TaxSleuth
Topic Starter
A little while back, my computer really started to act strangely. Kept crashing, wouldn't reboot. Really scary stuff. Malwarebytes got the following on two successive scans:
(I am just posting the infected part)
********************************************************************************
*********************************************************************************
****
12/13
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{5ADEFB9E-B824-45E6-86E2-2B7941F5D6A3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5ADEFB9E-B824-45E6-86E2-2B7941F5D6A3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5adefb9e-b824-45e6-86e2-2b7941f5d6a3} (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\softwaredistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\fsquirt.exe (Trojan.Dropper.BCM) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\fsquirt.exe (Trojan.Dropper.BCM) -> Quarantined and deleted successfully.
********************************************************************************
************************************************************************
And on 12/17
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{5ADEFB9E-B824-45E6-86E2-2B7941F5D6A3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5ADEFB9E-B824-45E6-86E2-2B7941F5D6A3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5adefb9e-b824-45e6-86e2-2b7941f5d6a3} (Trojan.Agent) -> Quarantined and deleted successfully.
********************************************************************************
*********************************************************************************
***************************************************************
The computer is behaving much better, but I am still kind of freaking and recently a tech support guy started talking about a root kit.
Here's a HighJack This log:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:50:43 PM, on 12/17/11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Ellie Mae\SCAppMgr\SCAppMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Affixa\AffixaTray.exe
C:\Program Files\NewTech Infosystems\NTI Shadow 3\Shadow.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Smith & Company\My Documents\Downloads\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Affixa] C:\Program Files\Affixa\AffixaTray.exe
O4 - HKCU\..\Run: [Shadow] C:\Program Files\NewTech Infosystems\NTI Shadow 3\Shadow.exe –minimize
O4 - HKCU\..\Run: [4AF60A91ED87D399336B6EE65845034E831A75D0._service_run] "C:\Program Files\Google\Chrome\Application\chrome.exe" –type=service
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: CureCRM.lnk = C:\Program Files\CureCRM\curecrm.exe
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Smith & Company\Application Data\Dropbox\bin\Dropbox.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK32.EXE
O8 - Extra context menu item: Add to Evernote 4.0 - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O15 - Trusted Zone: http://*.cumberlandcounty.org
O15 - Trusted Zone: *.instantsurvey.com
O15 - Trusted Zone: www.refund-advantage.com
O15 - Trusted Zone: http://www.refund-advantage.com
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://www.refund-advantage.com/pcheck041911/smsx.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} -
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://ccllcnc.com/Remote/msrdp.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqna/downloads/msxml4.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} -
O16 - DPF: {DC4B2445-4A2C-46FF-BAAE-C0FBB45D866D} (LASDetectX Control) - https://www.laserapp.com/dev/detect/lavdetect.ocx
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://intuitcorp.webex.com/client/WBXclie…ing/ieatgpc.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF2F86EA-5FC2-499A-BBD0-24EFF03A193F}: NameServer = 4.2.2.2,8.8.8.8
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Smart Client Manager (SCAppMgr) - Ellie Mae, Inc. - C:\Program Files\Ellie Mae\SCAppMgr\SCAppMgr.exe
–
End of file - 10504 bytes
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++
HERE ARE THE TWO DDS FILES
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 23:05:22.98 on 12/17/11
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1044 [GMT -5:00]
.
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Ellie Mae\SCAppMgr\SCAppMgr.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Affixa\AffixaTray.exe
C:\Program Files\NewTech Infosystems\NTI Shadow 3\Shadow.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Smith & Company\My Documents\Downloads\dds.scr
.
============== Pseudo HJT Report ===============
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: AutorunsDisabled - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
uRun: [Affixa] c:\program files\affixa\AffixaTray.exe
uRun: [Shadow] c:\program files\newtech infosystems\nti shadow 3\Shadow.exe –minimize
uRun: [4AF60A91ED87D399336B6EE65845034E831A75D0._service_run] "c:\program files\google\chrome\application\chrome.exe" –type=service
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\markha~1\startm~1\programs\startup\curecrm.lnk - c:\program files\curecrm\curecrm.exe
StartupFolder: c:\docume~1\markha~1\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\Smith & company\application data\dropbox\bin\Dropbox.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK32.EXE
IE: Add to Evernote 4.0 - c:\program files\evernote\evernote\EvernoteIE.dll/204
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://c:\program files\evernote\evernote\EvernoteIE.dll/204
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: cumberlandcounty.org
Trusted Zone: instantsurvey.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: mainelandrecords.com\www
Trusted Zone: refund-advantage.com\www
DPF: Microsoft XML Parser for Java
DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} - hxxps://www.refund-advantage.com/pcheck041911/smsx.cab
DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E}
DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://ccllcnc.com/Remote/msrdp.cab
DPF: {88D969C0-F192-11D4-A65F-0040963251E5} - hxxp://ipgweb.cce.hp.com/rdqna/downloads/msxml4.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913}
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DC4B2445-4A2C-46FF-BAAE-C0FBB45D866D} - hxxps://www.laserapp.com/dev/detect/lavdetect.ocx
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://intuitcorp.webex.com/client/WBXclient-T27L10NSP25-10481/training/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {CF2F86EA-5FC2-499A-BBD0-24EFF03A193F} = 4.2.2.2,8.8.8.8
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: GoToMyPC - c:\program files\citrix\gotomypc\G2WinLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-5-22 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-5-22 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-5-22 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-5-22 66616]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-11-28 366152]
R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [2010-1-22 45824]
R2 SCAppMgr;Smart Client Manager;c:\program files\ellie mae\scappmgr\SCAppMgr.exe [2011-4-23 65536]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [2005-7-27 14080]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [2005-7-27 36352]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-11-28 22216]
R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2010-1-22 56960]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [2005-7-27 77056]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-3 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-1-22 1691480]
S3 AtiDCM;AtiDCM;\??\c:\documents and settings\Smith & company\local settings\temp\atidcmxx.sys –> c:\documents and settings\Smith & company\local settings\temp\atidcmxx.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-8-3 136176]
S3 Intuit Fuse Service;Intuit Fuse Service;c:\program files\common files\intuit\fuse\service\Intuit Fuse Service.exe [2006-12-16 72704]
S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [2006-3-13 4736]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [2006-3-13 8960]
S4 cpuz132;cpuz132;\??\c:\docume~1\instal~1\locals~1\temp\cpuz132\cpuz132_x32.sys –> c:\docume~1\instal~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S4 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;\??\c:\docume~1\markha~1\locals~1\temp\onlinescanner\anti-virus\fsgk.sys –> c:\docume~1\markha~1\locals~1\temp\onlinescanner\anti-virus\fsgk.sys [?]
