system32\inetcomm.dll
+ 2006-02-24 19:24 . 2010-06-24 12:21 184320 c:\windows\system32\iepeers.dll
- 2006-02-24 19:24 . 2010-02-25 06:24 184320 c:\windows\system32\iepeers.dll
- 2002-09-03 19:40 . 2010-02-25 06:24 387584 c:\windows\system32\iedkcs32.dll
+ 2002-09-03 19:40 . 2010-06-24 12:21 387584 c:\windows\system32\iedkcs32.dll
+ 2002-09-03 19:39 . 2010-06-23 12:08 173056 c:\windows\system32\ie4uinit.exe
- 2002-09-03 19:39 . 2010-02-24 09:54 173056 c:\windows\system32\ie4uinit.exe
+ 2009-09-14 05:50 . 2010-09-26 07:11 289296 c:\windows\system32\FNTCACHE.DAT
- 2009-09-14 05:50 . 2010-08-13 23:27 289296 c:\windows\system32\FNTCACHE.DAT
+ 2002-09-03 19:57 . 2010-06-21 15:27 354304 c:\windows\system32\drivers\srv.sys
+ 2010-06-18 17:45 . 2010-06-18 17:45 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2009-06-26 16:18 . 2010-06-24 12:22 916480 c:\windows\system32\dllcache\wininet.dll
- 2009-06-26 16:18 . 2010-02-25 06:24 916480 c:\windows\system32\dllcache\wininet.dll
+ 2010-04-16 15:36 . 2010-04-16 15:36 406016 c:\windows\system32\dllcache\usp10.dll
+ 2009-09-28 19:01 . 2010-06-21 15:27 354304 c:\windows\system32\dllcache\srv.sys
+ 2008-12-05 06:54 . 2010-06-30 12:31 149504 c:\windows\system32\dllcache\schannel.dll
+ 2009-04-15 14:51 . 2010-07-22 15:49 590848 c:\windows\system32\dllcache\rpcrt4.dll
+ 2009-03-08 08:34 . 2010-06-24 12:22 206848 c:\windows\system32\dllcache\occache.dll
- 2009-03-08 08:34 . 2010-02-25 06:24 206848 c:\windows\system32\dllcache\occache.dll
+ 2009-06-26 16:18 . 2010-06-24 12:22 611840 c:\windows\system32\dllcache\mstime.dll
- 2009-06-26 16:18 . 2010-02-25 06:24 611840 c:\windows\system32\dllcache\mstime.dll
+ 2009-10-03 15:33 . 2010-06-24 12:21 599040 c:\windows\system32\dllcache\msfeeds.dll
- 2009-09-30 05:38 . 2008-04-14 00:11 384512 c:\windows\system32\dllcache\mp4sdmod.dll
+ 2009-09-30 05:38 . 2010-04-05 15:54 384512 c:\windows\system32\dllcache\mp4sdmod.dll
+ 2009-09-28 19:00 . 2010-06-09 07:43 692736 c:\windows\system32\dllcache\inetcomm.dll
+ 2009-10-03 15:33 . 2010-06-24 12:21 247808 c:\windows\system32\dllcache\ieproxy.dll
- 2009-10-03 15:33 . 2010-02-25 06:24 247808 c:\windows\system32\dllcache\ieproxy.dll
+ 2009-06-26 16:18 . 2010-06-24 12:21 184320 c:\windows\system32\dllcache\iepeers.dll
- 2009-06-26 16:18 . 2010-02-25 06:24 184320 c:\windows\system32\dllcache\iepeers.dll
- 2009-03-08 18:09 . 2010-02-25 06:24 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2009-03-08 18:09 . 2010-06-24 12:21 387584 c:\windows\system32\dllcache\iedkcs32.dll
- 2009-03-08 08:32 . 2010-02-24 09:54 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2009-03-08 08:32 . 2010-06-23 12:08 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2010-04-20 05:30 . 2010-04-20 05:30 285696 c:\windows\system32\dllcache\atmfd.dll
- 2002-09-03 19:33 . 2008-04-14 00:09 285696 c:\windows\system32\atmfd.dll
+ 2002-09-03 19:33 . 2010-04-20 05:30 285696 c:\windows\system32\atmfd.dll
+ 2009-09-14 04:59 . 2010-06-14 14:31 744448 c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
- 2009-09-14 04:59 . 2008-04-14 00:12 744448 c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
+ 2010-09-26 07:04 . 2010-02-25 06:24 916480 c:\windows\ie8updates\KB2183461-IE8\wininet.dll
+ 2010-09-26 07:04 . 2010-02-22 14:23 382840 c:\windows\ie8updates\KB2183461-IE8\spuninst\updspapi.dll
+ 2010-09-26 07:04 . 2009-05-26 09:01 231288 c:\windows\ie8updates\KB2183461-IE8\spuninst\spuninst.exe
+ 2010-09-26 07:04 . 2010-02-25 06:24 206848 c:\windows\ie8updates\KB2183461-IE8\occache.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 611840 c:\windows\ie8updates\KB2183461-IE8\mstime.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 594432 c:\windows\ie8updates\KB2183461-IE8\msfeeds.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 247808 c:\windows\ie8updates\KB2183461-IE8\ieproxy.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 184320 c:\windows\ie8updates\KB2183461-IE8\iepeers.dll
+ 2010-09-26 07:04 . 2009-03-08 08:35 742912 c:\windows\ie8updates\KB2183461-IE8\iedvtool.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 387584 c:\windows\ie8updates\KB2183461-IE8\iedkcs32.dll
