[Resolved]Vanquishing The Forces Of Evil

My new friends! It is a fine evening, is it not? On this particular evening, though, I have troubles of the technological variety. They are not too terribly troublesome at this point, but I seek their absolute eradication. As such, I shall now tell you the story of my infection.

Yesterday (at precisely 6:48 PM, possibly five minutes before) I was minding my own innocent business on the internet explorer, when all of a sudden, the browser crashed. I shrugged my shoulders (or some such dismissive action) and sought out something to eat. Upon my return roughly five minutes later, I engaged the internet explorer once more with a double click. The homepage opened up, along with a large number of pop-ups that mercilessly bombarded my screen, and I quickly made use of the X in the top right-hand corner of all open windows. I then emitted a groan and began to scan for Evil, which I truly did find.

In my History folder, I discovered three sites that I never visited, the sites from which the pop-ups hailed. They are ad.oinadserver.com (which I believe to be the strongest of the three), rond.starsdoor.com, and zredirector.com, all of which were accessed at precisely 6:48 PM. At 8:22 PM, when I engaged the browser once more to see if my work had successfully defeated the pop-ups, ad.oinadserver.com was the only one to appear. Now none of them appear.

As far as actual progress goes, Spybot Search and Destroy gave the most notable result, claiming to have deleted the following:

TagASaurus, AdSponsor, DoubleClick, MediaPlex, Media Tickets, Smitfraud-C, Statcounter, Virtumonde.WinPor, Virtumonde, YazzleSudoku.

I see no reason to disbelieve it. It comes up clean now.

Ad-aware has deleted myriad cookies, as well as several Evil processes and the like. I cannot name these, I fear.

A dated Ewido Anti-Malware took care of many filthy cookies, as well. I do not recall whether it achieved anything else.

AVG Anti-Spyware, which (as I am sure you are aware) is the new name of Ewido anti-malware, turned up many cookies, as well as something called PurityScan and Adware.Generic. I should like to note that Adware.Generic was ordered to die, but when I later ran AVG Anti-Spyware in Safe Mode, it reappeared. I then ordered it to die on reboot, but I do not know what has become of this.

I have also installed SpywareBlaster, and it is running. Also, the immunization function of Spybot Search and Destroy has been put into use. I do indeed wish I had known about them earlier.

As for HijackThis!, I have reviewed all that it records, deleted two or three obviously bad entries, and I am fairly certain the log is clear of malicious content at this point. Be that as it may, for whatever it is worth, I shall post the log:

Logfile of HijackThis v1.99.1
Scan saved at 7:44:50 PM, on 7/23/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\X3watch\x3watch.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Josh\Local Settings\Temp\Temporary Directory 8 for hijackthis2.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [LiveUpdate] C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: Registration-Studio 8.lnk = C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Event Planner Reminder.lnk = C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\System32\UAService7.exe

Lastly, every time I log onto the computer, I am informed that something is no longer functional for the McAfee Security Center, and that I ought to reinstall it. This is a valid message from McAfee, I am sure. If the message itself interests you, I shall post it on request. Also, this may simply be paranoia, but there is a folder called "Oracle" in My Documents that I do not recall seeing before. Is it evil?

This is the case for one of the two computers in my home, which form a network. The other, being newer, would seem to have better security, or otherwise better luck. It was never faced with popups or any sign of infection, but Spybot Search and Destroy turned up several of the problems on the other system, including TagASaurus and MediaPlex. It also informed me that having certain features of Norton Internet Security disabled served as a security risk. I do not believe this was caused by an outside source, though. On this system, it is notable that no suspicious HijackThis! entries have turned up, and indeed, neither have any malicious processes, only lots of mostly innocent cookies and the claims of Spybot Search and Destroy.

I cannot fathom where these troubles came from, as I have reviewed the browsing history and nothing suspicious appears. Even when the problems began, I was utilizing a perfectly innocent site that I access on a regular basis. I suppose this is simply more frustrating than helpful, (That is, I cannot even say that I have these problems because I have done something wrong or stupid!) The presence of these troubles (in different degrees, even) on both PC's throws me off even more. The only origin that makes any sense to me is Battlefield 1942, which was utilized on both systems the day before, but that would mean the programs sat dormant for nearly 24 hours. The source of my troubles, though, is not why I am here. I merely though I would bring this up so as to maximize the information in the hands of my most good and kind helper.

Please, I would very much like to rid myself of these unwanted files and remnants as completely as possible. The last thing I want is to leave some villianous file or folder or some such thing lying about to do heaven knows what without my knowledge. It is a simply wonderful thing that people such as yourselves are willing to offer aid to those such as myself. I thank you for all efforts devoted to me and to us all.