S4 mrtRate;mrtRate; [x]
S4 PortAcc;Spearit Port Access;\??\c:\program files\laplink\pcmover\portacc.sys –> c:\program files\laplink\pcmover\PortAcc.sys [?]
S4 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\tmpassthru.sys –> c:\windows\system32\drivers\TMPassthru.sys [?]
.
=============== Created Last 30 ================
.
2011-12-18 03:03:26 ——– d-sha-r- C:\cmdcons
2011-12-18 01:15:31 ——– d—–w- C:\MGtools
2011-12-18 00:58:15 ——– d—–w- c:\docume~1\markha~1\locals~1\applic~1\WinZip
2011-12-17 21:21:14 ——– d—–w- c:\docume~1\markha~1\applic~1\SUPERAntiSpyware.com
2011-12-17 21:20:41 ——– d—–w- c:\program files\SUPERAntiSpyware
2011-12-17 21:20:41 ——– d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2011-12-17 20:51:11 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-12-14 04:41:05 ——– d—–w- c:\program files\Affixa
2011-12-12 16:38:47 ——– d—–w- c:\windows\system32\wbem\repository\FS
2011-12-12 16:38:47 ——– d—–w- c:\windows\system32\wbem\Repository
2011-12-08 01:46:13 32768 —-a-w- c:\windows\system32\JAWTAccessBridge.dll
2011-11-30 00:06:04 ——– d—–w- C:\ProWin09
2011-11-25 01:21:24 ——– d—–w- C:\RefundAdvantage2011
2011-11-25 01:21:05 ——– d—–w- c:\program files\Refund Advantage 2011
2011-11-22 22:38:38 ——– d—–w- c:\program files\common files\Synactis
2011-11-22 22:37:01 843776 —-a-w- c:\windows\system32\wodTelnetDLX.ocx
2011-11-22 22:36:58 ——– d—–w- c:\program files\EFILE10
2011-11-20 01:38:44 ——– d—–w- c:\docume~1\markha~1\locals~1\applic~1\Evernote
2011-11-20 01:37:20 ——– d—–w- c:\program files\Evernote
2011-11-18 23:37:49 ——– d—–w- c:\docume~1\alluse~1\applic~1\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
2011-11-18 23:17:50 ——– d—–w- c:\program files\AMD APP
.
==================== Find3M ====================
.
2011-12-17 20:50:46 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-12-03 19:53:17 3209640 —-a-w- C:\Affixa-Download.exe
2011-11-18 22:29:47 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-13 22:53:03 414 —-a-w- C:\Act_Kill_regbackup_JDK_Nov13-2011.reg
2011-11-07 15:54:30 848 –sha-w- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2011-10-18 22:10:30 64616 —-a-w- c:\windows\system32\RtkCoInstXP.dll
2011-10-14 22:58:12 20064872 —-a-w- c:\windows\RTHDCPL.EXE
2011-10-12 21:16:30 56832 —-a-w- c:\windows\system32\OpenVideo.dll
2011-10-12 21:15:40 13753856 —-a-w- c:\windows\system32\amdocl.dll
2011-10-12 21:14:50 43520 —-a-w- c:\windows\system32\OpenCL.dll
2011-10-12 20:50:50 311296 —-a-w- c:\windows\system32\atiiiexx.dll
2011-10-12 20:28:58 57344 —-a-w- c:\windows\system32\aticalrt.dll
2011-10-12 20:28:48 53248 —-a-w- c:\windows\system32\aticalcl.dll
2011-10-12 20:25:46 5828608 —-a-w- c:\windows\system32\aticaldd.dll
2011-10-12 20:15:46 18874368 —-a-w- c:\windows\system32\atioglxx.dll
2011-10-12 20:04:48 3953664 —-a-w- c:\windows\system32\ati3duag.dll
2011-10-12 20:01:12 466944 —-a-w- c:\windows\system32\ATIDEMGX.dll
2011-10-12 20:00:06 304128 —-a-w- c:\windows\system32\ati2dvag.dll
2011-10-12 19:58:36 956160 —-a-w- c:\windows\system32\ativvamv.dll
2011-10-12 19:44:38 3278848 —-a-w- c:\windows\system32\ativvaxx.dll
2011-10-12 19:42:32 212992 —-a-w- c:\windows\system32\atipdlxx.dll
2011-10-12 19:42:18 155648 —-a-w- c:\windows\system32\Oemdspif.dll
2011-10-12 19:42:10 26112 —-a-w- c:\windows\system32\Ati2mdxx.exe
2011-10-12 19:42:02 43520 —-a-w- c:\windows\system32\ati2edxx.dll
2011-10-12 19:41:50 188416 —-a-w- c:\windows\system32\ati2evxx.dll
2011-10-12 19:40:34 643072 —-a-w- c:\windows\system32\ati2evxx.exe
2011-10-12 19:39:06 53248 —-a-w- c:\windows\system32\ATIDDC.DLL
2011-10-12 19:37:30 159744 —-a-w- c:\windows\system32\atiapfxx.exe
2011-10-12 19:33:46 503808 —-a-w- c:\windows\system32\atiok3x2.dll
2011-10-12 19:33:20 806912 —-a-w- c:\windows\system32\atikvmag.dll
2011-10-12 19:29:04 221184 —-a-w- c:\windows\system32\atiadlxx.dll
2011-10-12 19:28:46 17408 —-a-w- c:\windows\system32\atitvo32.dll
2011-10-12 19:23:52 65024 —-a-w- c:\windows\system32\atimpc32.dll
2011-10-12 19:23:52 65024 —-a-w- c:\windows\system32\amdpcom32.dll
2011-10-12 19:22:14 884736 —-a-w- c:\windows\system32\ati2cqag.dll
.
