This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Bredolab.fb

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I read the instructions you gave another user, but the first download MBRCheck.exe didn't work - I mean it wouldn't download. All I got was a blank page. I have used spybot twice now and this darn thing keeps popping up. Actually, the other one that keeps popping up is "right media". Would love to know how to get rid of both of these. Thanks. -Sheryl
Here are the results of "Hijack This":

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:23:12 PM, on 11/23/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17091)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\AccelerometerSt.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Zecter\ZumoDrive\zumodrive.exe
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Qlock\qlock.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\MBTrading\MBT Navigator\MbtNav.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\W301I7KH\HiJackThis[1].exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: optionsXpress Toolbar - {63CC63C6-1AE1-491C-B96A-812A7950A1EC} - C:\Program Files\optionsXpress\optionsXpress Toolbar\optionsXpressToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [HPWWANGSAssistant] c:\SWSetup\HPQWWAN\HPWWanGSAssistant.exe /TrayMode
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSetup] D:\setup.exe /skip_all_checks /p /start /restart /l:enu
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [ZumoDrive] C:\Program Files\Zecter\ZumoDrive\ZumoLauncher.lnk
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe (User 'Default user')
O4 - Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\iobit\advanced systemcare 3\spictrl.dll
O10 - Unknown file in Winsock LSP: c:\program files\iobit\advanced systemcare 3\spictrl.dll
O10 - Unknown file in Winsock LSP: c:\program files\iobit\advanced systemcare 3\spictrl.dll
O10 - Unknown file in Winsock LSP: c:\program files\iobit\advanced systemcare 3\spictrl.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O15 - Trusted Zone: http://www.vectorvest.com
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {AF9104F7-D6E9-46CC-8FBF-BBE2FB05E3CF} - https://www.optionsxpress.com/toolbox/toolb…ressToolbar.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: OneCard - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Intel® Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: B-Service - Unknown owner - C:\Documents and Settings\Administrator\Application Data\Mikogo\B-Service.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® Active Management Technology Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: SWIHPWMI - Sierra Wireless Inc. - C:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
O23 - Service: Intel® Active Management Technology User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\AMT\UNS.exe

–
End of file - 16196 bytes
Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
try right clicking the link > "save link as" or type the url into the address bar and see if it will give you the download. If not, do you have access to another uninfected machine where you can download the programs to a USB and transfer them over?
Thanks. That did it. Here are the results of DSD.txt: DDS (Ver_10-11-10.01) - NTFSx86 Run by [removed] at 19:14:47.79 on Wed 11/24/2010 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_22 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2000 [GMT -8:00] AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF} ============== Running Processes =============== C:\WINDOWS\System32\svchost.exe -k Cognizance C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss c:\Program Files\Microsoft Security Essentials\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\PDF Complete\pdfsty.exe C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\WINDOWS\SMINST\Scheduler.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\AccelerometerSt.exe C:\Program Files\Intel\AMT\atchk.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\IObit\IObit Security 360\IS360tray.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\Microsoft Security Essentials\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe C:\Program Files\Zecter\ZumoDrive\zumodrive.