I don't mean to bump my thread, but the situation is quite different now. I have made use of ComboFix, and its logs now interest me. In several moments I shall post these logs, one for each infected system. I would like to ask simply if you people know of anything I should do to ensure that the PC's involved are clean based on the information I have provided. Your input would greatly put my mind at ease, even if it is a mere acknowledgement of cleanliness. Without further ado, here is the first log:

"Josh" - 2007-07-25 21:24:54 [GMT -4:00] - ComboFix 07-07-24.5 - Service Pack 1 NTFS
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Josh\MYDOCU~1.\racle~1
C:\DOCUME~1\Josh\MYDOCU~1.\ystem~1
C:\m.exe
C:\p.exe
C:\q.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\system.exe


((((((((((((((((((((((((( Files Created from 2007-06-26 to 2007-07-26 )))))))))))))))))))))))))))))))


2007-07-25 21:23 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-25 17:39 d——– C:\KAV
2007-07-25 17:28 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-07-25 17:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-25 12:51 d——– C:\VundoFix Backups
2007-07-25 11:36 0 –a—— C:\WINDOWS\SYSTEM32\CMMGR32.EXE
2007-07-25 11:36 0 –a—— C:\WINDOWS\ORUN32.EXE
2007-07-25 11:30 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 11:29 d——– C:\Program Files\SUPERAntiSpyware
2007-07-25 11:29 d——– C:\DOCUME~1\Josh\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 11:05 d——– C:\Program Files\Security Task Manager
2007-07-25 11:05 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
2007-07-24 21:58 d——– C:\Program Files\a-squared Anti-Malware
2007-07-24 17:19 d——– C:\WINDOWS\SYSTEM32\ActiveScan
2007-07-23 11:45 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-07-23 01:10 d——– C:\Program Files\SpywareBlaster
2007-07-22 18:32 d——– C:\Program Files\ISM


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-25 20:45:38 ——– d—–w C:\Program Files\X3watch
2007-07-25 20:40:26 ——– d—–w C:\Program Files\QuickTime
2007-07-25 19:46:54 ——– d—–w C:\Program Files\ewido anti-malware
2007-07-25 17:27:47 288 —-a-w C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2007-07-25 17:27:47 288 —-a-w C:\WINDOWS\system32\DVCState-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2007-07-25 15:29:31 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-17 17:02:54 ——– d—–w C:\Program Files\Finale 2007
2007-06-27 21:35:29 ——– d—–w C:\Program Files\Guild Wars
2007-06-20 22:55:17 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-20 22:55:15 ——– d—–w C:\DOCUME~1\Josh\APPLIC~1\Musicmatch
2007-06-14 17:11:27 ——– d—–w C:\Program Files\PrintMaster 16
2007-06-03 20:13:43 ——– d—–w C:\DOCUME~1\Josh\APPLIC~1\Command & Conquer 3 Tiberium Wars
2007-06-03 19:57:13 ——– d—–w C:\Program Files\Electronic Arts
2007-05-30 20:27:43 ——– d—–w C:\DOCUME~1\Josh\APPLIC~1\Creative
2007-05-28 15:44:38 108,144 —-a-w C:\WINDOWS\system32\CmdLineExt.dll
2004-08-21 18:51:43 0 –sh–r C:\Program Files\q330994.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\cvchost.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\msstasks.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\mssys.com
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\mstasks1.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\mstaskss.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\msxmidi.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\ntldr.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\rocky.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\seksdialer.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\wininet32.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\SYSTEM\system.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\SYSTEM\wmscrop.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\SYSTEM32\d2kpax.dll
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\SYSTEM32\d2kpax.exe
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\SYSTEM32\jac.dll
2004-08-21 18:51:43 0 –sh–r C:\WINDOWS\SYSTEM32\msxslab.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 C:\WINDOWS\BCMSMMSG.exe]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 17:24]
"IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-25 01:00]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-08-24 22:10]
"StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 10:18]
"CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 02:00]
"CTHelper"="CTHELPER.EXE" [2003-02-20 17:45 C:\WINDOWS\SYSTEM32\CTHELPER.EXE]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-06-18 17:10]
"MMTray"="C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe" [2006-01-17 13:03]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 19:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2003-08-27 12:00]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2003-08-21 19:10]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 22:50]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49]
"LiveUpdate"="C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe" [2004-08-27 21:22]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-05 18:14]
"x3watch"="C:\Program Files\X3watch\x3watch.exe" [2005-08-13 08:27]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 10:12]
"@"="" []
"ReminderApp"="C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe" [2006-09-19 15:41]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2006-01-17 13:03]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-07-17 09:49]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"="" []
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2004-03-19 18:34]

C:\Documents and Settings\Josh\Start Menu\Programs\Startup\
DESKTOP.INI [2004-03-20 13:58:38]
Registration-Studio 8.lnk - C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe [2005-04-24 10:38:46]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
DESKTOP.INI [2004-03-20 13:58:38]
Event Planner Reminder.lnk - C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe [2005-08-30 18:18:30]
Event Reminder.lnk - C:\Program Files\PrintMaster 16\pmremind.exe [2004-01-20 04:10:40]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52]
SpySubtract.lnk - C:\Program Files\InterMute\SpySubtract\SpySub.exe [2007-07-23 17:18:07]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= c:\Program Files\InterMute\SpySubtract\sshook.dll [2007-07-23 17:18 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