============= FINISH: 23:05:50.26 ===============
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++
Second DDS file:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 12/10/06 6:21:25 PM
System Uptime: 12/17/11 10:24:14 PM (1 hours ago)
.
Motherboard: ELITEGROUP | | RC410-M
Processor: Intel® Celeron® D CPU 3.20GHz | CPU 1 | 3200/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 88 GiB total, 18.299 GiB free.
D: is CDROM (CDFS)
E: is FIXED (FAT32) - 4 GiB total, 0.208 GiB free.
G: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
L: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
M: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
O: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
Q: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
T: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
W: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
X: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1953: 10/01/11 5:49:07 PM - Installed ProSeries DMS
RP1954: 10/02/11 6:01:16 PM - System Checkpoint
RP1955: 10/03/11 11:50:39 PM - System Checkpoint
RP1956: 10/04/11 3:54:18 PM - Installed ProSeries DMS
RP1957: 10/07/11 4:19:19 AM - System Checkpoint
RP1958: 10/08/11 6:37:02 AM - System Checkpoint
RP1959: 10/09/11 7:23:25 AM - System Checkpoint
RP1960: 10/10/11 7:35:28 AM - System Checkpoint
RP1961: 10/11/11 5:30:27 PM - System Checkpoint
RP1962: 10/13/11 3:44:46 PM - System Checkpoint
RP1963: 10/15/11 12:39:19 AM - System Checkpoint
RP1964: 10/15/11 4:52:43 PM - Restore Operation
RP1965: 10/15/11 4:58:01 PM - Restore Operation
RP1966: 10/15/11 5:02:33 PM - Restore Operation
RP1967: 10/17/11 2:06:12 AM - System Checkpoint
RP1968: 10/18/11 10:29:40 PM - System Checkpoint
RP1969: 10/19/11 11:54:28 PM - System Checkpoint
RP1970: 10/21/11 6:40:14 PM - System Checkpoint
RP1971: 10/23/11 10:01:09 PM - System Checkpoint
RP1972: 10/26/11 1:14:32 AM - System Checkpoint
RP1973: 10/27/11 7:11:49 PM - System Checkpoint
RP1974: 10/28/11 11:10:04 AM - Restore Operation
RP1975: 10/28/11 11:15:31 AM - Restore Operation
RP1976: 10/28/11 11:25:32 AM - Restore Operation
RP1977: 10/28/11 12:33:12 PM - Installed Java™ 6 Update 29
RP1978: 10/28/11 12:58:05 PM - Installed Realtek High Definition Audio Driver
RP1979: 10/28/11 1:58:49 PM - Software Distribution Service 3.0
RP1980: 10/31/11 12:29:06 AM - System Checkpoint
RP1981: 11/01/11 1:18:27 AM - System Checkpoint
RP1982: 11/03/11 1:34:25 AM - System Checkpoint
RP1983: 11/04/11 2:33:28 AM - System Checkpoint
RP1984: 11/05/11 4:19:22 PM - System Checkpoint
RP1985: 11/08/11 12:12:35 PM - Removed 3CXPhone
RP1986: 11/08/11 3:23:00 PM - Removed 2003 ProSeries User's Guide
RP1987: 11/09/11 11:40:33 PM - System Checkpoint
RP1988: 11/11/11 12:29:00 AM - System Checkpoint
RP1989: 11/12/11 12:40:10 AM - System Checkpoint
RP1990: 11/13/11 1:19:10 AM - System Checkpoint
RP1991: 11/13/11 3:53:48 PM - Removed SlimComputer
RP1992: 11/13/11 3:55:02 PM - Removed SlimCleaner
RP1993: 11/13/11 4:32:50 PM - Configured ACT! by Sage 2010
RP1994: 11/14/11 6:16:07 PM - System Checkpoint
RP1995: 11/17/11 2:13:40 AM - System Checkpoint
RP1996: 11/18/11 3:18:04 AM - System Checkpoint
RP1997: 11/19/11 9:52:16 AM - System Checkpoint
RP1998: 11/19/11 8:37:12 PM - Installed Evernote v. 4.5.1
RP1999: 11/21/11 9:38:55 AM - System Checkpoint
RP2000: 11/22/11 11:43:43 AM - System Checkpoint
RP2001: 11/24/11 1:41:56 AM - System Checkpoint
RP2002: 11/24/11 8:21:02 PM - Installed Refund Advantage 2011.