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Qlock\qlock.exe C:\WINDOWS\system32\msdtc.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\Intel\AMT\atchksrv.exe C:\Program Files\IObit\IObit Security 360\IS360srv.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Intel\AMT\LMS.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\PDF Complete\pdfsvc.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe C:\Program Files\Intel\AMT\UNS.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe C:\WINDOWS\System32\SCardSvr.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\alg.exe C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE C:\Program Files\Outlook Express\msimn.exe C:\Program Files\IObit\IObit Security 360\is360.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe C:\Program Files\Interbank FX Trader 4\terminal.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Desktop\dds.com C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.comcast.net/ uInternet Settings,ProxyOverride = *.local uURLSearchHooks: H - No File mURLSearchHooks: H - No File BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 8\SnagItBHO.dll BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search BHO: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Credential Manager for HP ProtectTools: {df21f1db-80c6-11d3-9483-b03d0ec10000} - c:\program files\hewlett-packard\iam\bin\ItIEAddIn.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 8\SnagItIEAddin.dll TB: optionsXpress Toolbar: {63cc63c6-1ae1-491c-b96a-812a7950a1ec} - c:\program files\optionsxpress\optionsxpress toolbar\optionsXpressToolbar.dll TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [LogitechSetup] D:\setup.exe /skip_all_checks /p /start /restart /l:enu uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup uRun: [ZumoDrive] c:\program files\zecter\zumodrive\ZumoLauncher.lnk mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [MsmqIntCert] regsvr32 /s mqrt.dll mRun: [SoundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray mRun: [PDF Complete] "c:\program files\pdf complete\pdfsty.exe" mRun: [PTHOSTTR] c:\program files\hewlett-packard\hp protecttools security manager\PTHOSTTR.EXE /Start mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start mRun: [CognizanceTS] rundll32.exe c:\progra~1\hewlet~1\iam\bin\ASTSVCC.dll,RegisterModule mRun: [Recguard] c:\windows\sminst\Recguard.exe mRun: [Reminder] c:\windows\creator\Remind_XP.exe mRun: [Scheduler] c:\windows\sminst\Scheduler.exe mRun: [Cpqset] c:\program files\hewlett-packard\default settings\cpqset.exe mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [WatchDog] c:\program files\intervideo\dvd check\DVDCheck.exe mRun: [AccelerometerSysTrayApplet] c:\windows\system32\AccelerometerSt.exe mRun: [atchk] "c:\program files\intel\amt\atchk.exe" mRun: [HPWWANGSAssistant] c:\swsetup\hpqwwan\HPWWanGSAssistant.exe /TrayMode mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [IObit Security 360] "c:\program files\iobit\iobit security 360\IS360tray.exe" /autostart mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [ddoctorv2] "c:\program files\comcast\desktop doctor\bin\sprtcmd.exe" /P ddoctorv2 mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\gnotify.exe mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\qlock.lnk - c:\program files\qlock\qlock.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dvdche~1.lnk - c:\program files\intervideo\dvd check\DVDCheck.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqthb08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL LSP: c:\program files\iobit\advanced systemcare 3\SPICtrl.dll Trusted Zone: vectorvest.com\www DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab DPF: {AF9104F7-D6E9-46CC-8FBF-BBE2FB05E3CF} - hxxps://www.optionsxpress.com/toolbox/toolbar/optionsXpressToolbar.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} - hxxp://www.photodex.com/pxplay.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll Notify: igfxcui - igfxdev.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll Notify: OneCard - c:\program files\hewlett-packard\iam\bin\ASWLNPkg.dll AppInit_DLLs: APSHook.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll LSA: Notification Packages = scecli ASWLNPkg ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\xhl3bzgr.