R0 agpCPQ;Compaq AGP Bus Filter;C:\WINDOWS\System32\DRIVERS\agpCPQ.sys
R0 iaStor;Intel Integrated RAID;C:\WINDOWS\System32\drivers\iaStor.sys
R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
R1 sscdbhk5;sscdbhk5;C:\WINDOWS\System32\drivers\sscdbhk5.sys
R1 ssrtln;ssrtln;C:\WINDOWS\System32\drivers\ssrtln.sys
R2 drvnddm;drvnddm;C:\WINDOWS\System32\drivers\drvnddm.sys
R2 tfsnboio;tfsnboio;C:\WINDOWS\System32\dla\tfsnboio.sys
R2 tfsncofs;tfsncofs;C:\WINDOWS\System32\dla\tfsncofs.sys
R2 tfsndrct;tfsndrct;C:\WINDOWS\System32\dla\tfsndrct.sys
R2 tfsndres;tfsndres;C:\WINDOWS\System32\dla\tfsndres.sys
R2 tfsnifs;tfsnifs;C:\WINDOWS\System32\dla\tfsnifs.sys
R2 tfsnopio;tfsnopio;C:\WINDOWS\System32\dla\tfsnopio.sys
R2 tfsnpool;tfsnpool;C:\WINDOWS\System32\dla\tfsnpool.sys
R2 tfsnudf;tfsnudf;C:\WINDOWS\System32\dla\tfsnudf.sys
R2 tfsnudfa;tfsnudfa;C:\WINDOWS\System32\dla\tfsnudfa.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\System32\DRIVERS\BCMSM.sys
R3 E1000;Intel® PRO/1000 Adapter Driver;C:\WINDOWS\System32\DRIVERS\e1000325.sys
R3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
R3 StillCam;Still Serial Digital Camera Driver;C:\WINDOWS\System32\DRIVERS\serscan.sys
S2 Fax;Fax;C:\WINDOWS\system32\fxssvc.exe
S3 bDMusicb;bDMusicb;\??\C:\DOCUME~1\Josh\LOCALS~1\Temp\bDMusicb.sys
S3 Bridge;MAC Bridge;C:\WINDOWS\System32\DRIVERS\bridge.sys
S3 BridgeMP;MAC Bridge Miniport;C:\WINDOWS\System32\DRIVERS\bridge.sys
S3 NaiFiltr;NaiFiltr;C:\WINDOWS\System32\DRIVERS\NaiFiltr.sys

*Newly Created Service* - QNSMRYKJEEOR

Contents of the 'Scheduled Tasks' folder
2007-07-25 17:37:00 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Administrator).job
2007-07-25 17:37:00 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Dad).job
2007-07-22 17:14:00 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Jordan).job
2007-07-25 14:45:00 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Josh).job
2007-07-22 17:14:00 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Mom).job
2007-07-04 13:20:08 C:\WINDOWS\tasks\McAfee.com Update Check (OLDER-Dad).job
2007-06-11 20:50:02 C:\WINDOWS\tasks\McAfee.com Update Check (OLDER-Jordan).job
2007-07-25 17:37:22 C:\WINDOWS\tasks\McAfee.com Update Check (OLDER-Josh).job
2007-07-22 14:05:04 C:\WINDOWS\tasks\McAfee.com Update Check (OLDER-Mom).job
2007-07-25 04:01:01 C:\WINDOWS\tasks\McAfee.com Update Check (ONE-Mom).job
2006-05-09 23:29:00 C:\WINDOWS\tasks\WebReg officejet 7300 series.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-25 21:36:59
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-25 21:38:10
C:\ComboFix-quarantined-files.txt … 2007-07-25 21:37

— E O F —

Here also is the document called "Quarantined Files":

2004-08-21 14:51	  0	–a——	C:\Qoobox\Quarantine\C\m.exe.vir
2004-08-21 14:51	  0	–a——	C:\Qoobox\Quarantine\C\p.exe.vir
2004-08-21 14:51	  0	–a——	C:\Qoobox\Quarantine\C\q.exe.vir
2004-08-21 14:51	  0	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system.exe.vir
2007-07-17 08:27	  56320	–a——	C:\Qoobox\Quarantine\C\WINDOWS\b122.exe.vir


Folder PATH listing
Volume serial number is 71FAE346 80F4:F9B8
C:\QOOBOX
\—Quarantine
	+—C
	|   |   m.exe.vir
	|   |   p.exe.vir
	|   |   q.exe.vir
	|   |   
	|   \—WINDOWS
	|		   b122.exe.vir
	|		   system.exe.vir
	|		   
	\—Registry_backups

For the other system, the first log did not appear, and it was only after a second scan that I learned where I could have found it. At any rate, for the second scan, here is the log:

"Josh" - 2007-07-25 23:05:58 [GMT -4:00] - ComboFix 07-07-24.5 - Service Pack 2 NTFS


((((((((((((((((((((((((( Files Created from 2007-06-26 to 2007-07-26 )))))))))))))))))))))))))))))))