RP2003: 11/26/11 6:40:22 PM - Installed TaxTools 2011
RP2004: 11/27/11 7:46:13 PM - System Checkpoint
RP2005: 11/29/11 12:41:27 AM - System Checkpoint
RP2006: 11/29/11 7:08:53 PM - Installed ProSeries 2009
RP2007: 11/29/11 7:11:23 PM - Installed ProSeries User's Guide 2009
RP2008: 11/29/11 7:15:09 PM - Printer Driver Amyuni Document Converter 400 Installed
RP2009: 11/29/11 7:15:41 PM - Installed AnswerWorks 4.0 Runtime - English
RP2010: 11/30/11 8:56:26 PM - System Checkpoint
RP2011: 12/02/11 12:58:42 AM - System Checkpoint
RP2012: 12/03/11 2:56:18 PM - IObit Uninstaller restore point
RP2013: 12/03/11 2:56:38 PM - Removed ProSeries User's Guide 2009
RP2014: 12/03/11 3:02:23 PM - IObit Uninstaller restore point
RP2015: 12/04/11 3:09:11 PM - System Checkpoint
RP2016: 12/06/11 12:18:11 AM - System Checkpoint
RP2017: 12/07/11 10:51:30 PM - System Checkpoint
RP2018: 12/08/11 11:26:01 PM - System Checkpoint
RP2019: 12/09/11 9:07:33 AM - Restore Operation
RP2020: 12/10/11 10:39:48 AM - System Checkpoint
RP2021: 12/11/11 11:33:20 AM - Restore Operation
RP2022: 12/12/11 11:03:57 AM - Restore Operation
RP2023: 12/12/11 11:37:14 AM - Restore Operation
RP2024: 12/13/11 12:57:23 PM - System Checkpoint
RP2025: 12/14/11 7:05:35 PM - System Checkpoint
RP2026: 12/16/11 11:05:40 AM - System Checkpoint
RP2027: 12/17/11 2:11:57 PM - System Checkpoint
RP2028: 12/17/11 3:43:19 PM - Removed Java™ 6 Update 21
RP2029: 12/17/11 3:50:27 PM - Installed Java™ 6 Update 30
RP2030: 12/17/11 7:55:20 PM - Installed WinZip 16.0
.
==== Installed Programs ======================
.
2003 ProSeries User's Guide
AccuWage 2010
Acrobat.com
Adobe Acrobat 7.0 Professional
Adobe Acrobat 7.1.0 Professional
Adobe AIR
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Connect Add-in
Adobe Flash Player 11 ActiveX
Adobe Media Player
Adobe Reader X (10.1.1)
Affixa
AMD APP SDK Runtime
AMD Catalyst Install Manager
AnswerWorks 4.0 Runtime - English
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI AVIVO Codecs
ATI Problem Report Wizard
ATX / Kleinrock Tax Products 2006 (Remove Only)
ATX / Kleinrock Tax Products 2007 (Remove Only)
ATX XML Printer
Avira AntiVir Personal - Free Antivirus
Brother MFL-Pro Suite
Browntech Image Plugin 1.97
Carbonite
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility
CCC Help English
ChatRoulette
Compatibility Pack for the 2007 Office system
Coupon Printer for Windows
CureCRM 1.45
Data Import Wizard
DataPilot
Defraggler
DivX Setup
Document eSort Components
Driver Detective
Dropbox
e-Form RS
e-Form RS - 1
EASEUS Partition Manager 1.1
Easy Duplicate Finder v. 3.2
EFTPS Batch Provider Client
Encompass360 SmartClient
EntlClnt
ESET Online Scanner v3
Evernote v. 4.5.1
FastStone Capture 5.1
Free Convert to DIVX AVI WMV MP4 MPEG Converter 5.8
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
Gmail Backup
GoldMine 5.7
GoldMine 6.5
Google Chrome
Google Update Helper
GoToMeeting 5.1.0.873
GoToMyPC
High Definition Audio Driver Package - KB888111
Homestead SiteBuilder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB981793)
HP Media Vault
HP Software Update
IconsExtract
Intellect
IntelliForms
Intuit Entitlement Client
iSEEK AnswerWorks English Runtime
iTunes
Java Auto Updater
Java™ 6 Update 30
join.me
Malwarebytes' Anti-Malware version 1.51.2.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Access 2002 Runtime
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Easy Assist v2
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Network Guide
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Live Meeting 2007
Microsoft Office Outlook 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (ACT7)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft WSE 2.0 SP3 Runtime
Microsoft WSE 3.0
Move Networks Media Player for Internet Explorer
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
Netflix Movie Viewer
NTI DriveBackup! 4
NTI Shadow 3
Octoshape Streaming Services
PaperPort Image Printer
PDF Annotator 3.0.0.331
Perfect Uninstaller v6.3.3.9
perform plus III
Point
Print to PDF Annotator (novaPDF OEM 7.4 printer)
ProLine Tax Import
ProSeries 2000
ProSeries 2001
ProSeries 2002
ProSeries 2003
ProSeries 2004
ProSeries 2005
ProSeries 2006
ProSeries 2007
ProSeries 2008
ProSeries 2009
ProSeries 2010
ProSeries DMS
Quicken 2011
QuickTime
Real Alternative 1.9.0
Realtek High Definition Audio Driver
Refund Advantage 2010
Refund Advantage 2011
Republic Bank Tax Product Software 2006
ScandAll 21
Scanner Utility for Microsoft Windows
ScanSoft PaperPort 11
ScrewDrivers Client v4
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Setup
SMAC 2.0
SmartClient Core
SmartClient Installation Manager
Soft Data Fax Modem with SmartCP
Software Operation Panel
Stamps.com
Stamps.com Application Support for Microsoft Word 2000-2010
Stamps.com support for Microsoft Word 2000-2010
SUPERAntiSpyware
Tax Analysts ProSeries Research Library
TaxTools 2007
TaxTools 2009
TaxTools 2010
TaxTools 2011
The Lord of the Rings FREE Trial
TightVNC 1.3.9
TinyZIP
Tracker
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wmaiper
TurboTax 2009 wrapper
ubCore
Universal Media Player
Update for 2007 Microsoft Office System (KB967642)
Update for Outlook 2007 Junk Email Filter (kb2410711)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB900930)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922120)
Update for Windows XP (KB922582)
Update for Windows XP (KB929338)
Update for Windows XP (KB931836)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
USB-IrDA Adapter
VC80CRTRedist - 8.0.50727.4053
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
W2 Mate (2004)
W2 Mate (2005) 2.0
WebEx
WebFldrs XP
Windows Driver Package - Microsoft Corporation (usbvideo) Image (05/25/2007 1.0.3656.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinZip 16.0
.
==== Event Viewer Messages From Past Week ========
.
12/12/11 10:54:12 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio avipbb Fips intelppm ssmdrv
12/12/11 10:53:28 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666}
12/12/11 10:53:16 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
.