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/ FF - plugin: c:\documents and settings\administrator\application data\move networks\plugins\npqmp071500000347.dll FF - plugin: c:\documents and settings\administrator\application data\mozilla\plugins\npPxPlay.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: browser.chrome.favicons - false FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.turbo.enabled - true FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.urlbar.autofill - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.notify.backoffcount - 5 FF - user.js: content.notify.interval - 750000 FF - user.js: content.notify.ontimer - true FF - user.js: content.switch.threshold - 750000 FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: network.http.pipelining - true FF - user.js: network.http.pipelining.firstrequest - true FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.proxy.pipelining - true FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: nglayout.initialpaint.delay - 0 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified ============= SERVICES / DRIVERS =============== R1 CbFs;CbFs;c:\windows\system32\drivers\cbfs.sys [2010-10-25 147416] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 151216] R2 ASBroker;Logon Session Broker;c:\windows\system32\svchost.exe -k Cognizance [2004-8-4 14336] R2 ASChannel;Local Communication Channel;c:\windows\system32\svchost.exe -k Cognizance [2004-8-4 14336] R2 IS360service;IS360service;c:\program files\iobit\iobit security 360\is360srv.exe [2010-8-26 312152] R2 pdfcDispatcher;PDF Document Manager;c:\program files\pdf complete\pdfsvc.exe [2008-1-7 539936] R2 SWIHPWMI;SWIHPWMI;c:\program files\hpq\shared\sierra wireless\win32\unicode\SWIHPWMI.exe [2006-12-4 292384] R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\intel\amt\UNS.exe [2008-10-2 1489688] R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2008-3-4 34128] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2007-1-23 36608] R3 rismc32;RICOH Smart Card Reader;c:\windows\system32\drivers\rismc32.sys [2008-1-6 47616] S3 B-Service;B-Service;c:\documents and settings\administrator\application data\mikogo\B-Service.exe [2010-10-11 185640] S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\drivers\PTDMBus.sys [2008-10-17 29952] S3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\drivers\PTDMMdm.sys [2008-10-17 41856] S3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\drivers\PTDMVsp.sys [2008-10-17 39936] S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\drivers\PTDMWWAN.sys [2008-10-17 59520] S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\drivers\PTDUBus.sys [2009-8-7 33024] S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\drivers\PTDUMdm.sys [2009-8-7 41344] S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\drivers\PTDUVsp.sys [2009-8-7 39936] S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\drivers\PTDUWWAN.sys [2009-8-7 59904] =============== Created Last 30 ================ 2010-11-24 21:48:53 6273872 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{777a9568-110a-4006-8d96-c2fefa3e67d9}\mpengine.dll 2010-11-24 02:55:21 ——– d—–w- c:\docume~1\admini~1\applic~1\Safer Networking 2010-11-19 14:15:53 73728 —-a-w- c:\windows\system32\javacpl.cpl 2010-11-11 23:47:40 ——– d—–w- C:\IBFX Trader 4 2010-11-05 23:03:19 ——– d—–w- c:\program files\optionsXpress 2010-10-27 23:46:28 72080 —-a-w- c:\documents and settings\administrator\g2mdlhlpx.exe ==================== Find3M ==================== 2010-11-04 03:12:10 472808 —-a-w- c:\windows\system32\deployJava1.dll 2010-10-19 20:51:33 222080 ——w- c:\windows\system32\MpSigStub.exe 2010-09-18 19:23:26 974848 —-a-w- c:\windows\system32\mfc42u.dll 2010-09-18 06:53:25 974848 —-a-w- c:\windows\system32\mfc42.dll 2010-09-18 06:53:25 954368 —-a-w- c:\windows\system32\mfc40.dll 2010-09-18 06:53:25 953856 —-a-w- c:\windows\system32\mfc40u.dll 2010-09-09 13:38:01 832512 —-a-w- c:\windows\system32\wininet.dll 2010-09-09 13:38:01 1830912 —-a-w- c:\windows\system32\inetcpl.cpl 2010-09-09 13:38:00 78336 —-a-w- c:\windows\system32\ieencode.dll 2010-09-09 13:38:00 17408 —-a-w- c:\windows\system32\corpol.dll 2010-09-08 15:57:57 389120 —-a-w- c:\windows\system32\html.iec 2010-09-01 11:51:14 285824 —-a-w- c:\windows\system32\atmfd.dll 2010-08-31 13:42:52 1852800 —-a-w- c:\windows\system32\win32k.sys 2010-08-27 08:02:29 119808 —-a-w- c:\windows\system32\t2embed.dll 2010-08-27 05:57:43 99840 —-a-w- c:\windows\system32\srvsvc.dll ============= FINISH: 19:15:20.51 =============== Here are the results of attach.txt: UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_10-11-10.