Rebooting

Hello there:
My machine is all the sudden rebooting it's self for some reason. I have done a virus scan with my trendmicro and found nothing, I do have MBAM but I cant get the scan to finish with out the pc rebooting. I'll post a HJT log below. I did see a message that said the shut down was caused be kmixer.sys but I've only seen it once so far.
I'm getting notices saying that IE is not my current default browser, and security certificate warnings nearly every website I visit including wtt and from time to time numuros IE windows will open, my cursor flashes with every keystroke,. this all happening under 1 users account and not the other 2.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:48:04 PM, on 12/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TiVo\Desktop\TiVoBeacon.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Documents and Settings\Marion\My Documents\iTunesHelper.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFHP.EXE
C:\Program Files\TiVo\Desktop\TiVoNotify.exe
C:\Program Files\TiVo\Desktop\Plus\TranscodingService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ninemsn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [FUFAXSTM] "C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe"
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKLM\..\Run: [Trend Micro Titanium] "C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\Marion\My Documents\iTunesHelper.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON TX510FN Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFHP.EXE /FU "C:\WINDOWS\TEMP\E_S34A.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [TivoNotify] C:\Program Files\TiVo\Desktop\TiVoNotify.exe /service /registry /auto:TivoNotify
O4 - HKCU\..\Run: [TranscodingService] C:\Program Files\TiVo\Desktop\Plus\\TranscodingService.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKUS\S-1-5-18\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'Default user')
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB
O16 - DPF: {5BCC24A7-7D3F-4CC9-AC86-4380FCD68D1E} (PCInfoOcxEN Control) - http://esupport.trendmicro.com/_layouts/1033/GetPCInfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1274572673062
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1274572655875
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120…all/xscan53.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TiVo Beacon Service (TivoBeacon2) - TiVo Inc. - C:\Program Files\TiVo\Desktop\TiVoBeacon.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 10517 bytes

Heres a log from Combofix I've just ran

ComboFix 10-12-11.03 - Marion 01/12/2010 20:30:41.1.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.297 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
AV: Trend Micro Titanium Internet Security *Enabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Marion\LOCALS~1\Temp\IadHide4.dll
c:\documents and settings\carl lary\Application Data\inst.exe
c:\documents and settings\Marion\Local Settings\Temp\IadHide4.dll
c:\windows\BackUp
c:\windows\BackUp\TB031231.DAT
c:\windows\patch.exe
c:\windows\system32\service
c:\windows\system32\service\31072010_TIS17_SfFniAU.log

.
((((((((((((((((((((((((( Files Created from 2009-12-12 to 2010-01-12 )))))))))))))))))))))))))))))))
.