+ 2010-09-26 07:04 . 2010-02-24 09:54 173056 c:\windows\ie8updates\KB2183461-IE8\ie4uinit.exe
+ 2002-09-03 20:04 . 2010-04-08 18:03 2113536 c:\windows\system32\WMVCore.dll
+ 2002-09-03 20:03 . 2010-06-23 13:44 1851904 c:\windows\system32\win32k.sys
+ 2006-08-31 00:42 . 2010-06-24 12:22 1210368 c:\windows\system32\urlmon.dll
+ 2006-07-13 13:46 . 2010-07-27 06:30 8462336 c:\windows\system32\shell32.dll
+ 2005-08-30 04:02 . 2010-02-05 18:27 1291776 c:\windows\system32\quartz.dll
- 2005-08-30 04:02 . 2009-11-27 17:11 1291776 c:\windows\system32\quartz.dll
+ 2002-09-03 19:50 . 2010-04-28 02:25 2189952 c:\windows\system32\ntoskrnl.exe
- 2002-09-03 19:50 . 2010-02-17 13:10 2189952 c:\windows\system32\ntoskrnl.exe
+ 2002-08-29 01:04 . 2010-04-27 13:05 2066816 c:\windows\system32\ntkrnlpa.exe
- 2002-08-29 01:04 . 2010-02-16 13:25 2066816 c:\windows\system32\ntkrnlpa.exe
- 2006-09-13 05:09 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2006-09-13 05:09 . 2010-06-14 07:41 1172480 c:\windows\system32\msxml3.dll
+ 2006-06-30 14:28 . 2010-06-24 12:22 5951488 c:\windows\system32\mshtml.dll
+ 2009-03-08 08:32 . 2010-06-24 12:21 1986560 c:\windows\system32\iertutil.dll
+ 2008-11-07 22:32 . 2010-04-08 18:03 2113536 c:\windows\system32\dllcache\WMVCore.dll
+ 2009-04-17 12:26 . 2010-06-23 13:44 1851904 c:\windows\system32\dllcache\win32k.sys
+ 2009-06-26 16:18 . 2010-06-24 12:22 1210368 c:\windows\system32\dllcache\urlmon.dll
+ 2008-06-17 19:02 . 2010-07-27 06:30 8462336 c:\windows\system32\dllcache\shell32.dll
+ 2009-06-03 19:09 . 2010-02-05 18:27 1291776 c:\windows\system32\dllcache\quartz.dll
- 2009-06-03 19:09 . 2009-11-27 17:11 1291776 c:\windows\system32\dllcache\quartz.dll
- 2009-09-28 19:04 . 2010-02-17 13:10 2189952 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-09-28 19:04 . 2010-04-28 02:25 2189952 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-09-28 19:04 . 2010-04-27 13:05 2024448 c:\windows\system32\dllcache\ntkrpamp.exe
- 2009-09-28 19:04 . 2010-02-16 13:25 2024448 c:\windows\system32\dllcache\ntkrpamp.exe
- 2009-02-07 23:02 . 2010-02-16 13:25 2066816 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-02-07 23:02 . 2010-04-27 13:05 2066816 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-09-28 19:04 . 2010-04-27 13:59 2146304 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2009-09-28 19:04 . 2010-02-16 14:08 2146304 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2002-09-03 19:48 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2002-09-03 19:48 . 2010-06-14 07:41 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2009-07-18 16:20 . 2010-06-24 12:22 5951488 c:\windows\system32\dllcache\mshtml.dll
- 2010-03-10 22:33 . 2009-10-23 15:28 3558912 c:\windows\system32\dllcache\moviemk.exe
+ 2010-03-10 22:33 . 2010-06-18 13:36 3558912 c:\windows\system32\dllcache\moviemk.exe
+ 2009-10-03 15:33 . 2010-06-24 12:21 1986560 c:\windows\system32\dllcache\iertutil.dll
+ 2010-08-04 19:12 . 2010-08-04 19:12 1004544 c:\windows\Installer\dceefb.msp
+ 2010-04-24 21:10 . 2010-04-24 21:10 8486400 c:\windows\Installer\dceef4.msp
+ 2010-07-11 00:14 . 2010-07-11 00:14 2850816 c:\windows\Installer\dceeec.msp
+ 2009-08-19 22:04 . 2009-08-19 22:04 4542296 c:\windows\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6514\WRD12CNV.DLL
+ 2010-09-26 07:04 . 2010-02-25 06:24 1209344 c:\windows\ie8updates\KB2183461-IE8\urlmon.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 5944832 c:\windows\ie8updates\KB2183461-IE8\mshtml.dll
+ 2010-09-26 07:04 . 2010-02-25 06:24 1985536 c:\windows\ie8updates\KB2183461-IE8\iertutil.dll
- 2009-09-28 19:04 . 2010-02-17 13:10 2189952 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2009-09-28 19:04 . 2010-04-28 02:25 2189952 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2009-09-28 19:04 . 2010-04-27 13:05 2024448 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2009-09-28 19:04 . 2010-02-16 13:25 2024448 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2009-02-07 23:02 . 2010-04-27 13:05 2066816 c:\windows\Driver Cache\i386\ntkrnlpa.exe