2007-07-25 22:26 0 –a—— C:\WINDOWS\system32\sfsync02.dll
2007-07-25 22:11 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-25 13:45 d——– C:\VundoFix Backups
2007-07-25 11:48 0 –a—— C:\WINDOWS\ORUN32.EXE
2007-07-25 11:47 0 –a—— C:\WINDOWS\system32\CMMGR32.EXE
2007-07-25 11:39 d——– C:\Program Files\SUPERAntiSpyware
2007-07-25 11:39 d——– C:\DOCUME~1\Josh\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 11:39 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-24 20:31 d——– C:\Program Files\a-squared Anti-Malware
2007-07-24 17:43 8,576 –a—— C:\WINDOWS\system32\drivers\ldrbytupuwsn.sys
2007-07-24 17:34 d——– C:\WINDOWS\system32\ActiveScan
2007-07-23 16:11 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Symantec
2007-07-23 14:44 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-23 12:40 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-22 22:38 d——– C:\Program Files\Lavasoft
2007-07-22 22:38 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-26 02:51:57 384 —-a-w C:\WINDOWS\system32\DVCStateBkp-{00000005-00000000-00000003-00001102-00000004-20061102}.dat
2007-07-26 02:51:57 384 —-a-w C:\WINDOWS\system32\DVCState-{00000005-00000000-00000003-00001102-00000004-20061102}.dat
2007-07-25 22:05:48 ——– d—–w C:\Program Files\X3watch
2007-07-25 22:02:40 ——– d—–w C:\Program Files\Norton Internet Security
2007-07-25 21:05:47 ——– d—–w C:\Program Files\DellSupport
2007-07-25 21:03:27 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-07-25 15:38:46 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-24 23:32:39 ——– d—–w C:\Program Files\Messenger
2007-06-24 22:09:30 ——– d—–w C:\Program Files\Discovery Multimedia
2007-06-04 19:18:48 9,344 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 19:17:02 8,320 —-a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 19:14:56 6,272 —-a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-22 17:35:29 108,144 —-a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2004-08-10 10:00:00 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-10 10:00:00 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-08-10 10:00:00 1,028,096 –sh–w C:\WINDOWS\system32\mfc42.dll
2004-08-10 10:00:00 413,696 –sh–w C:\WINDOWS\system32\msvcp60.dll
2004-08-10 10:00:00 343,040 –sh–w C:\WINDOWS\system32\msvcrt.dll
2004-08-10 10:00:00 553,472 –sh–w C:\WINDOWS\system32\oleaut32.dll
2004-08-10 10:00:00 83,456 –sh–w C:\WINDOWS\system32\olepro32.dll
2004-08-10 10:00:00 11,776 –sh–w C:\WINDOWS\system32\regsvr32.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-04-25 09:50]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43]
"CTDVDDET"="C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [2003-06-18 02:00]
"CTHelper"="CTHELPER.EXE" [2004-03-11 16:50 C:\WINDOWS\system32\CTHELPER.EXE]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2004-09-14 09:50]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2004-09-14 09:50]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-03-15 16:33]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49]
"LiveUpdate"="C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe" [2004-08-27 21:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-01 02:00]
"x3watch"="C:\Program Files\X3watch\x3watch.exe" [2005-08-13 08:27]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-07-24 20:44]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-07-25 22:59]

C:\Documents and Settings\Josh\Start Menu\Programs\Startup\
Neverwinter Nights Registration.lnk - C:\NeverwinterNights\NWN\ereg\ATR1.EXE [2006-07-05 13:26:21]
Registration-Studio 8.lnk - C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe [2006-04-01 01:47:42]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 2007-07-25 22:59 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

R0 iastor;Intel AHCI Controller;C:\WINDOWS\system32\drivers\iastor.sys
R1 SASDIFSV;SASDIFSV;\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys
R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys
R2 drvnddm;drvnddm;C:\WINDOWS\system32\drivers\drvnddm.sys
R2 dsunidrv;DellSupport UniDriver;C:\WINDOWS\system32\DRIVERS\dsunidrv.sys
R2 ehRecvr;Media Center Receiver Service;C:\WINDOWS\eHome\ehRecvr.exe
R2 ehSched;Media Center Scheduler Service;C:\WINDOWS\eHome\ehSched.exe
R2 tfsnboio;tfsnboio;C:\WINDOWS\system32\dla\tfsnboio.sys
R2 tfsncofs;tfsncofs;C:\WINDOWS\system32\dla\tfsncofs.sys
R2 tfsndrct;tfsndrct;C:\WINDOWS\system32\dla\tfsndrct.sys
R2 tfsndres;tfsndres;C:\WINDOWS\system32\dla\tfsndres.sys
R2 tfsnifs;tfsnifs;C:\WINDOWS\system32\dla\tfsnifs.sys
R2 tfsnopio;tfsnopio;C:\WINDOWS\system32\dla\tfsnopio.sys
R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla\tfsnpool.sys
R2 tfsnudf;tfsnudf;C:\WINDOWS\system32\dla\tfsnudf.sys
R2 tfsnudfa;tfsnudfa;C:\WINDOWS\system32\dla\tfsnudfa.sys
R3 DSproct;DSproct;\??\C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
R3 HidUsb;Microsoft HID Class Driver;C:\WINDOWS\system32\DRIVERS\hidusb.sys
R3 IntelC51;IntelC51;C:\WINDOWS\system32\DRIVERS\IntelC51.sys
R3 IntelC52;IntelC52;C:\WINDOWS\system32\DRIVERS\IntelC52.sys
R3 IntelC53;IntelC53;C:\WINDOWS\system32\DRIVERS\IntelC53.sys
R3 mohfilt;mohfilt;C:\WINDOWS\system32\DRIVERS\mohfilt.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
R3 StillCam;Still Serial Digital Camera Driver;C:\WINDOWS\system32\DRIVERS\serscan.sys
R3 usbccgp;Microsoft USB Generic Parent Driver;C:\WINDOWS\system32\DRIVERS\usbccgp.sys
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver;C:\WINDOWS\system32\DRIVERS\usbehci.sys
R3 usbhub;USB2 Enabled Hub;C:\WINDOWS\system32\DRIVERS\usbhub.sys
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver;C:\WINDOWS\system32\DRIVERS\usbuhci.sys
S2 Fax;Fax;C:\WINDOWS\system32\fxssvc.exe
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter;\??\C:\WINDOWS\system32\drivers\NSDriver.sys
S3 Ad-Watch Real-Time Scanner;AW Real-Time Scanner;\??\C:\WINDOWS\system32\drivers\AWRTPD.sys
S3 Ad-Watch Registry Filter;Ad-Watch Registry Kernel Filter;\??\C:\WINDOWS\system32\drivers\AWRTRD.sys
S3 E100B;Intel® PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys
S3 MHN;MHN;C:\WINDOWS\System32\svchost.exe -k netsvcs
S3 MHNDRV;MHN driver;C:\WINDOWS\system32\DRIVERS\mhndrv.sys
S3 o1394bul;o1394bul;\??\C:\DOCUME~1\Josh\LOCALS~1\Temp\o1394bul.sys
S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM
S3 USBSTOR;USB Mass Storage Driver;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S3 YMIDUSB;YAMAHA Corporation USB MIDI Driver;C:\WINDOWS\system32\Drivers\ymidusb.sys
S4 agpCPQ;Compaq AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\agpCPQ.sys