2010-12-12 02:47 . 2010-12-12 02:47 388608 —-a-w- c:\program files\HijackThis.exe
2010-12-04 02:51 . 2010-12-04 02:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Nokia
2010-11-13 22:47 . 2010-11-13 22:47 ——– d—–w- C:\FOUND.000
2010-11-07 02:25 . 2008-04-13 14:15 26112 —-a-w- c:\windows\system32\drivers\usbser.sys
2010-11-07 02:25 . 2008-04-13 14:15 26112 —-a-w- c:\windows\system32\dllcache\usbser.sys
2010-11-07 02:18 . 2008-11-07 08:55 16928 ——w- c:\windows\system32\spmsgXP_2k3.dll
2010-11-07 01:57 . 2010-11-07 01:57 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Suite
2010-11-07 01:52 . 2010-11-07 01:53 ——– d—–w- c:\program files\Common Files\Nokia
2010-11-07 01:51 . 2010-11-07 01:51 ——– d—–w- c:\program files\DIFX
2010-11-07 01:51 . 2008-08-26 00:26 18816 —-a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-11-07 01:51 . 2010-11-07 01:51 ——– d—–w- c:\program files\PC Connectivity Solution
2010-11-07 01:50 . 2010-02-26 04:32 8192 —-a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2010-11-07 01:50 . 2010-02-26 04:32 8192 —-a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2010-11-07 01:50 . 2010-02-26 04:32 22528 —-a-w- c:\windows\system32\drivers\ccdcmbo.sys
2010-11-07 01:50 . 2010-02-26 04:32 662016 —-a-w- c:\windows\system32\nmwcdcocls.dll
2010-11-07 01:50 . 2010-02-26 04:32 18176 —-a-w- c:\windows\system32\drivers\ccdcmb.sys
2010-11-07 01:50 . 2010-02-26 04:19 1461992 —-a-w- c:\windows\system32\wdfcoinstaller01009.dll
2010-11-07 01:50 . 2010-02-26 04:32 92672 —-a-w- c:\windows\system32\nmwcdcls.dll
2010-11-07 01:47 . 2010-11-07 01:47 ——– d—–w- c:\program files\Nokia
2010-10-29 08:15 . 2006-11-29 03:06 3426072 —-a-w- c:\windows\system32\d3dx9_32.dll
2010-10-29 08:15 . 2010-10-29 08:15 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2010-10-29 08:14 . 2010-10-29 08:14 ——– d—–w- c:\program files\Microsoft
2010-10-29 08:14 . 2010-10-29 08:14 ——– d—–w- c:\program files\Windows Live SkyDrive
2010-10-29 08:13 . 2010-10-29 08:13 ——– d—–w- c:\program files\Windows Live
2010-10-29 08:07 . 2010-10-29 08:07 ——– d—–w- c:\program files\Common Files\Windows Live
2010-10-29 08:06 . 2010-10-29 08:06 1247056 —-a-w- c:\program files\wlsetup-web.exe
2010-10-29 07:56 . 2010-10-29 07:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-10-29 07:55 . 2010-10-29 07:55 6153352 —-a-w- c:\program files\mbam-setup.exe
2010-10-13 23:19 . 2010-09-18 06:53 974848 ——w- c:\windows\system32\dllcache\mfc42.dll
2010-10-13 23:19 . 2010-09-18 06:53 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-13 23:18 . 2010-08-23 16:12 617472 ——w- c:\windows\system32\dllcache\comctl32.dll
2010-10-08 10:26 . 2010-10-08 10:26 ——– d—–w- c:\program files\iPod
2010-10-08 10:24 . 2010-10-08 10:24 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2010-10-08 10:24 . 2010-10-08 10:24 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll
2010-10-08 10:24 . 2010-10-08 10:24 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
2010-10-08 10:24 . 2010-10-08 10:24 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll
2010-10-08 10:24 . 2010-10-08 10:24 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2010-10-08 10:24 . 2010-10-08 10:24 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2010-10-08 10:24 . 2010-10-08 10:24 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2010-10-08 10:23 . 2010-10-08 10:23 ——– d—–w- c:\program files\QuickTime
2010-10-08 10:22 . 2010-10-08 10:22 ——– d—–w- c:\program files\Bonjour
2010-09-26 21:56 . 2010-09-26 21:56 54936056 —-a-w- c:\program files\Trend_Micro_Titanium_Internet_Security_2011_Download_32bit.exe
2010-09-25 23:17 . 2010-09-25 23:17 ——– d—–w- c:\documents and settings\LocalService\Application Data\Trend Micro
2010-09-25 23:17 . 2010-09-25 23:13 80464 —-a-w- c:\windows\system32\drivers\tmactmon.sys
2010-09-25 23:17 . 2010-09-25 23:13 64080 —-a-w- c:\windows\system32\drivers\tmevtmgr.sys
2010-09-25 23:17 . 2010-09-25 23:13 189520 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2010-09-25 23:17 . 2010-09-25 23:13 92112 —-a-w- c:\windows\system32\drivers\tmtdi.sys
2010-09-25 23:17 . 2010-09-25 23:17 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Trend Micro
2010-09-25 23:13 . 2010-09-25 23:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Trend Micro
2010-09-18 02:23 . 2010-09-18 02:23 974848 ——w- c:\windows\system32\dllcache\mfc42u.dll
2010-09-17 00:50 . 2010-09-17 00:50 17244544 —-a-w- c:\program files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL
2010-09-08 01:17 . 2010-09-08 01:17 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 01:17 . 2010-09-08 01:17 69632 —-a-w- c:\windows\system32\QuickTime.qts
2010-08-27 05:57 . 2010-08-27 05:57 99840 ——w- c:\windows\system32\dllcache\srvsvc.dll
2010-08-19 07:11 . 2010-08-19 07:11 1402880 —-a-w- c:\program files\HiJackThis.msi
2010-08-17 13:17 . 2010-08-17 13:17 58880 ——w- c:\windows\system32\dllcache\spoolsv.exe
2010-08-14 20:49 . 2010-08-14 20:49 ——– d—–w- c:\program files\Common Files\Java
2010-08-08 15:35 . 2010-08-08 15:35 ——– d—–w- c:\program files\Microsoft Silverlight
2010-07-27 08:44 . 2010-07-27 08:44 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-07-27 08:44 . 2010-07-27 08:44 75040 —-a-w- c:\windows\system32\jdns_sd.dll
2010-07-27 08:44 . 2010-07-27 08:44 197920 —-a-w- c:\windows\system32\dnssdX.dll
2010-07-27 08:44 . 2010-07-27 08:44 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-07-25 05:49 . 2010-07-25 05:49 ——– d—–w- c:\program files\Safari
2010-07-23 08:28 . 2010-07-23 08:28 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2010-07-16 12:05 . 2010-07-16 12:05 1288192 ——w- c:\windows\system32\dllcache\ole32.dll