==== End Of File ===========================
Help me, Obiwan. You're my only hope.
Charles
(I am just posting the infected part)
********************************************************************************
*********************************************************************************
****
12/13
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{5ADEFB9E-B824-45E6-86E2-2B7941F5D6A3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5ADEFB9E-B824-45E6-86E2-2B7941F5D6A3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5adefb9e-b824-45e6-86e2-2b7941f5d6a3} (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\softwaredistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\fsquirt.exe (Trojan.Dropper.BCM) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\fsquirt.exe (Trojan.Dropper.BCM) -> Quarantined and deleted successfully.
********************************************************************************
************************************************************************
And on 12/17
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{5ADEFB9E-B824-45E6-86E2-2B7941F5D6A3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5ADEFB9E-B824-45E6-86E2-2B7941F5D6A3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5adefb9e-b824-45e6-86e2-2b7941f5d6a3} (Trojan.Agent) -> Quarantined and deleted successfully.
********************************************************************************
*********************************************************************************
***************************************************************
The computer is behaving much better, but I am still kind of freaking and recently a tech support guy started talking about a root kit.
Here's a HighJack This log:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:50:43 PM, on 12/17/11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Ellie Mae\SCAppMgr\SCAppMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Affixa\AffixaTray.exe
C:\Program Files\NewTech Infosystems\NTI Shadow 3\Shadow.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Smith & Company\My Documents\Downloads\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Affixa] C:\Program Files\Affixa\AffixaTray.exe
O4 - HKCU\..\Run: [Shadow] C:\Program Files\NewTech Infosystems\NTI Shadow 3\Shadow.exe –minimize
O4 - HKCU\..\Run: [4AF60A91ED87D399336B6EE65845034E831A75D0._service_run] "C:\Program Files\Google\Chrome\Application\chrome.exe" –type=service
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: CureCRM.lnk = C:\Program Files\CureCRM\curecrm.exe
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Smith & Company\Application Data\Dropbox\bin\Dropbox.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK32.EXE
O8 - Extra context menu item: Add to Evernote 4.0 - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O15 - Trusted Zone: http://*.cumberlandcounty.org
O15 - Trusted Zone: *.instantsurvey.com
O15 - Trusted Zone: www.refund-advantage.com
O15 - Trusted Zone: http://www.refund-advantage.com
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://www.refund-advantage.com/pcheck041911/smsx.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} -
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://ccllcnc.com/Remote/msrdp.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqna/downloads/msxml4.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} -
O16 - DPF: {DC4B2445-4A2C-46FF-BAAE-C0FBB45D866D} (LASDetectX Control) - https://www.laserapp.com/dev/detect/lavdetect.ocx
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://intuitcorp.webex.com/client/WBXclie…ing/ieatgpc.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF2F86EA-5FC2-499A-BBD0-24EFF03A193F}: NameServer = 4.2.2.2,8.8.8.8
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Smart Client Manager (SCAppMgr) - Ellie Mae, Inc. - C:\Program Files\Ellie Mae\SCAppMgr\SCAppMgr.exe
–
End of file - 10504 bytes
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++
HERE ARE THE TWO DDS FILES
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 23:05:22.98 on 12/17/11
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1044 [GMT -5:00]
.
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Ellie Mae\SCAppMgr\SCAppMgr.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Affixa\AffixaTray.exe
C:\Program Files\NewTech Infosystems\NTI Shadow 3\Shadow.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Smith & Company\My Documents\Downloads\dds.scr
.
============== Pseudo HJT Report ===============
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: AutorunsDisabled - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
uRun: [Affixa] c:\program files\affixa\AffixaTray.exe
uRun: [Shadow] c:\program files\newtech infosystems\nti shadow 3\Shadow.exe –minimize
uRun: [4AF60A91ED87D399336B6EE65845034E831A75D0._service_run] "c:\program files\google\chrome\application\chrome.exe" –type=service
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\markha~1\startm~1\programs\startup\curecrm.lnk - c:\program files\curecrm\curecrm.exe
StartupFolder: c:\docume~1\markha~1\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\Smith & company\application data\dropbox\bin\Dropbox.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK32.EXE
IE: Add to Evernote 4.0 - c:\program files\evernote\evernote\EvernoteIE.dll/204
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://c:\program files\evernote\evernote\EvernoteIE.dll/204
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: cumberlandcounty.org
Trusted Zone: instantsurvey.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: mainelandrecords.com\www
Trusted Zone: refund-advantage.com\www
DPF: Microsoft XML Parser for Java
DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} - hxxps://www.refund-advantage.com/pcheck041911/smsx.cab
DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E}
DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://ccllcnc.com/Remote/msrdp.cab
DPF: {88D969C0-F192-11D4-A65F-0040963251E5} - hxxp://ipgweb.cce.hp.com/rdqna/downloads/msxml4.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913}
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DC4B2445-4A2C-46FF-BAAE-C0FBB45D866D} - hxxps://www.laserapp.com/dev/detect/lavdetect.ocx
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://intuitcorp.webex.com/client/WBXclient-T27L10NSP25-10481/training/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {CF2F86EA-5FC2-499A-BBD0-24EFF03A193F} = 4.2.2.2,8.8.8.8
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: GoToMyPC - c:\program files\citrix\gotomypc\G2WinLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-5-22 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-5-22 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-5-22 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-5-22 66616]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-11-28 366152]
R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [2010-1-22 45824]
R2 SCAppMgr;Smart Client Manager;c:\program files\ellie mae\scappmgr\SCAppMgr.exe [2011-4-23 65536]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [2005-7-27 14080]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [2005-7-27 36352]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-11-28 22216]
R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2010-1-22 56960]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [2005-7-27 77056]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-3 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-1-22 1691480]
S3 AtiDCM;AtiDCM;\??\c:\documents and settings\Smith & company\local settings\temp\atidcmxx.sys –> c:\documents and settings\Smith & company\local settings\temp\atidcmxx.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-8-3 136176]
S3 Intuit Fuse Service;Intuit Fuse Service;c:\program files\common files\intuit\fuse\service\Intuit Fuse Service.exe [2006-12-16 72704]
S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [2006-3-13 4736]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [2006-3-13 8960]
S4 cpuz132;cpuz132;\??\c:\docume~1\instal~1\locals~1\temp\cpuz132\cpuz132_x32.sys –> c:\docume~1\instal~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S4 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;\??\c:\docume~1\markha~1\locals~1\temp\onlinescanner\anti-virus\fsgk.sys –> c:\docume~1\markha~1\locals~1\temp\onlinescanner\anti-virus\fsgk.sys [?]