*Newly Created Service* - SASDIFSV

Contents of the 'Scheduled Tasks' folder
2007-07-20 23:59:59 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Mom.job
2007-07-26 02:38:45 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-25 23:18:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000009a

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-25 23:20:15
C:\ComboFix-quarantined-files.txt … 2007-07-25 23:19

— E O F —

Here also are the "Quarantined Files":

2000-10-27 18:23	  50688	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\BSZIP.DLL.vir
2005-08-10 10:06	  19968	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\sfsync02.sys.vir
2007-07-25 22:27	  1374	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_SFSYNC02.reg.cf
2007-07-25 22:27	  2572	–a——	C:\Qoobox\Quarantine\Registry_backups\services_sfsync02.reg.cf


Folder PATH listing
Volume serial number is 3473-2D85
C:\QOOBOX
\—Quarantine
	+—C
	|   \—WINDOWS
	|	   \—system32
	|		   |   BSZIP.DLL.vir
	|		   |   
	|		   \—drivers
	|				   sfsync02.sys.vir
	|				   
	\—Registry_backups
			LEGACY_SFSYNC02.reg.cf
			services_sfsync02.reg.cf

Your consideration is much appreciated. Please understand my breaking of the no-bumping rule, after all, what do I gain by doing it? I thank you in advance.

Thank you! This issue has been troubling me a great deal.

I have done as you asked. This is the log for the first PC (I can do the other now or later), the one that was hit the hardest:

Josh" - 2007-07-26 19:48:59 [GMT -4:00] - ComboFix 07-07-24.5 - Service Pack 1 NTFS
Command switches used :: C:\Documents and Settings\Josh\Desktop\CFScript.txt
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\q330994.exe
C:\VundoFix Backups
C:\WINDOWS\cvchost.exe
C:\WINDOWS\msstasks.exe
C:\WINDOWS\mssys.com
C:\WINDOWS\mstasks1.exe
C:\WINDOWS\mstaskss.exe
C:\WINDOWS\msxmidi.exe
C:\WINDOWS\ntldr.exe
C:\WINDOWS\ORUN32.EXE
C:\WINDOWS\rocky.exe
C:\WINDOWS\seksdialer.exe
C:\WINDOWS\SYSTEM\system.exe
C:\WINDOWS\SYSTEM\wmscrop.exe
C:\WINDOWS\SYSTEM32\CMMGR32.EXE
C:\WINDOWS\SYSTEM32\d2kpax.dll
C:\WINDOWS\SYSTEM32\d2kpax.exe
C:\WINDOWS\SYSTEM32\jac.dll
C:\WINDOWS\SYSTEM32\msxslab.dll
C:\WINDOWS\wininet32.exe


((((((((((((((((((((((((( Files Created from 2007-06-26 to 2007-07-26 )))))))))))))))))))))))))))))))


2007-07-25 21:23 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-25 17:39 d——– C:\KAV
2007-07-25 17:28 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-07-25 17:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-25 11:30 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 11:29 d——– C:\Program Files\SUPERAntiSpyware
2007-07-25 11:29 d——– C:\DOCUME~1\Josh\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 11:05 d——– C:\Program Files\Security Task Manager
2007-07-25 11:05 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
2007-07-24 21:58 d——– C:\Program Files\a-squared Anti-Malware
2007-07-24 17:19 d——– C:\WINDOWS\SYSTEM32\ActiveScan
2007-07-23 11:45 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-07-23 01:10 d——– C:\Program Files\SpywareBlaster
2007-07-22 18:32 d——– C:\Program Files\ISM