2010-07-14 01:20 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-05 07:15 . 2010-07-05 07:15 ——– d—–w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-07-05 07:15 . 2010-07-05 07:15 ——– d—–w- c:\program files\DVD Shrink
2010-07-01 18:08 . 2010-07-01 18:08 ——– d—–w- c:\program files\etax2010
2010-06-29 01:40 . 2009-05-18 03:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-06-29 01:40 . 2008-04-17 02:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2010-06-29 01:39 . 2010-06-29 01:39 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-29 01:37 . 2010-06-29 01:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-06-29 01:37 . 2010-06-29 01:37 ——– d—–w- c:\program files\Apple Software Update
2010-06-29 01:37 . 2010-04-19 10:47 3062048 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-06-29 01:37 . 2010-04-19 10:47 41984 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2010-06-29 01:35 . 2010-06-29 01:35 ——– d—–w- c:\program files\Common Files\Apple
2010-06-28 15:54 . 2001-08-17 12:36 5632 —-a-w- c:\windows\system32\ptpusb.dll
2010-06-28 15:54 . 2008-04-13 19:42 159232 —-a-w- c:\windows\system32\ptpusd.dll
2010-06-25 13:11 . 2010-06-25 13:11 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-06-25 13:10 . 2010-06-25 13:10 ——– d—–w- c:\program files\MSXML 4.0
2010-06-25 10:52 . 2008-04-13 19:42 53760 —-a-w- c:\windows\system32\vfwwdm32.dll
2010-06-25 10:52 . 2008-04-13 19:42 53760 —-a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-06-25 10:45 . 2010-06-25 10:46 ——– d—–w- c:\program files\Common Files\FotoWire
2010-06-25 10:44 . 2004-05-21 10:05 53248 —-a-r- c:\windows\system32\InstMed.exe
2010-06-25 10:44 . 2004-05-27 15:49 372736 —-a-w- c:\windows\system32\LVUI2RC.dll
2010-06-25 10:44 . 2004-05-27 15:47 19968 —-a-w- c:\windows\system32\drivers\LVUSBSta.sys
2010-06-25 10:44 . 2004-05-27 15:43 106496 —-a-w- c:\windows\system32\lvcoinst.dll
2010-06-25 10:44 . 2004-05-27 15:46 204800 —-a-w- c:\windows\system32\LVUI2.dll
2010-06-25 10:44 . 2004-05-27 15:44 208896 —-a-w- c:\windows\system32\lvcodec2.dll
2010-06-25 10:44 . 2004-05-27 15:50 201728 —-a-w- c:\windows\system32\drivers\LV302AV.SYS
2010-06-25 10:43 . 2010-06-25 10:43 ——– d—–w- c:\program files\Common Files\Logitech
2010-06-25 10:43 . 2010-06-25 10:43 81920 ——r- c:\windows\bwUnin-6.1.4.68-8876480L.exe
2010-06-25 10:42 . 2010-06-25 10:42 ——– d—–w- c:\program files\Logitech
2010-06-25 10:41 . 2010-06-25 10:41 53248 ——w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\msihook.dll
2010-06-25 10:41 . 2010-06-25 10:41 126976 ——w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\knlwrap.exe
2010-06-25 10:41 . 2010-06-25 10:41 114688 ——w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\scpthdlr.dll
2010-06-19 01:08 . 2010-06-19 01:08 ——– d—–w- c:\program files\MSECache
2010-06-18 17:45 . 2010-06-18 17:45 293376 ——w- c:\windows\system32\dllcache\winsrv.dll
2010-06-17 05:21 . 2010-06-17 05:21 ——– d—–w- c:\documents and settings\All Users\Application Data\vsosdk
2010-06-14 01:02 . 2010-06-14 01:02 27024112 —-a-w- c:\program files\PowerPointViewer.exe
2010-06-09 10:09 . 2010-09-10 05:58 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-07 04:09 . 2010-06-07 04:09 ——– d—–w- c:\documents and settings\Boys
2010-06-06 03:16 . 2010-06-06 03:16 47360 —-a-w- c:\windows\system32\drivers\SET78.tmp
2010-06-06 03:16 . 2010-06-06 03:16 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2010-06-06 03:16 . 2007-03-18 11:37 65602 —-a-w- c:\windows\system32\cook3260.dll
2010-06-06 03:16 . 2006-09-29 03:26 176165 —-a-w- c:\windows\system32\drv23260.dll
2010-06-06 03:16 . 2006-09-29 03:25 208935 —-a-w- c:\windows\system32\drv33260.dll
2010-06-06 03:16 . 2006-09-29 03:24 217127 —-a-w- c:\windows\system32\drv43260.dll
2010-06-06 03:16 . 2006-05-11 10:21 626688 —-a-w- c:\windows\system32\vp7vfw.dll
2010-06-06 03:16 . 2006-05-20 07:16 1184984 —-a-w- c:\windows\system32\wvc1dmod.dll
2010-06-06 03:16 . 2004-05-04 02:53 1645320 —-a-w- c:\windows\gdiplus.dll
2010-06-06 03:16 . 2010-06-06 03:16 ——– d—–w- c:\program files\VSO
2010-06-06 03:15 . 2009-05-02 22:42 15907184 —-a-w- c:\program files\vsoConvertXtoDVD3_setup.exe
2010-06-06 03:13 . 2004-03-02 06:37 125184 ——w- c:\windows\system32\drivers\imagesrv.sys
2010-06-06 03:13 . 2004-03-02 06:37 5504 ——w- c:\windows\system32\drivers\imagedrv.sys
2010-06-06 03:12 . 2000-06-26 00:45 106496 —-a-w- c:\windows\system32\TwnLib20.dll
2010-06-06 03:12 . 2004-07-26 06:16 476320 ——w- c:\windows\system32\ImagXpr7.dll
2010-06-06 03:12 . 2004-07-26 06:16 471040 ——w- c:\windows\system32\ImagXRA7.dll
2010-06-06 03:12 . 2004-07-26 06:16 262144 ——w- c:\windows\system32\ImagXR7.dll
2010-06-06 03:12 . 2004-07-26 06:16 1568768 ——w- c:\windows\system32\ImagX7.dll
2010-06-06 03:12 . 2010-06-06 03:12 ——– d—–w- c:\program files\Common Files\Ahead
2010-06-06 03:12 . 2001-07-09 00:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe
2010-06-06 03:12 . 2010-06-06 03:12 ——– d—–w- c:\program files\Ahead
2010-06-06 03:12 . 2005-08-08 00:49 29974779 —-a-w- c:\program files\nero6603.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 06:53 . 1979-12-31 14:00 974848 —-a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 1979-12-31 14:00 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 1979-12-31 14:00 953856 —-a-w- c:\windows\system32\mfc40u.dll
2010-09-18 02:23 . 1979-12-31 14:00 974848 —-a-w- c:\windows\system32\mfc42u.dll