S4 mrtRate;mrtRate; [x]
S4 PortAcc;Spearit Port Access;\??\c:\program files\laplink\pcmover\portacc.sys –> c:\program files\laplink\pcmover\PortAcc.sys [?]
S4 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\tmpassthru.sys –> c:\windows\system32\drivers\TMPassthru.sys [?]
.
=============== Created Last 30 ================
.
2011-12-18 03:03:26 ——– d-sha-r- C:\cmdcons
2011-12-18 01:15:31 ——– d—–w- C:\MGtools
2011-12-18 00:58:15 ——– d—–w- c:\docume~1\markha~1\locals~1\applic~1\WinZip
2011-12-17 21:21:14 ——– d—–w- c:\docume~1\markha~1\applic~1\SUPERAntiSpyware.com
2011-12-17 21:20:41 ——– d—–w- c:\program files\SUPERAntiSpyware
2011-12-17 21:20:41 ——– d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2011-12-17 20:51:11 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-12-14 04:41:05 ——– d—–w- c:\program files\Affixa
2011-12-12 16:38:47 ——– d—–w- c:\windows\system32\wbem\repository\FS
2011-12-12 16:38:47 ——– d—–w- c:\windows\system32\wbem\Repository
2011-12-08 01:46:13 32768 —-a-w- c:\windows\system32\JAWTAccessBridge.dll
2011-11-30 00:06:04 ——– d—–w- C:\ProWin09
2011-11-25 01:21:24 ——– d—–w- C:\RefundAdvantage2011
2011-11-25 01:21:05 ——– d—–w- c:\program files\Refund Advantage 2011
2011-11-22 22:38:38 ——– d—–w- c:\program files\common files\Synactis
2011-11-22 22:37:01 843776 —-a-w- c:\windows\system32\wodTelnetDLX.ocx
2011-11-22 22:36:58 ——– d—–w- c:\program files\EFILE10
2011-11-20 01:38:44 ——– d—–w- c:\docume~1\markha~1\locals~1\applic~1\Evernote
2011-11-20 01:37:20 ——– d—–w- c:\program files\Evernote
2011-11-18 23:37:49 ——– d—–w- c:\docume~1\alluse~1\applic~1\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
2011-11-18 23:17:50 ——– d—–w- c:\program files\AMD APP
.
==================== Find3M ====================
.
2011-12-17 20:50:46 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-12-03 19:53:17 3209640 —-a-w- C:\Affixa-Download.exe
2011-11-18 22:29:47 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-13 22:53:03 414 —-a-w- C:\Act_Kill_regbackup_JDK_Nov13-2011.reg
2011-11-07 15:54:30 848 –sha-w- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2011-10-18 22:10:30 64616 —-a-w- c:\windows\system32\RtkCoInstXP.dll
2011-10-14 22:58:12 20064872 —-a-w- c:\windows\RTHDCPL.EXE
2011-10-12 21:16:30 56832 —-a-w- c:\windows\system32\OpenVideo.dll
2011-10-12 21:15:40 13753856 —-a-w- c:\windows\system32\amdocl.dll
2011-10-12 21:14:50 43520 —-a-w- c:\windows\system32\OpenCL.dll
2011-10-12 20:50:50 311296 —-a-w- c:\windows\system32\atiiiexx.dll
2011-10-12 20:28:58 57344 —-a-w- c:\windows\system32\aticalrt.dll
2011-10-12 20:28:48 53248 —-a-w- c:\windows\system32\aticalcl.dll
2011-10-12 20:25:46 5828608 —-a-w- c:\windows\system32\aticaldd.dll
2011-10-12 20:15:46 18874368 —-a-w- c:\windows\system32\atioglxx.dll
2011-10-12 20:04:48 3953664 —-a-w- c:\windows\system32\ati3duag.dll
2011-10-12 20:01:12 466944 —-a-w- c:\windows\system32\ATIDEMGX.dll
2011-10-12 20:00:06 304128 —-a-w- c:\windows\system32\ati2dvag.dll
2011-10-12 19:58:36 956160 —-a-w- c:\windows\system32\ativvamv.dll
2011-10-12 19:44:38 3278848 —-a-w- c:\windows\system32\ativvaxx.dll
2011-10-12 19:42:32 212992 —-a-w- c:\windows\system32\atipdlxx.dll
2011-10-12 19:42:18 155648 —-a-w- c:\windows\system32\Oemdspif.dll
2011-10-12 19:42:10 26112 —-a-w- c:\windows\system32\Ati2mdxx.exe
2011-10-12 19:42:02 43520 —-a-w- c:\windows\system32\ati2edxx.dll
2011-10-12 19:41:50 188416 —-a-w- c:\windows\system32\ati2evxx.dll
2011-10-12 19:40:34 643072 —-a-w- c:\windows\system32\ati2evxx.exe
2011-10-12 19:39:06 53248 —-a-w- c:\windows\system32\ATIDDC.DLL
2011-10-12 19:37:30 159744 —-a-w- c:\windows\system32\atiapfxx.exe
2011-10-12 19:33:46 503808 —-a-w- c:\windows\system32\atiok3x2.dll
2011-10-12 19:33:20 806912 —-a-w- c:\windows\system32\atikvmag.dll
2011-10-12 19:29:04 221184 —-a-w- c:\windows\system32\atiadlxx.dll
2011-10-12 19:28:46 17408 —-a-w- c:\windows\system32\atitvo32.dll
2011-10-12 19:23:52 65024 —-a-w- c:\windows\system32\atimpc32.dll
2011-10-12 19:23:52 65024 —-a-w- c:\windows\system32\amdpcom32.dll
2011-10-12 19:22:14 884736 —-a-w- c:\windows\system32\ati2cqag.dll
.