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 10/2/2008 7:54:21 PM System Uptime: 11/24/2010 1:36:09 PM (6 hours ago) Motherboard: Hewlett-Packard | | 30C1 Processor: Intel Pentium III Xeon processor | U10 | 1987/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 102 GiB total, 35.447 GiB free. D: is CDROM () E: is FIXED (NTFS) - 9 GiB total, 9.026 GiB free. Z: is Removable ==== Disabled Device Manager Items ============= Class GUID: {4D36E96E-E325-11CE-BFC1-08002BE10318} Description: Plug and Play Monitor Device ID: DISPLAY\CMO1424\5&2C2210AC&0&00000110&01&00 Manufacturer: (Standard monitor types) Name: Plug and Play Monitor PNP Device ID: DISPLAY\CMO1424\5&2C2210AC&0&00000110&01&00 Service: ==== System Restore Points =================== RP678: 8/28/2010 7:23:18 AM - Software Distribution Service 3.0 RP679: 8/29/2010 9:22:30 AM - Software Distribution Service 3.0 RP680: 8/30/2010 9:56:20 AM - System Checkpoint RP681: 8/31/2010 5:45:22 AM - Software Distribution Service 3.0 RP682: 9/1/2010 8:07:58 AM - Software Distribution Service 3.0 RP683: 9/2/2010 8:49:46 AM - System Checkpoint RP684: 9/3/2010 5:38:20 AM - Software Distribution Service 3.0 RP685: 9/4/2010 12:33:18 PM - Software Distribution Service 3.0 RP686: 9/5/2010 5:05:56 PM - Software Distribution Service 3.0 RP687: 9/7/2010 5:46:11 AM - Software Distribution Service 3.0 RP688: 9/8/2010 7:35:24 AM - Software Distribution Service 3.0 RP689: 9/8/2010 7:57:46 AM - Software Distribution Service 3.0 RP690: 9/9/2010 6:17:45 PM - Software Distribution Service 3.0 RP691: 9/10/2010 8:05:31 PM - Software Distribution Service 3.0 RP692: 9/12/2010 7:58:33 AM - Software Distribution Service 3.0 RP693: 9/13/2010 9:32:58 AM - System Checkpoint RP694: 9/13/2010 8:31:54 PM - Software Distribution Service 3.0 RP695: 9/15/2010 5:51:36 AM - Software Distribution Service 3.0 RP696: 9/15/2010 4:37:18 PM - Software Distribution Service 3.0 RP697: 9/15/2010 8:18:46 PM - Software Distribution Service 3.0 RP698: 9/16/2010 6:21:23 AM - Software Distribution Service 3.0 RP699: 9/17/2010 9:38:12 AM - System Checkpoint RP700: 9/17/2010 7:38:34 PM - Software Distribution Service 3.0 RP701: 9/18/2010 9:21:04 PM - Software Distribution Service 3.0 RP702: 9/20/2010 5:17:04 AM - Software Distribution Service 3.0 RP703: 9/21/2010 8:18:01 AM - Software Distribution Service 3.0 RP704: 9/22/2010 2:21:43 PM - System Checkpoint RP705: 9/22/2010 6:20:29 PM - Software Distribution Service 3.0 RP706: 9/24/2010 5:23:40 AM - Software Distribution Service 3.0 RP707: 9/25/2010 7:51:15 AM - Software Distribution Service 3.0 RP708: 9/26/2010 1:03:03 PM - Software Distribution Service 3.0 RP709: 9/27/2010 1:59:47 PM - System Checkpoint RP710: 9/28/2010 1:05:30 AM - Software Distribution Service 3.0 RP711: 9/29/2010 5:00:04 AM - Software Distribution Service 3.0 RP712: 9/29/2010 7:29:07 AM - Software Distribution Service 3.0 RP713: 9/30/2010 5:09:12 AM - Software Distribution Service 3.0 RP714: 10/1/2010 5:52:25 AM - Software Distribution Service 3.0 RP715: 10/2/2010 8:23:33 AM - Software Distribution Service 3.0 RP716: 10/3/2010 10:00:09 AM - Software Distribution Service 3.0 RP717: 10/4/2010 10:03:59 AM - System Checkpoint RP718: 10/5/2010 5:16:55 AM - Software Distribution Service 3.0 RP719: 10/5/2010 8:25:20 PM - Software Distribution Service 3.0 RP720: 10/6/2010 8:48:04 AM - Software Distribution Service 3.0 RP721: 10/7/2010 5:26:43 PM - Software Distribution Service 3.0 RP722: 10/8/2010 6:21:27 PM - System Checkpoint RP723: 10/9/2010 8:24:37 AM - Software Distribution Service 3.0 RP724: 10/10/2010 9:36:21 AM - Software Distribution Service 3.0 RP725: 10/11/2010 11:48:13 AM - System Checkpoint RP726: 10/12/2010 5:07:21 AM - Software Distribution Service 3.0 RP727: 10/12/2010 6:31:07 PM - Installed Java™ 6 Update 22 RP728: 10/13/2010 5:19:20 AM - Software