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-26 22:41:00 288 —-a-w C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2007-07-26 22:41:00 288 —-a-w C:\WINDOWS\system32\DVCState-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2007-07-25 20:45:38 ——– d—–w C:\Program Files\X3watch
2007-07-25 20:40:26 ——– d—–w C:\Program Files\QuickTime
2007-07-25 19:46:54 ——– d—–w C:\Program Files\ewido anti-malware
2007-07-25 15:29:31 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-17 17:02:54 ——– d—–w C:\Program Files\Finale 2007
2007-06-27 21:35:29 ——– d—–w C:\Program Files\Guild Wars
2007-06-20 22:55:17 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-20 22:55:15 ——– d—–w C:\DOCUME~1\Josh\APPLIC~1\Musicmatch
2007-06-14 17:11:27 ——– d—–w C:\Program Files\PrintMaster 16
2007-06-03 20:13:43 ——– d—–w C:\DOCUME~1\Josh\APPLIC~1\Command & Conquer 3 Tiberium Wars
2007-06-03 19:57:13 ——– d—–w C:\Program Files\Electronic Arts
2007-05-30 20:27:43 ——– d—–w C:\DOCUME~1\Josh\APPLIC~1\Creative
2007-05-28 15:44:38 108,144 —-a-w C:\WINDOWS\system32\CmdLineExt.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 C:\WINDOWS\BCMSMMSG.exe]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 17:24]
"IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-25 01:00]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-08-24 22:10]
"StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 10:18]
"CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 02:00]
"CTHelper"="CTHELPER.EXE" [2003-02-20 17:45 C:\WINDOWS\SYSTEM32\CTHELPER.EXE]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-06-18 17:10]
"MMTray"="C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe" [2006-01-17 13:03]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 19:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2003-08-27 12:00]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2003-08-21 19:10]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 22:50]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49]
"LiveUpdate"="C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe" [2004-08-27 21:22]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-05 18:14]
"x3watch"="C:\Program Files\X3watch\x3watch.exe" [2005-08-13 08:27]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 10:12]
"@"="" []
"ReminderApp"="C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe" [2006-09-19 15:41]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2006-01-17 13:03]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-07-17 09:49]
"McRegWiz"="c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe" [2003-09-02 16:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"="" []
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2004-03-19 18:34]

C:\Documents and Settings\Josh\Start Menu\Programs\Startup\
DESKTOP.INI [2004-03-20 13:58:38]
Registration-Studio 8.lnk - C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe [2005-04-24 10:38:46]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
DESKTOP.INI [2004-03-20 13:58:38]
Event Planner Reminder.lnk - C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe [2005-08-30 18:18:30]
Event Reminder.lnk - C:\Program Files\PrintMaster 16\pmremind.exe [2004-01-20 04:10:40]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52]
SpySubtract.lnk - C:\Program Files\InterMute\SpySubtract\SpySub.exe [2007-07-23 17:18:07]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= c:\Program Files\InterMute\SpySubtract\sshook.dll [2007-07-23 17:18 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

R0 agpCPQ;Compaq AGP Bus Filter;C:\WINDOWS\System32\DRIVERS\agpCPQ.sys
R0 iaStor;Intel Integrated RAID;C:\WINDOWS\System32\drivers\iaStor.sys
R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
R1 sscdbhk5;sscdbhk5;C:\WINDOWS\System32\drivers\sscdbhk5.sys
R1 ssrtln;ssrtln;C:\WINDOWS\System32\drivers\ssrtln.sys
R2 drvnddm;drvnddm;C:\WINDOWS\System32\drivers\drvnddm.sys
R2 tfsnboio;tfsnboio;C:\WINDOWS\System32\dla\tfsnboio.sys
R2 tfsncofs;tfsncofs;C:\WINDOWS\System32\dla\tfsncofs.sys
R2 tfsndrct;tfsndrct;C:\WINDOWS\System32\dla\tfsndrct.sys
R2 tfsndres;tfsndres;C:\WINDOWS\System32\dla\tfsndres.sys
R2 tfsnifs;tfsnifs;C:\WINDOWS\System32\dla\tfsnifs.sys
R2 tfsnopio;tfsnopio;C:\WINDOWS\System32\dla\tfsnopio.sys
R2 tfsnpool;tfsnpool;C:\WINDOWS\System32\dla\tfsnpool.sys
R2 tfsnudf;tfsnudf;C:\WINDOWS\System32\dla\tfsnudf.sys
R2 tfsnudfa;tfsnudfa;C:\WINDOWS\System32\dla\tfsnudfa.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\System32\DRIVERS\BCMSM.sys
R3 E1000;Intel® PRO/1000 Adapter Driver;C:\WINDOWS\System32\DRIVERS\e1000325.sys
R3 StillCam;Still Serial Digital Camera Driver;C:\WINDOWS\System32\DRIVERS\serscan.sys
S2 Fax;Fax;C:\WINDOWS\system32\fxssvc.exe
S3 bDMusicb;bDMusicb;\??\C:\DOCUME~1\Josh\LOCALS~1\Temp\bDMusicb.sys
S3 Bridge;MAC Bridge;C:\WINDOWS\System32\DRIVERS\bridge.sys
S3 BridgeMP;MAC Bridge Miniport;C:\WINDOWS\System32\DRIVERS\bridge.sys
S3 NaiFiltr;NaiFiltr;C:\WINDOWS\System32\DRIVERS\NaiFiltr.sys
S3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS


Contents of the 'Scheduled Tasks' folder
2007-07-26 21:32:00 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Administrator).job
2007-07-26 21:32:00 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Dad).job
2007-07-26 23:19:01 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Jordan).job
2007-07-26 23:20:00 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Josh).job
2007-07-26 23:19:01 C:\WINDOWS\tasks\McAfee.com Update Check (D5ZWZG41-Mom).job
2007-07-04 13:20:08 C:\WINDOWS\tasks\McAfee.com Update Check (OLDER-Dad).job
2007-06-11 20:50:02 C:\WINDOWS\tasks\McAfee.com Update Check (OLDER-Jordan).job
2007-07-26 21:12:25 C:\WINDOWS\tasks\McAfee.com Update Check (OLDER-Josh).job
2007-07-22 14:05:04 C:\WINDOWS\tasks\McAfee.com Update Check (OLDER-Mom).job
2007-07-26 21:31:08 C:\WINDOWS\tasks\McAfee.com Update Check (ONE-Mom).job
2006-05-09 23:29:00 C:\WINDOWS\tasks\WebReg officejet 7300 series.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-26 20:00:51
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-26 20:01:59
C:\ComboFix-quarantined-files.txt … 2007-07-26 20:01
C:\ComboFix2.txt … 2007-07-25 21:38

— E O F —

I really very much appreciate this.

Actually, the computer is not misbehaving in any apparent way. I was able to put a stop to the popups fairly quickly with Spybot, Adaware, and Hijackthis. The trouble is that positives (in particular "PurityScan," which for all I know may be gone at this point) continue to appear on various scans with other programs. I have run only one scan since yesterday (a-squared), though, as they can take quite a while to complete, and it (as it has done for a while now) comes up clean.

Suspiciously though, on the other system I am still finding mysterious cookies for sites I have not visited, such as "statcounter.com."

At any rate, here is the log for the first PC:

Logfile of HijackThis v1.99.1
Scan saved at 9:00:49 PM, on 7/26/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\X3watch\x3watch.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\EXPLORER.EXE
C:\Documents and Settings\Josh\Local Settings\Temp\Temporary Directory 1 for hijackthis2.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [LiveUpdate] C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: Registration-Studio 8.lnk = C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Event Planner Reminder.lnk = C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\System32\UAService7.exe

I briefly mentioned this earlier, but every time I log on, McAfee Security Center informs me that some components of Activescan are missing or were not installed properly. I suppose I should simply reinstall it later. The same message appears when I try to re-enable Activescan.

Other than that, computer behavior seems normal.

As for the log…

Logfile of HijackThis v1.99.1
Scan saved at 10:24:10 PM, on 7/26/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\wuauclt.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe
C:\Program Files\X3watch\x3watch.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [LiveUpdate] C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: Registration-Studio 8.lnk = C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe
O4 - Global Startup: Event Planner Reminder.lnk = C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\System32\UAService7.exe

All right, all seems well on that one. This has brought me great relief.

As for the other, here is the log:

"Josh" - 2007-07-27 0:16:28 [GMT -4:00] - ComboFix 07-07-24.5 - Service Pack 2 NTFS


((((((((((((((((((((((((( Files Created from 2007-06-27 to 2007-07-27 )))))))))))))))))))))))))))))))


2007-07-25 22:26 0 –a—— C:\WINDOWS\system32\sfsync02.dll
2007-07-25 22:11 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-25 13:45 d——– C:\VundoFix Backups
2007-07-25 11:48 0 –a—— C:\WINDOWS\ORUN32.EXE
2007-07-25 11:47 0 –a—— C:\WINDOWS\system32\CMMGR32.EXE
2007-07-25 11:39 d——– C:\Program Files\SUPERAntiSpyware
2007-07-25 11:39 d——– C:\DOCUME~1\Josh\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 11:39 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-24 20:31 d——– C:\Program Files\a-squared Anti-Malware
2007-07-24 17:43 8,576 –a—— C:\WINDOWS\system32\drivers\ldrbytupuwsn.sys
2007-07-24 17:34 d——– C:\WINDOWS\system32\ActiveScan
2007-07-23 16:11 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Symantec
2007-07-23 14:44 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-23 12:40 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-22 22:38 d——– C:\Program Files\Lavasoft
2007-07-22 22:38 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-27 03:05:59 384 —-a-w C:\WINDOWS\system32\DVCStateBkp-{00000005-00000000-00000003-00001102-00000004-20061102}.dat
2007-07-27 03:05:59 384 —-a-w C:\WINDOWS\system32\DVCState-{00000005-00000000-00000003-00001102-00000004-20061102}.dat
2007-07-26 22:38:31 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-07-25 22:05:48 ——– d—–w C:\Program Files\X3watch
2007-07-25 22:02:40 ——– d—–w C:\Program Files\Norton Internet Security
2007-07-25 21:05:47 ——– d—–w C:\Program Files\DellSupport
2007-07-25 15:38:46 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-24 23:32:39 ——– d—–w C:\Program Files\Messenger
2007-06-24 22:09:30 ——– d—–w C:\Program Files\Discovery Multimedia
2007-06-04 19:18:48 9,344 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 19:17:02 8,320 —-a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 19:14:56 6,272 —-a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-22 17:35:29 108,144 —-a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2004-08-10 10:00:00 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-10 10:00:00 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-08-10 10:00:00 1,028,096 –sh–w C:\WINDOWS\system32\mfc42.dll
2004-08-10 10:00:00 413,696 –sh–w C:\WINDOWS\system32\msvcp60.dll
2004-08-10 10:00:00 343,040 –sh–w C:\WINDOWS\system32\msvcrt.dll
2004-08-10 10:00:00 553,472 –sh–w C:\WINDOWS\system32\oleaut32.dll
2004-08-10 10:00:00 83,456 –sh–w C:\WINDOWS\system32\olepro32.dll
2004-08-10 10:00:00 11,776 –sh–w C:\WINDOWS\system32\regsvr32.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-04-25 09:50]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43]
"CTDVDDET"="C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [2003-06-18 02:00]
"CTHelper"="CTHELPER.EXE" [2004-03-11 16:50 C:\WINDOWS\system32\CTHELPER.EXE]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2004-09-14 09:50]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2004-09-14 09:50]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-03-15 16:33]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49]
"LiveUpdate"="C:\Program Files\Byteswarm\LiveUpdate\LiveUpdate.exe" [2004-08-27 21:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-01 02:00]
"x3watch"="C:\Program Files\X3watch\x3watch.exe" [2005-08-13 08:27]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-07-24 20:44]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-07-25 22:59]