- 2009-02-07 23:02 . 2010-02-16 13:25 2066816 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2009-09-28 19:04 . 2010-04-27 13:59 2146304 c:\windows\Driver Cache\i386\ntkrnlmp.exe
- 2009-09-28 19:04 . 2010-02-16 14:08 2146304 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2009-03-08 08:39 . 2010-06-24 21:51 11077120 c:\windows\system32\ieframe.dll
+ 2009-10-03 15:33 . 2010-06-24 21:51 11077120 c:\windows\system32\dllcache\ieframe.dll
+ 2010-04-24 21:09 . 2010-04-24 21:09 11750912 c:\windows\Installer\dcef03.msp
+ 2010-09-26 07:04 . 2010-02-25 15:54 11070976 c:\windows\ie8updates\KB2183461-IE8\ieframe.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-01-20 14:34 1197448 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-03 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"nwiz"="nwiz.exe" [2003-10-06 741376]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2009-09-29 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-29 77824]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"HostManager"="c:\program files\Common Files\AOL\1285387552\ee\AOLSoftware.exe" [2006-09-26 50736]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-07-01 1193848]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-4 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2009-9-28 36954]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2010-09-11 05:55 13672 —-a-w- c:\program files\Citrix\GoToAssist\615\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\system32\\lsass.exe"=
"c:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [4/14/2010 3:45 PM 218592]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [9/13/2010 1:20 PM 84072]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [10/4/2004 5:47 AM 98304]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [4/14/2010 3:46 PM 198608]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\McSACore.exe [9/13/2010 1:21 PM 88176]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/25/2010 2:43 PM 271480]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/25/2010 2:43 PM 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [9/13/2010 1:21 PM 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\Mcafee\SystemCore\mfevtps.exe [9/13/2010 1:20 PM 141792]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [10/4/2004 4:40 AM 118784]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [9/13/2010 1:20 PM 55840]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [9/13/2010 1:20 PM 312904]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [9/13/2010 1:20 PM 88544]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/6/2010 3:46 PM 135664]
S3 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service –> c:\windows\system32\dlcdcoms.exe -service [?]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [9/13/2010 1:20 PM 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [9/20/2010 8:32 AM 84264]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/14/2010 3:44 PM 366840]
S4 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [4/14/2010 3:45 PM 233136]
S4 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [4/14/2010 3:44 PM 63360]

— Other Services/Drivers In Memory —

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 19:46]

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 19:46]

2010-09-26 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-01-20 14:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/
mStart Page = hxxp://www.pctools.com/mrc/fix_homepage/
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-26 13:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1044)
c:\program files\Citrix\GoToAssist\615\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(936)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\System32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\windows\BCMSMMSG.exe
.
**************************************************************************
.
Completion time: 2010-09-26 13:58:42 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-26 17:58
ComboFix2.txt 2010-09-25 21:43
ComboFix3.txt 2010-09-25 16:52

Pre-Run: 108,095,275,008 bytes free
Post-Run: 108,083,994,624 bytes free

- - End Of File - - EA5F3282FBDCDE720A5085889DE04A55