Distribution Service 3.0 RP729: 10/13/2010 7:31:16 AM - Software Distribution Service 3.0 RP730: 10/14/2010 8:27:15 AM - Software Distribution Service 3.0 RP731: 10/15/2010 1:29:10 PM - System Checkpoint RP732: 10/15/2010 4:42:37 PM - Software Distribution Service 3.0 RP733: 10/16/2010 5:25:44 PM - Software Distribution Service 3.0 RP734: 10/18/2010 5:10:36 AM - Software Distribution Service 3.0 RP735: 10/19/2010 8:13:13 AM - Software Distribution Service 3.0 RP736: 10/20/2010 3:24:41 PM - System Checkpoint RP737: 10/20/2010 5:40:01 PM - Software Distribution Service 3.0 RP738: 10/21/2010 5:41:08 PM - Software Distribution Service 3.0 RP739: 10/22/2010 5:04:51 PM - Removed Java™ 6 Update 20 RP740: 10/22/2010 5:07:25 PM - Installed Java™ 6 Update 22 RP741: 10/22/2010 5:35:59 PM - Software Distribution Service 3.0 RP742: 10/23/2010 9:06:40 PM - Software Distribution Service 3.0 RP743: 10/24/2010 9:07:38 AM - Software Distribution Service 3.0 RP744: 10/25/2010 9:47:38 AM - System Checkpoint RP745: 10/25/2010 4:48:55 PM - Software Distribution Service 3.0 RP746: 10/26/2010 5:30:06 PM - Software Distribution Service 3.0 RP747: 10/28/2010 5:45:14 AM - Software Distribution Service 3.0 RP748: 10/29/2010 8:49:05 AM - Software Distribution Service 3.0 RP749: 11/1/2010 6:18:52 AM - Software Distribution Service 3.0 RP750: 11/2/2010 8:24:30 AM - Software Distribution Service 3.0 RP751: 11/3/2010 1:29:45 PM - System Checkpoint RP752: 11/3/2010 4:56:13 PM - Software Distribution Service 3.0 RP753: 11/3/2010 8:00:40 PM - Removed Java™ 6 Update 22 RP754: 11/3/2010 8:11:56 PM - Installed Java™ 6 Update 22 RP755: 11/4/2010 4:59:42 PM - Software Distribution Service 3.0 RP756: 11/5/2010 4:03:19 PM - Installed optionsXpress Toolbar RP757: 11/5/2010 7:16:12 PM - Software Distribution Service 3.0 RP758: 11/6/2010 6:28:06 PM - System Checkpoint RP759: 11/7/2010 7:50:12 AM - Software Distribution Service 3.0 RP760: 11/8/2010 9:35:49 AM - System Checkpoint RP761: 11/8/2010 3:58:52 PM - Software Distribution Service 3.0 RP762: 11/9/2010 4:19:29 PM - System Checkpoint RP763: 11/9/2010 5:10:24 PM - Software Distribution Service 3.0 RP764: 11/10/2010 3:46:14 PM - Software Distribution Service 3.0 RP765: 11/11/2010 6:17:30 AM - Software Distribution Service 3.0 RP766: 11/12/2010 6:20:42 AM - Software Distribution Service 3.0 RP767: 11/13/2010 9:50:07 AM - Software Distribution Service 3.0 RP768: 11/14/2010 12:02:55 PM - Software Distribution Service 3.0 RP769: 11/15/2010 1:25:37 PM - System Checkpoint RP770: 11/16/2010 5:44:48 AM - Software Distribution Service 3.0 RP771: 11/17/2010 5:51:24 AM - Software Distribution Service 3.0 RP772: 11/18/2010 8:08:27 AM - Software Distribution Service 3.0 RP773: 11/19/2010 5:59:06 AM - Removed Java™ 6 Update 22 RP774: 11/19/2010 6:15:27 AM - Installed Java™ 6 Update 22 RP775: 11/20/2010 11:17:15 AM - Software Distribution Service 3.0 RP776: 11/21/2010 9:27:23 AM - Software Distribution Service 3.0 RP777: 11/22/2010 1:32:17 PM - System Checkpoint RP778: 11/23/2010 6:16:10 AM - Software Distribution Service 3.0 RP779: 11/23/2010 7:01:02 PM - Removed TD AMERITRADE StrategyDesk 3.3 RP780: 11/23/2010 7:07:06 PM - Removed GoToMyPC RP781: 11/24/2010 1:48:48 PM - Software Distribution Service 3.0 ==== Installed Programs ====================== 5500 5500_Help 5500Tour 5500Trb Acrobat.com Adobe Acrobat Connect Add-in Adobe AIR Adobe Flash Player 10 ActiveX Adobe Reader 9.2 Adobe Shockwave Player 11.5 Advanced SystemCare 3 AiO_Scan AiOSoftware Amazon Kindle For PC v1.1 AnswerWorks 5.0 English Runtime Apple Application Support Apple Mobile Device Support Apple Software Update Application Installer 4.00.B13 ATI Catalyst Control Center ATI Display Driver Bonjour BufferChm Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Localization Chinese Standard Catalyst Control Center Localization Chinese Traditional Catalyst Control Center Localization Czech Catalyst Control Center Localization Danish Catalyst Control Center Localization Dutch Catalyst Control Center Localization Finnish Catalyst Control Center Localization French Catalyst Control Center Localization German Catalyst Control Center Localization Greek Catalyst Control Center Localization Hungarian Catalyst Control Center Localization Italian Catalyst