2010-09-10 05:58 . 2006-06-23 01:33 916480 —-a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 1979-12-31 14:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 1979-12-31 14:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 1979-12-31 14:00 285824 —-a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 1980-01-01 09:00 1852800 —-a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 1979-12-31 14:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 1979-12-31 14:00 99840 —-a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 1979-12-31 14:00 357248 —-a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 1979-12-31 14:00 617472 —-a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2005-06-10 23:55 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-03-06 02:16 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-16 12:05 . 2005-07-26 04:31 1288192 —-a-w- c:\windows\system32\ole32.dll
2010-06-30 12:31 . 1979-12-31 14:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-18 17:45 . 1980-01-01 09:00 293376 —-a-w- c:\windows\system32\winsrv.dll
2010-06-17 14:03 . 1979-12-31 14:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-15 16:17 . 2002-12-11 14:14 143422 —-a-w- c:\windows\system32\l3codecx.ax
2010-06-14 14:31 . 2003-12-29 22:21 744448 —-a-w- c:\windows\pchealth\HelpCtr\Binaries\HelpSvc.exe
2010-06-14 07:41 . 2006-09-13 05:09 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-06-09 07:43 . 2003-03-03 05:57 692736 —-a-w- c:\windows\system32\inetcomm.dll
2010-04-27 13:59 . 2002-08-29 10:04 2146304 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-04-27 13:05 . 2002-08-29 10:04 2024448 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-16 15:36 . 1979-12-31 14:00 406016 —-a-w- c:\windows\system32\usp10.dll
2010-03-30 02:24 . 2006-10-18 11:47 317440 ——w- c:\windows\system32\mp4sdecd.dll
2010-03-29 14:52 . 1979-12-31 14:00 262416 —-a-w- c:\windows\system32\mpg4ds32.ax
2010-03-10 06:15 . 1979-12-31 14:00 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-03-05 14:37 . 1979-12-31 14:00 65536 —-a-w- c:\windows\system32\asycfilt.dll
2010-02-24 13:11 . 1979-12-31 14:00 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-12 04:33 . 2006-08-16 12:14 100864 —-a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2003-06-30 06:30 226880 —-a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-05 18:27 . 2005-08-29 23:14 1291776 —-a-w- c:\windows\system32\quartz.dll
2010-01-29 14:43 . 1979-12-31 14:00 307260 —-a-w- c:\windows\system32\l3codeca.acm
2010-01-13 14:01 . 1979-12-31 14:00 86016 —-a-w- c:\windows\system32\cabview.dll
2009-12-24 06:59 . 1979-12-31 14:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2009-12-16 18:43 . 2003-12-29 22:19 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 1979-12-31 14:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-11-27 16:07 . 2001-08-17 12:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 1979-12-31 14:00 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-17 12:36 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:07 . 1979-12-31 14:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 1979-12-31 14:00 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-21 15:51 . 1979-12-31 14:00 471552 —-a-w- c:\windows\apppatch\AcLayers.dll
2009-11-06 15:07 . 2009-11-06 15:07 49488 —-a-w- c:\windows\system32\netfxperf.dll
2009-11-06 15:07 . 2009-11-06 15:07 297808 —-a-w- c:\windows\system32\mscoree.dll
2009-11-06 15:06 . 2009-11-06 15:06 1130824 —-a-w- c:\windows\system32\dfshim.dll
2009-10-15 16:28 . 1979-12-31 14:00 81920 —-a-w- c:\windows\system32\fontsub.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-10-06 49152]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2010-06-25 20480]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"SiS Tray"="c:\windows\System32\sistray.EXE" [2003-08-19 667648]
"SiS Windows KeyHook"="c:\windows\System32\keyhook.exe" [2003-08-19 241664]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"nwiz"="nwiz.exe" [2003-10-06 741376]
"CTHelper"="CTHELPER.EXE" [2003-06-20 24576]
"AsioReg"="CTASIO.DLL" [2003-06-20 118784]
"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 45056]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"SoundMan"="SOUNDMAN.EXE" [2003-08-14 57344]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-06-04 843776]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-06 673616]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 110592]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-05-21 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-06-01 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-06-01 217088]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2010-09-25 112632]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2010-09-25 1062224]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\documents and settings\Marion\My Documents\iTunesHelper.exe" [2010-09-23 421160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-10-06 49152]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2010-06-25 10:43 20480 —-a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 00:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 00:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-09-02 00:26 672632 —-a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 01:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TivoServer]
2009-11-02 03:17 2195160 —-a-w- c:\program files\TiVo\Desktop\TiVoServer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TivoTransfer]
2009-11-02 03:17 604888 —-a-w- c:\program files\TiVo\Desktop\TiVoTransfer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SharedAccess"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"mnmsrvc"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Marion\\My Documents\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=