============= FINISH: 23:05:50.26 ===============
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++
Second DDS file:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 12/10/06 6:21:25 PM
System Uptime: 12/17/11 10:24:14 PM (1 hours ago)
.
Motherboard: ELITEGROUP | | RC410-M
Processor: Intel® Celeron® D CPU 3.20GHz | CPU 1 | 3200/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 88 GiB total, 18.299 GiB free.
D: is CDROM (CDFS)
E: is FIXED (FAT32) - 4 GiB total, 0.208 GiB free.
G: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
L: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
M: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
O: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
Q: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
T: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
W: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
X: is NetworkDisk (NTFS) - 279 GiB total, 170.625 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1953: 10/01/11 5:49:07 PM - Installed ProSeries DMS
RP1954: 10/02/11 6:01:16 PM - System Checkpoint
RP1955: 10/03/11 11:50:39 PM - System Checkpoint
RP1956: 10/04/11 3:54:18 PM - Installed ProSeries DMS
RP1957: 10/07/11 4:19:19 AM - System Checkpoint
RP1958: 10/08/11 6:37:02 AM - System Checkpoint
RP1959: 10/09/11 7:23:25 AM - System Checkpoint
RP1960: 10/10/11 7:35:28 AM - System Checkpoint
RP1961: 10/11/11 5:30:27 PM - System Checkpoint
RP1962: 10/13/11 3:44:46 PM - System Checkpoint
RP1963: 10/15/11 12:39:19 AM - System Checkpoint
RP1964: 10/15/11 4:52:43 PM - Restore Operation
RP1965: 10/15/11 4:58:01 PM - Restore Operation
RP1966: 10/15/11 5:02:33 PM - Restore Operation
RP1967: 10/17/11 2:06:12 AM - System Checkpoint
RP1968: 10/18/11 10:29:40 PM - System Checkpoint
RP1969: 10/19/11 11:54:28 PM - System Checkpoint
RP1970: 10/21/11 6:40:14 PM - System Checkpoint
RP1971: 10/23/11 10:01:09 PM - System Checkpoint
RP1972: 10/26/11 1:14:32 AM - System Checkpoint
RP1973: 10/27/11 7:11:49 PM - System Checkpoint
RP1974: 10/28/11 11:10:04 AM - Restore Operation
RP1975: 10/28/11 11:15:31 AM - Restore Operation
RP1976: 10/28/11 11:25:32 AM - Restore Operation
RP1977: 10/28/11 12:33:12 PM - Installed Java™ 6 Update 29
RP1978: 10/28/11 12:58:05 PM - Installed Realtek High Definition Audio Driver
RP1979: 10/28/11 1:58:49 PM - Software Distribution Service 3.0
RP1980: 10/31/11 12:29:06 AM - System Checkpoint
RP1981: 11/01/11 1:18:27 AM - System Checkpoint
RP1982: 11/03/11 1:34:25 AM - System Checkpoint
RP1983: 11/04/11 2:33:28 AM - System Checkpoint
RP1984: 11/05/11 4:19:22 PM - System Checkpoint
RP1985: 11/08/11 12:12:35 PM - Removed 3CXPhone
RP1986: 11/08/11 3:23:00 PM - Removed 2003 ProSeries User's Guide
RP1987: 11/09/11 11:40:33 PM - System Checkpoint
RP1988: 11/11/11 12:29:00 AM - System Checkpoint
RP1989: 11/12/11 12:40:10 AM - System Checkpoint
RP1990: 11/13/11 1:19:10 AM - System Checkpoint
RP1991: 11/13/11 3:53:48 PM - Removed SlimComputer
RP1992: 11/13/11 3:55:02 PM - Removed SlimCleaner
RP1993: 11/13/11 4:32:50 PM - Configured ACT! by Sage 2010
RP1994: 11/14/11 6:16:07 PM - System Checkpoint
RP1995: 11/17/11 2:13:40 AM - System Checkpoint
RP1996: 11/18/11 3:18:04 AM - System Checkpoint
RP1997: 11/19/11 9:52:16 AM - System Checkpoint
RP1998: 11/19/11 8:37:12 PM - Installed Evernote v. 4.5.1
RP1999: 11/21/11 9:38:55 AM - System Checkpoint
RP2000: 11/22/11 11:43:43 AM - System Checkpoint
RP2001: 11/24/11 1:41:56 AM - System Checkpoint
RP2002: 11/24/11 8:21:02 PM - Installed Refund Advantage 2011.