Control Center Localization Japanese Catalyst Control Center Localization Korean Catalyst Control Center Localization Norwegian Catalyst Control Center Localization Polish Catalyst Control Center Localization Portuguese Catalyst Control Center Localization Russian Catalyst Control Center Localization Spanish Catalyst Control Center Localization Swedish Catalyst Control Center Localization Thai Catalyst Control Center Localization Turkish ccc-core-preinstall ccc-core-static ccc-utility CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CDDRV_Installer Copy CreativeProjects CreativeProjectsTemplates Credential Manager for HP ProtectTools Critical Update for Windows Media Player 11 (KB959772) CueTour DealBook 360 Desktop Doctor Destinations Director DocProc DocumentViewer erLT Fax Forex Calculator 1.1.20 Forex Signal Live World Market Times Forex Trade Log 1.2.8 FX AccuCharts Global Trading System Pro Google Earth Google Gmail Notifier GoToMeeting 4.5.0.457 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2158563) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP 3D DriveGuard HP Backup and Recovery Manager Installer HP BIOS Configuration for ProtectTools HP Broadband Wireless Modules HP Diagnostic Assistant HP Doc Viewer HP Driver Diagnostics HP Help and Support HP Image Zone 4.2 HP Integrated Module with Bluetooth wireless technology HP ProtectTools Security Manager HP PSC & OfficeJet 4.2 HP Quick Launch Buttons 6.40 B2 HP Update HP User Guide Bluetooth Addendum 0062 HP User Guides 0058 HP Wireless Assistant HP WWAN Setup Utility HPSystemDiagnostics InstantShare Intel® Active Management Technology Device Software Intel® Graphics Media Accelerator Driver Intel® Management Engine Interface Intel® PRO Network Connections Drivers Interbank FX Trader 4 Build 226 InterVideo DVD Check InterVideo Register Manager InterVideo WinDVD IObit Security 360 iTunes Java Auto Updater Java™ 6 Update 22 KhalInstallWrapper LightScribe 1.4.136.1 Logitech QuickCam Logitech QuickCam Driver Package Logitech SetPoint MBT MetaTrader 4.00 MBT Navigator Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2416447) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Antimalware Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Excel MUI (English) 2007 Microsoft Office Home and Student 2007 Microsoft Office Live Meeting 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Report Viewer Redistributable 2005 Microsoft Security Essentials Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Mikogo Move Media Player Mozilla Firefox (3.5.5) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 6.0 Parser (KB927977) OGA Notifier 2.0.0048.0 optionsXpress Toolbar Overland PANTECH PC USB Modem Software PANTECH UM175 Driver PDF Complete Photodex Presenter PhotoGallery PrintScreen ProductContext QFolder Qlock Lite Quicken 2009 QuickProjects QuickTime Readme Roxio Creator Audio Roxio Creator Basic v9 Roxio Creator Copy Roxio Creator Data Roxio Creator Tools Roxio Express Labeler 3 Scan Screencaster Plug-in for IE Secrets of the Masters Trading Game Security Update for 2007 Microsoft Office System (KB2288621) Security Update for 2007 Microsoft Office System (KB2289158) Security Update for 2007 Microsoft Office System (KB2344875) Security Update for 2007 Microsoft Office System (KB2345043) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Microsoft Office Excel 2007 (KB2345035) Security Update for Microsoft Office InfoPath 2007 (KB979441) Security Update for Microsoft Office PowerPoint 2007 (KB982158) Security Update for Microsoft Office PowerPoint Viewer (KB2413381) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB2344993) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB2183461) Security Update for Windows Internet Explorer 7 (KB2360131) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Internet Explorer 7 (KB974455) Security Update for Windows Internet Explorer 7 (KB976325) Security Update for Windows Internet Explorer 7 (KB978207) Security Update for Windows Internet Explorer 7 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2160329) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2259922) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2286198) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981349) Security