R2 TivoBeacon2;TiVo Beacon Service;c:\program files\TiVo\Desktop\TiVoBeacon.exe [11/2/2009 1:17 PM 1098968]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [9/26/2010 9:17 AM 64080]
R3 C4C_BSC2;C4C_BSC2;c:\windows\system32\drivers\C4C_BSC2.sys [12/31/2003 8:17 PM 84788]
S1 SiSEsc;SISLIB_ESC;c:\windows\system32\sisesc.sys [12/31/2003 8:51 PM 28416]
S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [9/26/2010 9:15 AM 196320]
.
Contents of the 'Scheduled Tasks' folder

2010-12-12 c:\windows\Tasks\Epson Printer Software Downloader.job
- c:\program files\EPSON\EPAPDL\E_SAPDL2.EXE [2009-05-26 01:43]

2010-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 01:50]

2010-12-12 c:\windows\Tasks\User_Feed_Synchronization-{1C69E20A-E0C8-44F1-9878-A3E70125F746}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 18:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.ninemsn.com/
uInternet Settings,ProxyOverride = localhost;*.local
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-12 20:45
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(508)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1116)
c:\windows\system32\WININET.dll
c:\docume~1\Marion\LOCALS~1\Temp\IadHide4.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Epson Software\Easy Photo Print\EPTBL.dll
c:\program files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
c:\program files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe < c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-01-12 20:48:54 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-12 10:48

Pre-Run: 205,653,639,168 bytes free
Post-Run: 206,373,519,360 bytes free

- - End Of File - - F41698114906A2933F147E26D2C2AFB6