RP2003: 11/26/11 6:40:22 PM - Installed TaxTools 2011
RP2004: 11/27/11 7:46:13 PM - System Checkpoint
RP2005: 11/29/11 12:41:27 AM - System Checkpoint
RP2006: 11/29/11 7:08:53 PM - Installed ProSeries 2009
RP2007: 11/29/11 7:11:23 PM - Installed ProSeries User's Guide 2009
RP2008: 11/29/11 7:15:09 PM - Printer Driver Amyuni Document Converter 400 Installed
RP2009: 11/29/11 7:15:41 PM - Installed AnswerWorks 4.0 Runtime - English
RP2010: 11/30/11 8:56:26 PM - System Checkpoint
RP2011: 12/02/11 12:58:42 AM - System Checkpoint
RP2012: 12/03/11 2:56:18 PM - IObit Uninstaller restore point
RP2013: 12/03/11 2:56:38 PM - Removed ProSeries User's Guide 2009
RP2014: 12/03/11 3:02:23 PM - IObit Uninstaller restore point
RP2015: 12/04/11 3:09:11 PM - System Checkpoint
RP2016: 12/06/11 12:18:11 AM - System Checkpoint
RP2017: 12/07/11 10:51:30 PM - System Checkpoint
RP2018: 12/08/11 11:26:01 PM - System Checkpoint
RP2019: 12/09/11 9:07:33 AM - Restore Operation
RP2020: 12/10/11 10:39:48 AM - System Checkpoint
RP2021: 12/11/11 11:33:20 AM - Restore Operation
RP2022: 12/12/11 11:03:57 AM - Restore Operation
RP2023: 12/12/11 11:37:14 AM - Restore Operation
RP2024: 12/13/11 12:57:23 PM - System Checkpoint
RP2025: 12/14/11 7:05:35 PM - System Checkpoint
RP2026: 12/16/11 11:05:40 AM - System Checkpoint
RP2027: 12/17/11 2:11:57 PM - System Checkpoint
RP2028: 12/17/11 3:43:19 PM - Removed Java™ 6 Update 21
RP2029: 12/17/11 3:50:27 PM - Installed Java™ 6 Update 30
RP2030: 12/17/11 7:55:20 PM - Installed WinZip 16.0
.
==== Installed Programs ======================
.
2003 ProSeries User's Guide
AccuWage 2010
Acrobat.com
Adobe Acrobat 7.0 Professional
Adobe Acrobat 7.1.0 Professional
Adobe AIR
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Connect Add-in
Adobe Flash Player 11 ActiveX
Adobe Media Player
Adobe Reader X (10.1.1)
Affixa
AMD APP SDK Runtime
AMD Catalyst Install Manager
AnswerWorks 4.0 Runtime - English
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI AVIVO Codecs
ATI Problem Report Wizard
ATX / Kleinrock Tax Products 2006 (Remove Only)
ATX / Kleinrock Tax Products 2007 (Remove Only)
ATX XML Printer
Avira AntiVir Personal - Free Antivirus
Brother MFL-Pro Suite
Browntech Image Plugin 1.97
Carbonite
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility
CCC Help English
ChatRoulette
Compatibility Pack for the 2007 Office system
Coupon Printer for Windows
CureCRM 1.45
Data Import Wizard
DataPilot
Defraggler
DivX Setup
Document eSort Components
Driver Detective
Dropbox
e-Form RS
e-Form RS - 1
EASEUS Partition Manager 1.1
Easy Duplicate Finder v. 3.2
EFTPS Batch Provider Client
Encompass360 SmartClient
EntlClnt
ESET Online Scanner v3
Evernote v. 4.5.1
FastStone Capture 5.1
Free Convert to DIVX AVI WMV MP4 MPEG Converter 5.8
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
Gmail Backup
GoldMine 5.7
GoldMine 6.5
Google Chrome
Google Update Helper
GoToMeeting 5.1.0.873
GoToMyPC
High Definition Audio Driver Package - KB888111
Homestead SiteBuilder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB981793)
HP Media Vault
HP Software Update
IconsExtract
Intellect
IntelliForms
Intuit Entitlement Client
iSEEK AnswerWorks English Runtime
iTunes
Java Auto Updater
Java™ 6 Update 30
join.me
Malwarebytes' Anti-Malware version 1.51.2.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Access 2002 Runtime
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Easy Assist v2
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Network Guide
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Live Meeting 2007
Microsoft Office Outlook 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (ACT7)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft WSE 2.0 SP3 Runtime
Microsoft WSE 3.0
Move Networks Media Player for Internet Explorer
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
Netflix Movie Viewer
NTI DriveBackup! 4
NTI Shadow 3
Octoshape Streaming Services
PaperPort Image Printer
PDF Annotator 3.0.0.331
Perfect Uninstaller v6.3.3.9
perform plus III
Point
Print to PDF Annotator (novaPDF OEM 7.4 printer)
ProLine Tax Import
ProSeries 2000
ProSeries 2001
ProSeries 2002
ProSeries 2003
ProSeries 2004
ProSeries 2005
ProSeries 2006
ProSeries 2007
ProSeries 2008
ProSeries 2009
ProSeries 2010
ProSeries DMS
Quicken 2011
QuickTime
Real Alternative 1.9.0
Realtek High Definition Audio Driver
Refund Advantage 2010
Refund Advantage 2011
Republic Bank Tax Product Software 2006
ScandAll 21
Scanner Utility for Microsoft Windows
ScanSoft PaperPort 11
ScrewDrivers Client v4
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Setup
SMAC 2.0
SmartClient Core
SmartClient Installation Manager
Soft Data Fax Modem with SmartCP
Software Operation Panel
Stamps.com
Stamps.com Application Support for Microsoft Word 2000-2010
Stamps.com support for Microsoft Word 2000-2010
SUPERAntiSpyware
Tax Analysts ProSeries Research Library
TaxTools 2007
TaxTools 2009
TaxTools 2010
TaxTools 2011
The Lord of the Rings FREE Trial
TightVNC 1.3.9
TinyZIP
Tracker
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wmaiper
TurboTax 2009 wrapper
ubCore
Universal Media Player
Update for 2007 Microsoft Office System (KB967642)
Update for Outlook 2007 Junk Email Filter (kb2410711)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB900930)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922120)
Update for Windows XP (KB922582)
Update for Windows XP (KB929338)
Update for Windows XP (KB931836)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
USB-IrDA Adapter
VC80CRTRedist - 8.0.50727.4053
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
W2 Mate (2004)
W2 Mate (2005) 2.0
WebEx
WebFldrs XP
Windows Driver Package - Microsoft Corporation (usbvideo) Image (05/25/2007 1.0.3656.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinZip 16.0
.
==== Event Viewer Messages From Past Week ========
.
12/12/11 10:54:12 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio avipbb Fips intelppm ssmdrv
12/12/11 10:53:28 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666}
12/12/11 10:53:16 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
.
==== End Of File ===========================
Help me, Obiwan. You're my only hope.
Charles