Update for Windows XP (KB981852) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982665) Security Update for Windows XP (KB982802) Skins SkinsHP1 Skype Toolbars Skype™ 4.2 Smart Defrag SnagIt 8 Soft Data Fax Modem with SmartCP Sonic Activation Module SoundMAX Spell Checker For OE 2.1 Spybot - Search & Destroy 1.4 Synaptics Pointing Device Driver TD AMERITRADE StrategyDesk 3.4_2 (C:\Program Files\TD AMERITRADE\StrategyDesk) TeamSpeak 3 Client TrayApp Unload Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office OneNote 2007 (KB980729) Update for Windows Internet Explorer 7 (KB976749) Update for Windows Internet Explorer 7 (KB980182) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) VZAccess Manager WebEx WebFldrs XP WebReg Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 3 WinRAR archiver Xtend Yahoo! Messenger ZumoDrive ==== Event Viewer Messages From Past Week ======== 11/23/2010 3:31:29 PM, error: Dhcp [1002] - The IP address lease 0.0.0.0 for the Network Card with network address 00215C3BABCF has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). 11/22/2010 5:53:43 AM, error: Tcpip [4198] - The system detected an address conflict for IP address 192.168.0.10 with the system having network hardware address 00:23:69:0A:05:72. The local interface has been disabled. 11/22/2010 5:46:03 AM, error: Dhcp [1002] - The IP address lease 0.0.0.0 for the Network Card with network address 705AB6AE8D54 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). 11/20/2010 7:16:04 PM, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.0.11 with the system having network hardware address 00:23:69:0A:05:72. Network operations on this system may be disrupted as a result. 11/20/2010 11:05:34 AM, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.0.12 with the system having network hardware address 00:23:69:0A:05:72. Network operations on this system may be disrupted as a result. 11/19/2010 8:28:30 AM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 00215C3BABCF. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. 11/19/2010 6:12:12 AM, error: Service Control Manager [7001] - The Message Queuing Triggers service depends on the Message Queuing service which failed to start because of the following error: The dependency service or group failed to start. 11/19/2010 6:12:12 AM, error: Service Control Manager [7001] - The Message Queuing service depends on the NT LM Security Support Provider service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 11/19/2010 6:12:12 AM, error: Service Control Manager [7001] - The Infrared Monitor service depends on the Terminal Services service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 11/19/2010 5:59:32 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s). 11/19/2010 3:11:11 PM, error: PlugPlayManager [12] - The device 'Communications Port (COM1)' (ACPI\PNP0501\5&381fcc12&0) disappeared from the system without first being prepared for removal. 11/19/2010 3:04:40 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56} 11/18/2010 7:56:58 AM, error: Dhcp [1002] - The IP address lease 192.168.0.12 for the Network Card with network address 00215C3BABCF has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). 11/18/2010 4:41:30 PM, error: Dhcp [1002] - The IP address lease 192.168.1.102 for the Network Card with network address 00215C3BABCF has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). 11/17/2010 8:28:30 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the hpqwmiex service to connect. 11/17/2010 8:28:30 AM, error: Service Control Manager [7000] - The hpqwmiex service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. ==== End Of File =========================== I will start working on the next thing you requested. Thanks for your help.
When I double click on the GMER rootkit exe file it gives me the option of "run" or "cancel". When I click "run" it starts running and there is no way for me to uncheck the boxes you talked about. I don't see any where to pause or anything else other than to let it run or stop it. Suggestions? I did right click as well and open, but got the same options.
Never mind. I see it sort of starts and then stops and waits for you to push scan. So I got the appropriate boxes unchecked. Will attach shortly.