C:\Documents and Settings\Josh\Start Menu\Programs\Startup\
Neverwinter Nights Registration.lnk - C:\NeverwinterNights\NWN\ereg\ATR1.EXE [2006-07-05 13:26:21]
Registration-Studio 8.lnk - C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe [2006-04-01 01:47:42]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 2007-07-25 22:59 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

R0 iastor;Intel AHCI Controller;C:\WINDOWS\system32\drivers\iastor.sys
R1 SASDIFSV;SASDIFSV;\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys
R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys
R2 drvnddm;drvnddm;C:\WINDOWS\system32\drivers\drvnddm.sys
R2 dsunidrv;DellSupport UniDriver;C:\WINDOWS\system32\DRIVERS\dsunidrv.sys
R2 ehRecvr;Media Center Receiver Service;C:\WINDOWS\eHome\ehRecvr.exe
R2 ehSched;Media Center Scheduler Service;C:\WINDOWS\eHome\ehSched.exe
R2 tfsnboio;tfsnboio;C:\WINDOWS\system32\dla\tfsnboio.sys
R2 tfsncofs;tfsncofs;C:\WINDOWS\system32\dla\tfsncofs.sys
R2 tfsndrct;tfsndrct;C:\WINDOWS\system32\dla\tfsndrct.sys
R2 tfsndres;tfsndres;C:\WINDOWS\system32\dla\tfsndres.sys
R2 tfsnifs;tfsnifs;C:\WINDOWS\system32\dla\tfsnifs.sys
R2 tfsnopio;tfsnopio;C:\WINDOWS\system32\dla\tfsnopio.sys
R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla\tfsnpool.sys
R2 tfsnudf;tfsnudf;C:\WINDOWS\system32\dla\tfsnudf.sys
R2 tfsnudfa;tfsnudfa;C:\WINDOWS\system32\dla\tfsnudfa.sys
R3 DSproct;DSproct;\??\C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
R3 HidUsb;Microsoft HID Class Driver;C:\WINDOWS\system32\DRIVERS\hidusb.sys
R3 IntelC51;IntelC51;C:\WINDOWS\system32\DRIVERS\IntelC51.sys
R3 IntelC52;IntelC52;C:\WINDOWS\system32\DRIVERS\IntelC52.sys
R3 IntelC53;IntelC53;C:\WINDOWS\system32\DRIVERS\IntelC53.sys
R3 mohfilt;mohfilt;C:\WINDOWS\system32\DRIVERS\mohfilt.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
R3 StillCam;Still Serial Digital Camera Driver;C:\WINDOWS\system32\DRIVERS\serscan.sys
R3 usbccgp;Microsoft USB Generic Parent Driver;C:\WINDOWS\system32\DRIVERS\usbccgp.sys
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver;C:\WINDOWS\system32\DRIVERS\usbehci.sys
R3 usbhub;USB2 Enabled Hub;C:\WINDOWS\system32\DRIVERS\usbhub.sys
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver;C:\WINDOWS\system32\DRIVERS\usbuhci.sys
S2 Fax;Fax;C:\WINDOWS\system32\fxssvc.exe
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter;\??\C:\WINDOWS\system32\drivers\NSDriver.sys
S3 Ad-Watch Real-Time Scanner;AW Real-Time Scanner;\??\C:\WINDOWS\system32\drivers\AWRTPD.sys
S3 Ad-Watch Registry Filter;Ad-Watch Registry Kernel Filter;\??\C:\WINDOWS\system32\drivers\AWRTRD.sys
S3 E100B;Intel® PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys
S3 MHN;MHN;C:\WINDOWS\System32\svchost.exe -k netsvcs
S3 MHNDRV;MHN driver;C:\WINDOWS\system32\DRIVERS\mhndrv.sys
S3 o1394bul;o1394bul;\??\C:\DOCUME~1\Josh\LOCALS~1\Temp\o1394bul.sys
S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM
S3 USBSTOR;USB Mass Storage Driver;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S3 YMIDUSB;YAMAHA Corporation USB MIDI Driver;C:\WINDOWS\system32\Drivers\ymidusb.sys
S4 agpCPQ;Compaq AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\agpCPQ.sys


Contents of the 'Scheduled Tasks' folder
2007-07-20 23:59:59 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Mom.job
2007-07-27 02:38:34 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-27 00:29:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-27 0:31:06
C:\ComboFix-quarantined-files.txt … 2007-07-27 00:30
C:\ComboFix2.txt … 2007-07-25 23:20

— E O F —