That one took quite awhile to run. It's attached per your directions. Thanks again for your continued help. Tomorrow is Thanksgiving, so I won't expect a reply until Friday at the earliest. Next week is fine too. Whatever works for you. Thanks.

Attachments:

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
I ran it. It went through everything and rebooted my computer and then just hung there. I let it sit for 5 hours and it never produced a log. Now what? I hope it is not hopeless.
I swear I can be so stupid sometimes. I looked and found it. Here are the contents: ComboFix 10-11-24.04 - Administrator 11/25/2010 7:27:58.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2324 [GMT -8:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\g2mdlhlpx.exe C:\Documents and Settings\Administrator\My Documents\DPE.DUS C:\WINDOWS\system32\gotomon.log C:\WINDOWS\system32\spool\prtprocs\w32x86\GoToPrintProcessor.dll C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll E:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2010-10-25 to 2010-11-25 ))))))))))))))))))))))))))))))) . 2010-11-24 21:48:53 . 2010-11-10 04:33:37 6273872 —-a-w- C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{777A9568-110A-4006-8D96-C2FEFA3E67D9}\mpengine.dll 2010-11-24 02:55:21 . 2010-11-24 02:55:21 ——– d—–w- C:\Documents and Settings\Administrator\Application Data\Safer Networking 2010-11-19 14:16:03 . 2010-11-19 14:16:03 ——– d—–w- C:\Program Files\Common Files\Java 2010-11-19 14:15:53 . 2010-11-19 14:15:39 73728 —-a-w- C:\WINDOWS\system32\javacpl.cpl 2010-11-19 14:15:31 . 2010-11-19 14:15:31 ——– d—–w- C:\Program Files\Java 2010-11-11 23:47:40 . 2010-11-20 01:44:26 ——– d—–w- C:\IBFX Trader 4 2010-11-05 23:03:19 . 2010-11-05 23:03:19 ——– d—–w- C:\Program Files\optionsXpress . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-11-10 04:33:37 . 2010-05-08 03:39:58 6273872 —-a-w- C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2010-11-04 03:12:10 . 2010-05-13 17:47:38 472808 —-a-w- C:\WINDOWS\system32\deployJava1.dll 2010-10-19 20:51:33 . 2010-05-07 01:52:02 222080 ——w- C:\WINDOWS\system32\MpSigStub.exe 2010-09-18 19:23:26 . 2004-08-04 08:00:00 974848 —-a-w- C:\WINDOWS\system32\mfc42u.dll 2010-09-18 06:53:25 . 2004-08-04 08:00:00 974848 —-a-w- C:\WINDOWS\system32\mfc42.dll 2010-09-18 06:53:25 . 2004-08-04 08:00:00 954368 —-a-w- C:\WINDOWS\system32\mfc40.dll 2010-09-18 06:53:25 . 2004-08-04 08:00:00 953856 —-a-w- C:\WINDOWS\system32\mfc40u.dll 2010-09-09 13:38:01 . 2004-08-04 08:00:00 832512 —-a-w- C:\WINDOWS\system32\wininet.dll 2010-09-09 13:38:01 . 2004-08-04 08:00:00 1830912 —-a-w- C:\WINDOWS\system32\inetcpl.cpl 2010-09-09 13:38:00 . 2004-08-04 08:00:00 78336 —-a-w- C:\WINDOWS\system32\ieencode.dll 2010-09-09 13:38:00 . 2004-08-04 08:00:00 17408 —-a-w- C:\WINDOWS\system32\corpol.dll 2010-09-08 15:57:57 . 2004-08-04 08:00:00 389120 —-a-w- C:\WINDOWS\system32\html.iec 2010-09-08 03:16:54 . 2010-10-25 23:16:09 147416 —-a-w- C:\WINDOWS\system32\drivers\cbfs.sys 2010-09-01 11:51:14 . 2004-08-04 08:00:00 285824 —-a-w- C:\WINDOWS\system32\atmfd.dll 2010-08-31 13:42:52 . 2004-08-04 08:00:00 1852800 —-a-w- C:\WINDOWS\system32\win32k.sys .
Hi

Most of the log has been cut off, was that all there was?

Please run the following

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic and also let me know how things are now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI