[Resolved] spyware virus pls help remove

hello

downloaded a virus saying i have viueses and i need to download thier software

my desktop screen has been replaced and ny browser tells mehta i have virues

thank you
here is the log from my computor

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:32:32 PM, on 4/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=6080226
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cnn.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {826A5ED9-1316-4EFD-87F8-AA400C5D551A} - C:\WINDOWS\system32\yayaWOEU.dll
O2 - BHO: DVA Media - {88425A92-EB25-4ABA-A863-3380D2C570B7} - C:\WINDOWS\svpekgonwdn.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: stfngdvw - {505968FB-8A4C-4CAB-8EA1-A8D9C0B91DCA} - C:\WINDOWS\stfngdvw.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Intellisync Handheld Launcher] "C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" /logon
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: SetPoint.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - http://symantec.atgnow.com/sdccommon/download/ssrc.cab
O16 - DPF: {01119400-3E00-11D2-8470-0060089874ED} (SupportSoft Listener Control) - http://symantec.atgnow.com/sdccommon/download/sprtctlln.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O20 - Winlogon Notify: yayaWOEU - C:\WINDOWS\SYSTEM32\yayaWOEU.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 11559 bytes

Hi Scotty,

seeing improvements already!!

here is the combo fix log followed by the hijack this log thx kjd

ComboFix 08-04-03.3 - Kevin 2008-04-03 13:39:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1510 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Kevin\Desktopvirii
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.exe
C:\Program Files\Inet Delivery
C:\Program Files\Inet Delivery\inetdl.exe
C:\Program Files\Inet Delivery\intdel.exe
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
C:\Program Files\MyWebSearch\bar\Settings\settings.dat
C:\WINDOWS\a.bat
C:\WINDOWS\base64.tmp
C:\WINDOWS\bdn.com
C:\WINDOWS\dwltqnmx.exe
C:\WINDOWS\fkdnrwsv.dll
C:\WINDOWS\FVProtect.exe
C:\WINDOWS\iTunesMusic.exe
C:\WINDOWS\mslagent
C:\WINDOWS\mslagent\2_mslagent.dll
C:\WINDOWS\mslagent\mslagent.exe
C:\WINDOWS\mslagent\uninstall.exe
C:\WINDOWS\mssecu.exe
C:\WINDOWS\stfngdvw.dll
C:\WINDOWS\svpekgonwdn.dll
C:\WINDOWS\sxfnewqb.dll
C:\WINDOWS\system32\yayaWOEU.dll
C:\WINDOWS\system32akttzn.exe
C:\WINDOWS\system32anticipator.dll
C:\WINDOWS\system32awtoolb.dll
C:\WINDOWS\system32bdn.com
C:\WINDOWS\system32bsva-egihsg52.exe
C:\WINDOWS\system32dpcproxy.exe
C:\WINDOWS\system32emesx.dll
C:\WINDOWS\system32h@tkeysh@@k.dll
C:\WINDOWS\system32hoproxy.dll
C:\WINDOWS\system32hxiwlgpm.dat
C:\WINDOWS\system32hxiwlgpm.exe
C:\WINDOWS\system32medup012.dll
C:\WINDOWS\system32medup020.dll
C:\WINDOWS\system32msgp.exe
C:\WINDOWS\system32msnbho.dll
C:\WINDOWS\system32mssecu.exe
C:\WINDOWS\system32msvchost.exe
C:\WINDOWS\system32mtr2.exe
C:\WINDOWS\system32mwin32.exe
C:\WINDOWS\system32netode.exe
C:\WINDOWS\system32newsd32.exe
C:\WINDOWS\system32ps1.exe
C:\WINDOWS\system32psof1.exe
C:\WINDOWS\system32psoft1.exe
C:\WINDOWS\system32regc64.dll
C:\WINDOWS\system32regm64.dll
C:\WINDOWS\system32Rundl1.exe
C:\WINDOWS\system32smp
C:\WINDOWS\system32smp\msrc.exe
C:\WINDOWS\system32sncntr.exe
C:\WINDOWS\system32ssurf022.dll
C:\WINDOWS\system32ssvchost.com
C:\WINDOWS\system32ssvchost.exe
C:\WINDOWS\system32sysreq.exe
C:\WINDOWS\system32taack.dat
C:\WINDOWS\system32taack.exe
C:\WINDOWS\system32temp#01.exe
C:\WINDOWS\system32thun.dll
C:\WINDOWS\system32thun32.dll
C:\WINDOWS\system32VBIEWER.OCX
C:\WINDOWS\system32vbsys2.dll
C:\WINDOWS\system32vcatchpi.dll
C:\WINDOWS\system32winlogonpc.exe
C:\WINDOWS\system32winsystem.exe
C:\WINDOWS\system32WINWGPX.EXE
C:\WINDOWS\userconfig9x.dll
C:\WINDOWS\Web\def.htm
C:\WINDOWS\winsystem.exe
C:\WINDOWS\zip1.tmp
C:\WINDOWS\zip2.tmp
C:\WINDOWS\zip3.tmp
C:\WINDOWS\zipped.tmp

.
((((((((((((((((((((((((( Files Created from 2008-03-03 to 2008-04-03 )))))))))))))))))))))))))))))))
.

2008-04-02 17:31 . 2008-04-02 17:31 d——– C:\Program Files\Trend Micro
2008-04-02 16:28 . 2008-04-02 16:42 d——– C:\Documents and Settings\All Users\Application Data\wjmdqdif
2008-04-02 16:28 . 2008-04-02 16:28 114,688 –a—— C:\WINDOWS\system32\exwjutkf.exe
2008-03-30 13:00 . 2008-03-30 13:00 d——– C:\Documents and Settings\Kevin\Application Data\CyberLink
2008-03-19 11:58 . 2008-03-19 11:58 d——– C:\Program Files\ABBYY FineReader 5.0 Sprint
2008-03-19 11:57 . 2008-03-19 11:57 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-03-19 11:56 . 2003-09-23 00:42 303,104 –a—— C:\WINDOWS\system32\LEXBCES.EXE
2008-03-19 11:56 . 2003-09-23 00:55 286,720 –a—— C:\WINDOWS\system32\lxbfcomm.dll
2008-03-19 11:56 . 2003-09-23 00:36 201,216 –a—— C:\WINDOWS\system32\LEXP2P32.DLL
2008-03-19 11:56 . 2003-09-23 00:45 196,096 –a—— C:\WINDOWS\system32\LEX2KUSB.DLL
2008-03-19 11:56 . 2003-09-23 00:37 192,512 –a—— C:\WINDOWS\system32\lexlmpm.dll
2008-03-19 11:56 . 2003-09-23 00:37 174,592 –a—— C:\WINDOWS\system32\LEXPPS.EXE
2008-03-19 11:56 . 2003-09-23 00:39 147,456 –a—— C:\WINDOWS\system32\LEXBCE.DLL
2008-03-19 11:56 . 2003-09-23 00:36 73,728 –a—— C:\WINDOWS\system32\lxbfpwr.dll
2008-03-19 11:56 . 2002-11-13 14:40 40,960 –a—— C:\WINDOWS\system32\lxbfvs.dll
2008-03-19 11:55 . 2008-03-27 16:16 d——– C:\Program Files\Lexmark X6100 Series
2008-03-19 11:16 . 2008-03-19 11:16 d——– C:\Lxk6100
2008-03-08 11:31 . 2001-05-30 04:53 1,044,480 -ra—— C:\WINDOWS\system32\ROBOEX32.DLL
2008-03-07 16:35 . 2004-08-04 00:08 26,496 –a—— C:\WINDOWS\system32\dllcache\usbstor.sys
2008-03-07 12:05 . 2008-03-07 12:05 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-03-07 12:05 . 2008-03-07 12:05 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-03-07 10:55 . 2008-03-07 10:55 d——– C:\Program Files\ABBYY FineReader 6.0
2008-03-07 10:47 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-03-07 10:47 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-03-07 10:46 . 1997-04-08 20:08 299,520 –a—— C:\WINDOWS\uninst.exe
2008-03-07 10:14 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-07 10:14 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-07 10:13 . 2004-08-04 00:08 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-07 10:13 . 2004-08-04 00:08 31,616 –a—— C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-07 02:58 . 2008-03-10 18:17 d——– C:\Program Files\Windows Desktop Search
2008-03-07 02:57 . 2006-09-15 07:36 192,000 ——— C:\WINDOWS\system32\dllcache\offfilt.dll
2008-03-07 02:57 . 2006-09-15 07:36 98,304 ——— C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-03-07 02:57 . 2006-09-15 07:36 29,696 ——— C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-03-07 00:39 . 2008-02-22 03:33 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-03-06 23:28 . 2008-03-06 23:28 d——– C:\Documents and Settings\Kevin\WINDOWS
2008-03-06 23:28 . 2008-03-06 23:28 d——– C:\Documents and Settings\Kevin\viewone
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Sony Corporation
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Share-to-Web Upload Folder
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Roxio
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\PC Tools
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Palo Alto Software Inc
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\OfficeUpdate12
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Netscape
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Microsoft Web Folders
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Leadertech
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Lavasoft
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\IsolatedStorage
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\iPIX
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Intuit
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\InterVideo
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\InterTrust
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Interact Commerce
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Intellisync Desktop
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\iambic
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\HP
2008-03-06 23:18 . 2008-03-08 11:14 d——– C:\Documents and Settings\Kevin\Application Data\Corel
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\AdobeUM
2008-03-06 22:37 . 2008-03-06 22:37 d——– C:\WINDOWS\873D68B3EDE54DFD85ACFFC430FB7EE2.TMP
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\SSI
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Roguescanfix
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Quicken
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Project64 1.6
2008-03-06 22:30 . 2008-03-06 22:31 d——– C:\Program Files\Mplayer
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Microsoft SQL Server
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Microprose
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Eidos Interactive
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Common Files\Palo Alto Software
2008-03-06 22:28 . 2008-03-06 22:28 d——– C:\Documents and Settings\All Users\Application Data\Intuit
2008-03-06 20:12 . 2008-03-06 20:12 d——– C:\usr
2008-03-06 20:12 . 2008-03-06 20:12 d–h—– C:\system.sav
2008-03-06 19:52 . 2008-03-06 22:43 d-a—— C:\SwSetup
2008-03-06 19:52 . 2008-03-06 19:52 d——– C:\spoolerlogs
2008-03-06 19:52 . 2008-03-06 19:52 d——– C:\SIERRA
2008-03-06 19:51 . 2008-03-06 19:52 d——– C:\REALEST
2008-03-06 19:51 . 2008-03-06 19:51 d——– C:\My Download Files
2008-03-06 19:51 . 2008-03-06 19:51 d——– C:\cpqs
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\Windows Update Setup Files
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\VerizonOnline
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\SxsCaPendDel
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\Sun
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\SQLHotfix
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\solcache
2008-03-06 19:42 . 2008-03-06 19:42 d–h—– C:\WINDOWS\PIF
2008-03-06 19:41 . 2008-03-06 19:41 d–h—– C:\WINDOWS\msdownld.tmp
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\Corel
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\Cache
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\BBSTORE
2008-03-06 19:35 . 2008-03-06 19:35 d——– C:\Program Files\Windows Media Connect 2
2008-03-06 19:35 . 2008-03-06 19:35 d——– C:\Program Files\Web Publish
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\TaxMaster
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\TaxEstimator353
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\Spyware Doctor
2008-03-06 19:32 . 2008-03-06 19:34 d——– C:\Program Files\Sony Handheld
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Sony
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\REFN
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Real
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Pocket Tanks
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Netflix
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\MSXML 4.0
2008-03-06 19:32 . 2008-03-08 10:43 d——– C:\Program Files\Microsoft ActiveSync

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-03 18:48 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-03 18:37 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-04-03 18:10 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-31 12:33 3,932 —-a-w C:\Documents and Settings\Kevin\Application Data\LMLayout.dat
2008-03-31 12:33 268 —-a-w C:\Documents and Settings\Kevin\Application Data\LMCPaper.dat
2008-03-19 16:57 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-16 22:06 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-07 23:25 ——— d—–w C:\Program Files\Google
2008-03-07 23:23 ——— d—–w C:\Program Files\Common Files\Adobe
2008-03-07 06:12 ——— d—–w C:\Program Files\Microsoft Works
2008-03-07 05:39 ——— d—–w C:\Program Files\Java
2008-03-07 03:30 ——— d—–w C:\Program Files\CONEXANT
2008-03-07 02:32 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-07 02:32 23,904 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-07 02:32 10,537 —-a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-03-06 23:29 ——— d—–w C:\Program Files\Common Files\Roxio Shared
2008-03-06 23:28 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-03-06 23:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-03-06 23:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-03-04 04:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Dell
2008-03-04 02:53 ——— d—–w C:\Program Files\Norton Internet Security
2008-03-04 02:48 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-04 02:48 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-04 02:48 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-04 02:48 ——— d—–w C:\Program Files\Symantec
2008-02-26 16:38 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-26 16:37 ——— d—–w C:\Program Files\Windows Sidebar
2008-02-26 16:35 ——— d–h–w C:\Documents and Settings\Administrator\Application Data\GTek
2008-02-26 16:35 ——— d—–w C:\Program Files\DellAutomatedPCTuneUp
2008-02-26 16:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Gtek
2008-02-26 16:34 ——— d—–w C:\Program Files\MSECache
2008-02-26 16:32 ——— d—–w C:\Program Files\Dell Support Center
2008-02-26 16:32 ——— d—–w C:\Program Files\Dell
2008-02-26 16:32 ——— d—–w C:\Program Files\CyberLink
2008-02-26 16:32 ——— d—–w C:\Program Files\Common Files\supportsoft
2008-02-26 16:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-26 16:31 ——— d—–w C:\Program Files\Dell Network Assistant
2008-02-26 16:31 ——— d—–w C:\Documents and Settings\All Users\Application Data\SingleClick Systems
2008-02-26 16:29 ——— d—–w C:\Program Files\Microsoft.NET
2008-02-26 16:26 ——— d—–w C:\Program Files\Roxio
2008-02-26 16:26 ——— d—–w C:\Program Files\Common Files\SureThing Shared
2008-02-26 16:26 ——— d—–w C:\Program Files\Common Files\Sonic Shared
2008-02-26 16:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\Sonic
2008-02-26 16:25 ——— d—–w C:\Program Files\Sigmatel
2008-02-26 16:21 ——— d—–w C:\Program Files\WIDCOMM
2008-02-26 16:21 ——— d—–w C:\Program Files\NetWaiting
2008-02-26 16:21 ——— d—–w C:\Program Files\Modem Diagnostic Tool
2008-02-26 16:21 ——— d—–w C:\Program Files\Digital Line Detect
2008-02-26 16:21 ——— d—–w C:\Program Files\Broadcom
2008-02-26 16:21 ——— d—–w C:\Documents and Settings\Administrator\Application Data\InstallShield
2008-02-26 16:20 ——— d—–w C:\Program Files\SetPoint
2008-02-26 16:20 ——— d—–w C:\Program Files\Common Files\Logitech
2008-02-26 16:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 16:20 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Logitech
2008-02-26 16:17 ——— d—–w C:\Program Files\Common Files\Java
2008-02-26 16:16 ——— d—–w C:\Program Files\MSXML 6.0
2008-02-26 16:00 ——— d—–w C:\Program Files\Synaptics
2008-02-26 15:52 7,411 —-a-w C:\WINDOWS\system32\drivers\1028_Dell_VOS_1500.mrk
2008-02-19 19:44 96,432 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-02-19 19:44 41,008 —-a-w C:\WINDOWS\system32\drivers\symndisv.sys
2008-02-19 19:44 38,576 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2008-02-19 19:44 37,424 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-02-19 19:44 31,408 —-a-w C:\WINDOWS\system32\drivers\SymIM.sys
2008-02-19 19:44 22,320 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-02-19 19:44 188,464 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-02-19 19:44 13,616 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-02-19 19:44 13,021 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2008-02-19 19:44 1,612 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2004-07-27 15:41 632 —-a-w C:\Program Files\Shortcut to TaxEstimator35.lnk
2002-01-18 14:52 3,932 —-a-w C:\Documents and Settings\LocalService\Application Data\LMLayout.dat
2006-07-27 00:37 56 –sha-r C:\WINDOWS\system32\CB5678212A.sys
2006-11-01 15:11 1,786 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2008-01-07 12:47 316784 –a—— C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-03-03 21:47 116088 –a—— C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2008-01-07 12:47 316784]
"{505968FB-8A4C-4CAB-8EA1-A8D9C0B91DCA}"= "C:\WINDOWS\stfngdvw.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CLASSES_ROOT\clsid\{505968fb-8a4c-4cab-8ea1-a8d9c0b91dca}]
[HKEY_CLASSES_ROOT\stfngdvw.1]
[HKEY_CLASSES_ROOT\TypeLib\{4C528A01-4096-41F4-B410-E4CC5514BD88}]
[HKEY_CLASSES_ROOT\stfngdvw]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 15:20 851968]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-01-29 16:14 8491008]
"nwiz"="nwiz.exe" [2008-01-29 16:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2008-01-29 16:14 86016 C:\WINDOWS\system32\nvhotkey.dll]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-01-29 16:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Logitech Hardware Abstraction Layer"="C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2007-10-09 09:09 100888]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 04:10 1392640]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-05-14 15:23 1191936]
"SigmatelSysTrayApp"="stsystra.exe" [2007-06-06 16:28 405504 C:\WINDOWS\stsystra.exe]
"KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 15:05 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 10:00 1116920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-11-01 16:39 189736]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 12:01 51048]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2008-01-07 12:49 714608]
"Intellisync Handheld Launcher"="C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" [2006-12-18 01:49 1558224]
"CARPService"="carpserv.exe" [2003-05-21 15:35 4608 C:\WINDOWS\system32\carpserv.exe]
"LMPDPSRV"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE" [2002-07-11 14:31 45056]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [ ]
"srmclean"="C:\Cpqs\Scom\srmclean.exe" [2001-07-24 16:34 36864]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [ ]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-10-09 09:09 100888 C:\WINDOWS\KHALMNPR.Exe]
"Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 01:01 57344]

C:\Documents and Settings\Kevin\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-03-09 12:22:59 256000]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-05-17 16:43:18 568176]
Dell Network Assistant.lnk - C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2008-02-26 11:31:14 7168]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-02-26 11:21:18 50688]
HotSync Manager.lnk - C:\Program Files\Sony Handheld\HOTSYNC.EXE [2002-08-09 15:36:20 299008]
Lexmark X125 Settings Utility.lnk - C:\Program Files\Lexmark X125\LEX125SU.exe [2006-06-10 11:49:53 1810432]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-02-26 11:20:23 679936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayaWOEU]
yayaWOEU.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"C:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC

R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 11:35]
R2 datunidr;DellAutomatedPCTuneUp UniDriver;C:\WINDOWS\system32\DRIVERS\datunidr.sys [2007-08-23 19:29]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 19:56]
R3 DXEC02;DXEC02;C:\WINDOWS\system32\drivers\dxec02.sys [2006-11-02 13:31]
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-19 14:44]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]
S3 DellAMBrokerService;DellAMBrokerService;"C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe" [2007-10-11 10:49]
S3 LLUSBFLT;LLUSBFLT;C:\WINDOWS\system32\drivers\llusbflt.sys [2005-08-03 16:59]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc2.sys [2005-08-03 16:59]
S3 PTproct;PTproct;C:\Program Files\DellAutomatedPCTuneUp\GTAction\triggers\PTproct.sys [2006-10-05 17:07]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-19 14:44]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-03-11 01:55:41 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Kevin.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-03 13:48:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\DLAAPI_W.DLL
.
———————— Other Running Processes ————————
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2008-04-03 13:52:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-03 18:52:09
Pre-Run: 90,519,089,152 bytes free
Post-Run: 90,615,709,696 bytes free
.
2008-03-14 16:21:44 — E O F —



hi jack log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:53, on 2008-04-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cnn.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: stfngdvw - {505968FB-8A4C-4CAB-8EA1-A8D9C0B91DCA} - C:\WINDOWS\stfngdvw.dll (file missing)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Intellisync Handheld Launcher] "C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" /logon
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: SetPoint.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - http://symantec.atgnow.com/sdccommon/download/ssrc.cab
O16 - DPF: {01119400-3E00-11D2-8470-0060089874ED} (SupportSoft Listener Control) - http://symantec.atgnow.com/sdccommon/download/sprtctlln.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O20 - Winlogon Notify: yayaWOEU - yayaWOEU.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 11250 bytes

here are the logs you asked for thx kjd

ComboFix 08-04-03.3 - Kevin 2008-04-04 15:51:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1539 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kevin\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\exwjutkf.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\wjmdqdif
C:\WINDOWS\system32\exwjutkf.exe

.
((((((((((((((((((((((((( Files Created from 2008-03-04 to 2008-04-04 )))))))))))))))))))))))))))))))
.

2008-04-02 17:31 . 2008-04-02 17:31 d——– C:\Program Files\Trend Micro
2008-03-30 13:00 . 2008-03-30 13:00 d——– C:\Documents and Settings\Kevin\Application Data\CyberLink
2008-03-19 11:58 . 2008-03-19 11:58 d——– C:\Program Files\ABBYY FineReader 5.0 Sprint
2008-03-19 11:57 . 2008-03-19 11:57 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-03-19 11:56 . 2003-09-23 00:42 303,104 –a—— C:\WINDOWS\system32\LEXBCES.EXE
2008-03-19 11:56 . 2003-09-23 00:55 286,720 –a—— C:\WINDOWS\system32\lxbfcomm.dll
2008-03-19 11:56 . 2003-09-23 00:36 201,216 –a—— C:\WINDOWS\system32\LEXP2P32.DLL
2008-03-19 11:56 . 2003-09-23 00:45 196,096 –a—— C:\WINDOWS\system32\LEX2KUSB.DLL
2008-03-19 11:56 . 2003-09-23 00:37 192,512 –a—— C:\WINDOWS\system32\lexlmpm.dll
2008-03-19 11:56 . 2003-09-23 00:37 174,592 –a—— C:\WINDOWS\system32\LEXPPS.EXE
2008-03-19 11:56 . 2003-09-23 00:39 147,456 –a—— C:\WINDOWS\system32\LEXBCE.DLL
2008-03-19 11:56 . 2003-09-23 00:36 73,728 –a—— C:\WINDOWS\system32\lxbfpwr.dll
2008-03-19 11:56 . 2002-11-13 14:40 40,960 –a—— C:\WINDOWS\system32\lxbfvs.dll
2008-03-19 11:55 . 2008-03-27 16:16 d——– C:\Program Files\Lexmark X6100 Series
2008-03-19 11:16 . 2008-03-19 11:16 d——– C:\Lxk6100
2008-03-08 11:31 . 2001-05-30 04:53 1,044,480 -ra—— C:\WINDOWS\system32\ROBOEX32.DLL
2008-03-07 16:35 . 2004-08-04 00:08 26,496 –a—— C:\WINDOWS\system32\dllcache\usbstor.sys
2008-03-07 12:05 . 2008-03-07 12:05 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-03-07 12:05 . 2008-03-07 12:05 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-03-07 10:55 . 2008-03-07 10:55 d——– C:\Program Files\ABBYY FineReader 6.0
2008-03-07 10:47 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-03-07 10:47 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-03-07 10:46 . 1997-04-08 20:08 299,520 –a—— C:\WINDOWS\uninst.exe
2008-03-07 10:14 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-07 10:14 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-07 10:13 . 2004-08-04 00:08 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-07 10:13 . 2004-08-04 00:08 31,616 –a—— C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-07 02:58 . 2008-03-10 18:17 d——– C:\Program Files\Windows Desktop Search
2008-03-07 02:57 . 2006-09-15 07:36 192,000 ——— C:\WINDOWS\system32\dllcache\offfilt.dll
2008-03-07 02:57 . 2006-09-15 07:36 98,304 ——— C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-03-07 02:57 . 2006-09-15 07:36 29,696 ——— C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-03-07 00:39 . 2008-02-22 03:33 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-03-06 23:28 . 2008-03-06 23:28 d——– C:\Documents and Settings\Kevin\WINDOWS
2008-03-06 23:28 . 2008-03-06 23:28 d——– C:\Documents and Settings\Kevin\viewone
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Sony Corporation
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Share-to-Web Upload Folder
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Roxio
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\PC Tools
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Palo Alto Software Inc
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\OfficeUpdate12
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Netscape
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Microsoft Web Folders
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Leadertech
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Lavasoft
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\IsolatedStorage
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\iPIX
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Intuit
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\InterVideo
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\InterTrust
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Interact Commerce
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Intellisync Desktop
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\iambic
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\HP
2008-03-06 23:18 . 2008-03-08 11:14 d——– C:\Documents and Settings\Kevin\Application Data\Corel
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\AdobeUM
2008-03-06 22:37 . 2008-03-06 22:37 d——– C:\WINDOWS\873D68B3EDE54DFD85ACFFC430FB7EE2.TMP
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\SSI
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Roguescanfix
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Quicken
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Project64 1.6
2008-03-06 22:30 . 2008-03-06 22:31 d——– C:\Program Files\Mplayer
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Microsoft SQL Server
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Microprose
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Eidos Interactive
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Common Files\Palo Alto Software
2008-03-06 22:28 . 2008-03-06 22:28 d——– C:\Documents and Settings\All Users\Application Data\Intuit
2008-03-06 20:12 . 2008-03-06 20:12 d——– C:\usr
2008-03-06 20:12 . 2008-03-06 20:12 d–h—– C:\system.sav
2008-03-06 19:52 . 2008-03-06 22:43 d-a—— C:\SwSetup
2008-03-06 19:52 . 2008-03-06 19:52 d——– C:\spoolerlogs
2008-03-06 19:52 . 2008-03-06 19:52 d——– C:\SIERRA
2008-03-06 19:51 . 2008-03-06 19:52 d——– C:\REALEST
2008-03-06 19:51 . 2008-03-06 19:51 d——– C:\My Download Files
2008-03-06 19:51 . 2008-03-06 19:51 d——– C:\cpqs
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\Windows Update Setup Files
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\VerizonOnline
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\SxsCaPendDel
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\Sun
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\SQLHotfix
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\solcache
2008-03-06 19:42 . 2008-03-06 19:42 d–h—– C:\WINDOWS\PIF
2008-03-06 19:41 . 2008-03-06 19:41 d–h—– C:\WINDOWS\msdownld.tmp
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\Corel
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\Cache
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\BBSTORE
2008-03-06 19:35 . 2008-03-06 19:35 d——– C:\Program Files\Windows Media Connect 2
2008-03-06 19:35 . 2008-03-06 19:35 d——– C:\Program Files\Web Publish
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\TaxMaster
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\TaxEstimator353
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\Spyware Doctor
2008-03-06 19:32 . 2008-03-06 19:34 d——– C:\Program Files\Sony Handheld
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Sony
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\REFN
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Real
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Pocket Tanks
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Netflix
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\MSXML 4.0
2008-03-06 19:32 . 2008-03-08 10:43 d——– C:\Program Files\Microsoft ActiveSync
2008-03-06 19:31 . 2008-03-06 19:32 d——– C:\Program Files\Lexmark X125
2008-03-06 19:31 . 2008-03-06 19:31 d——– C:\Program Files\LexarMedia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-04 20:53 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-04-04 19:46 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-03 18:48 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-31 12:33 3,932 —-a-w C:\Documents and Settings\Kevin\Application Data\LMLayout.dat
2008-03-31 12:33 268 —-a-w C:\Documents and Settings\Kevin\Application Data\LMCPaper.dat
2008-03-19 16:57 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-16 22:06 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-07 23:25 ——— d—–w C:\Program Files\Google
2008-03-07 23:23 ——— d—–w C:\Program Files\Common Files\Adobe
2008-03-07 06:12 ——— d—–w C:\Program Files\Microsoft Works
2008-03-07 05:39 ——— d—–w C:\Program Files\Java
2008-03-07 04:19 ——— d—–w C:\Documents and Settings\Kevin\Application Data\Symantec
2008-03-07 03:30 ——— d—–w C:\Program Files\CONEXANT
2008-03-07 02:32 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-07 02:32 23,904 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-07 02:32 10,537 —-a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-03-06 23:29 ——— d—–w C:\Program Files\Common Files\Roxio Shared
2008-03-06 23:28 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-03-06 23:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-03-06 23:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-03-05 03:23 ——— d–h–w C:\Documents and Settings\Kevin\Application Data\GTek
2008-03-04 04:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Dell
2008-03-04 03:44 ——— d—–w C:\Documents and Settings\Kevin\Application Data\Spearit
2008-03-04 03:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spearit
2008-03-04 03:44 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Spearit
2008-03-04 03:43 ——— d—–w C:\Program Files\Laplink
2008-03-04 03:43 ——— d—–w C:\Program Files\Common Files\Laplink
2008-03-04 02:53 ——— d—–w C:\Program Files\Norton Internet Security
2008-03-04 02:48 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-04 02:48 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-04 02:48 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-04 02:48 ——— d—–w C:\Program Files\Symantec
2008-03-04 02:29 ——— d—–w C:\Documents and Settings\Kevin\Application Data\Dell
2008-02-26 16:38 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-26 16:37 ——— d—–w C:\Program Files\Windows Sidebar
2008-02-26 16:35 ——— d–h–w C:\Documents and Settings\Administrator\Application Data\GTek
2008-02-26 16:35 ——— d—–w C:\Program Files\DellAutomatedPCTuneUp
2008-02-26 16:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Gtek
2008-02-26 16:34 ——— d—–w C:\Program Files\MSECache
2008-02-26 16:32 ——— d—–w C:\Program Files\Dell Support Center
2008-02-26 16:32 ——— d—–w C:\Program Files\Dell
2008-02-26 16:32 ——— d—–w C:\Program Files\CyberLink
2008-02-26 16:32 ——— d—–w C:\Program Files\Common Files\supportsoft
2008-02-26 16:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-26 16:31 ——— d—–w C:\Program Files\Dell Network Assistant
2008-02-26 16:31 ——— d—–w C:\Documents and Settings\All Users\Application Data\SingleClick Systems
2008-02-26 16:29 ——— d—–w C:\Program Files\Microsoft.NET
2008-02-26 16:26 ——— d—–w C:\Program Files\Roxio
2008-02-26 16:26 ——— d—–w C:\Program Files\Common Files\SureThing Shared
2008-02-26 16:26 ——— d—–w C:\Program Files\Common Files\Sonic Shared
2008-02-26 16:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\Sonic
2008-02-26 16:25 ——— d—–w C:\Program Files\Sigmatel
2008-02-26 16:21 ——— d—–w C:\Program Files\WIDCOMM
2008-02-26 16:21 ——— d—–w C:\Program Files\NetWaiting
2008-02-26 16:21 ——— d—–w C:\Program Files\Modem Diagnostic Tool
2008-02-26 16:21 ——— d—–w C:\Program Files\Digital Line Detect
2008-02-26 16:21 ——— d—–w C:\Program Files\Broadcom
2008-02-26 16:21 ——— d—–w C:\Documents and Settings\Kevin\Application Data\InstallShield
2008-02-26 16:21 ——— d—–w C:\Documents and Settings\Administrator\Application Data\InstallShield
2008-02-26 16:20 ——— d—–w C:\Program Files\SetPoint
2008-02-26 16:20 ——— d—–w C:\Program Files\Common Files\Logitech
2008-02-26 16:20 ——— d—–w C:\Documents and Settings\Kevin\Application Data\Logitech
2008-02-26 16:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 16:20 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Logitech
2008-02-26 16:17 ——— d—–w C:\Program Files\Common Files\Java
2008-02-26 16:16 ——— d—–w C:\Program Files\MSXML 6.0
2008-02-26 16:00 ——— d—–w C:\Program Files\Synaptics
2008-02-26 15:52 7,411 —-a-w C:\WINDOWS\system32\drivers\1028_Dell_VOS_1500.mrk
2008-02-19 19:44 96,432 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-02-19 19:44 41,008 —-a-w C:\WINDOWS\system32\drivers\symndisv.sys
2008-02-19 19:44 38,576 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2008-02-19 19:44 37,424 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-02-19 19:44 31,408 —-a-w C:\WINDOWS\system32\drivers\SymIM.sys
2008-02-19 19:44 22,320 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-02-19 19:44 188,464 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-02-19 19:44 13,616 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-02-19 19:44 13,021 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2008-02-19 19:44 1,612 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2004-07-27 15:41 632 —-a-w C:\Program Files\Shortcut to TaxEstimator35.lnk
2002-01-18 14:52 3,932 —-a-w C:\Documents and Settings\LocalService\Application Data\LMLayout.dat
2006-07-27 00:37 56 –sha-r C:\WINDOWS\system32\CB5678212A.sys
2006-11-01 15:11 1,786 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-03_13.51.57.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-02 04:14:46 27,335 —-a-w C:\WINDOWS\system32\nvModes.dat
+ 2008-04-04 20:32:47 27,335 —-a-w C:\WINDOWS\system32\nvModes.dat
- 2008-04-02 22:30:45 54,682 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-03 18:52:19 54,682 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-02 22:30:45 385,164 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-03 18:52:19 385,164 —-a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2008-01-07 12:47 316784 –a—— C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-03-03 21:47 116088 –a—— C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2008-01-07 12:47 316784]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 15:20 851968]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-01-29 16:14 8491008]
"nwiz"="nwiz.exe" [2008-01-29 16:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2008-01-29 16:14 86016 C:\WINDOWS\system32\nvhotkey.dll]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-01-29 16:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Logitech Hardware Abstraction Layer"="C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2007-10-09 09:09 100888]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 04:10 1392640]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-05-14 15:23 1191936]
"SigmatelSysTrayApp"="stsystra.exe" [2007-06-06 16:28 405504 C:\WINDOWS\stsystra.exe]
"KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 15:05 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 10:00 1116920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-11-01 16:39 189736]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 12:01 51048]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2008-01-07 12:49 714608]
"Intellisync Handheld Launcher"="C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" [2006-12-18 01:49 1558224]
"CARPService"="carpserv.exe" [2003-05-21 15:35 4608 C:\WINDOWS\system32\carpserv.exe]
"LMPDPSRV"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE" [2002-07-11 14:31 45056]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [ ]
"srmclean"="C:\Cpqs\Scom\srmclean.exe" [2001-07-24 16:34 36864]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [ ]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-10-09 09:09 100888 C:\WINDOWS\KHALMNPR.Exe]
"Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 01:01 57344]

C:\Documents and Settings\Kevin\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-03-09 12:22:59 256000]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-05-17 16:43:18 568176]
Dell Network Assistant.lnk - C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2008-02-26 11:31:14 7168]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-02-26 11:21:18 50688]
HotSync Manager.lnk - C:\Program Files\Sony Handheld\HOTSYNC.EXE [2002-08-09 15:36:20 299008]
Lexmark X125 Settings Utility.lnk - C:\Program Files\Lexmark X125\LEX125SU.exe [2006-06-10 11:49:53 1810432]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-02-26 11:20:23 679936]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"C:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC

R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 11:35]
R2 datunidr;DellAutomatedPCTuneUp UniDriver;C:\WINDOWS\system32\DRIVERS\datunidr.sys [2007-08-23 19:29]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 19:56]
R3 DXEC02;DXEC02;C:\WINDOWS\system32\drivers\dxec02.sys [2006-11-02 13:31]
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-19 14:44]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]
S3 DellAMBrokerService;DellAMBrokerService;"C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe" [2007-10-11 10:49]
S3 LLUSBFLT;LLUSBFLT;C:\WINDOWS\system32\drivers\llusbflt.sys [2005-08-03 16:59]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc2.sys [2005-08-03 16:59]
S3 PTproct;PTproct;C:\Program Files\DellAutomatedPCTuneUp\GTAction\triggers\PTproct.sys [2006-10-05 17:07]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-19 14:44]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-03-11 01:55:41 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Kevin.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-04 15:55:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\DLAAPI_W.DLL
.
———————— Other Running Processes ————————
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
.
**************************************************************************
.
Completion time: 2008-04-04 15:59:25 - machine was rebooted [Kevin]
ComboFix-quarantined-files.txt 2008-04-04 20:59:21
ComboFix2.txt 2008-04-03 18:52:14
Pre-Run: 90,599,358,464 bytes free
Post-Run: 90,591,084,544 bytes free
.
2008-03-14 16:21:44 — E O F —



——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
2008-04-04 5:55:24 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 4/04/2008
Kaspersky Anti-Virus database records: 682197
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 97520
Number of viruses found: 10
Number of infected objects: 20
Number of suspicious objects: 6
Duration of the scan process: 01:34:20

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\SingleClick Systems\HomeNet Manager\Logs\hnm_svc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\SupportSoft\DellSupportCenter\SYSTEM\state\logs\sprtcmd.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.DAT Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\volatile.DAT Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-04-04_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\Shl_{73C0D44A-16E8-4D16-B67D-DBEBF4F7D458}.ldb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\Shl_{73C0D44A-16E8-4D16-B67D-DBEBF4F7D458}.sds Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\LightningSand.CFD Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\7A052B62.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
C:\Documents and Settings\Kevin\Application Data\Symantec\NPMDataStore\CIMStore.xml Object is locked skipped
C:\Documents and Settings\Kevin\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{A47FC4DA-5DAD-4DDF-BF25-76A8CABC0188}\Microsoft\Outlook Express\CORAL DRIVE.dbx/[From "eBay Member: hutcher2005" <[removed]>][Date Tue, 31 May 2005 12:29:54 -0700]/UNNAMED/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{A47FC4DA-5DAD-4DDF-BF25-76A8CABC0188}\Microsoft\Outlook Express\CORAL DRIVE.dbx/[From "eBay Member: hutcher2005" <[removed]>][Date Tue, 31 May 2005 12:29:54 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{A47FC4DA-5DAD-4DDF-BF25-76A8CABC0188}\Microsoft\Outlook Express\CORAL DRIVE.dbx Mail MS Outlook 5: infected - 2 skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{A47FC4DA-5DAD-4DDF-BF25-76A8CABC0188}\Microsoft\Outlook Express\Sent Items.dbx/[From "Kevin DeFrang" <[removed]>][Date Sun, 16 Jul 2006 12:53:38 -0500]/UNNAMED/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{A47FC4DA-5DAD-4DDF-BF25-76A8CABC0188}\Microsoft\Outlook Express\Sent Items.dbx/[From "Kevin DeFrang" <[removed]>][Date Sun, 16 Jul 2006 12:53:38 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Identities\{A47FC4DA-5DAD-4DDF-BF25-76A8CABC0188}\Microsoft\Outlook Express\Sent Items.dbx Mail MS Outlook 5: suspicious - 2 skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/15 Jan 2008 04:13 to [removed]:Periodic Ac.html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Deleted Items/07 Feb 2008 14:58 to Kevin:HSBC Bank customer service: please up.html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Sent Items/16 Jul 2006 17:53 to yvonne:Fw: * resend * SHIPPING NOTIFICATION.html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/HOUSES/ASOLD TENNANTS/coraldrive/CORAL DRIVE/31 May 2005 21:43 from eBay Member: hutcher2005:Question about p.eml Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Mail MS Mail: infected - 1, suspicious - 3 skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\temp\InstallShieldClean.0001.dir.0000\~efe2.tmp Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\temp\Perflib_Perfdata_1c0.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Kevin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Kevin\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Kevin\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\kaka.exe Infected: Trojan-Dropper.Win32.Small.go skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\dwltqnmx.exe.vir Infected: not-a-virus:AdWare.Win32.Vapsup.dix skipped
C:\QooBox\Quarantine\C\WINDOWS\fkdnrwsv.dll.vir Infected: not-a-virus:AdWare.Win32.Vapsup.dkx skipped
C:\QooBox\Quarantine\C\WINDOWS\stfngdvw.dll.vir Infected: not-a-virus:AdWare.Win32.Vapsup.dkv skipped
C:\QooBox\Quarantine\C\WINDOWS\svpekgonwdn.dll.vir Infected: not-a-virus:AdWare.Win32.Vapsup.dku skipped
C:\QooBox\Quarantine\C\WINDOWS\sxfnewqb.dll.vir Infected: not-a-virus:AdWare.Win32.Vapsup.dkw skipped
C:\QooBox\Quarantine\catchme2008-04-03_134805.53.zip/Documents and Settings/Kevin/Desktop/catchme.zip/yayaWOEU.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.lvo skipped
C:\QooBox\Quarantine\catchme2008-04-03_134805.53.zip/Documents and Settings/Kevin/Desktop/catchme.zip Infected: not-a-virus:AdWare.Win32.Virtumonde.lvo skipped
C:\QooBox\Quarantine\catchme2008-04-03_134805.53.zip ZIP: infected - 2 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP55\A0010820.exe Infected: Trojan.Win32.Agent.dzl skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP57\A0011910.dll Infected: not-a-virus:AdWare.Win32.Vapsup.dkw skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP57\A0011911.dll Infected: not-a-virus:AdWare.Win32.Vapsup.dkx skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP57\A0011912.dll Infected: not-a-virus:AdWare.Win32.Vapsup.dkv skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP57\A0011913.exe Infected: not-a-virus:AdWare.Win32.Vapsup.dix skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP57\A0011914.dll Infected: not-a-virus:AdWare.Win32.Vapsup.dku skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP58\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{3B940371-84B3-4408-A0A2-726378CE566D}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\JETB9E9.tmp Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP58\change.log Object is locked skipped

Scan process completed.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:56:41 PM, on 04/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cnn.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Intellisync Handheld Launcher] "C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" /logon
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: SetPoint.lnk = ?
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - http://symantec.atgnow.com/sdccommon/download/ssrc.cab
O16 - DPF: {01119400-3E00-11D2-8470-0060089874ED} (SupportSoft Listener Control) - http://symantec.atgnow.com/sdccommon/download/sprtctlln.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 10706 bytes

Here you go …thx kjd


ComboFix 08-04-03.3 - Kevin 2008-04-06 14:33:19.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1568 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kevin\Desktop\CFScript.txt.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\kaka.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\kaka.exe

.
((((((((((((((((((((((((( Files Created from 2008-03-06 to 2008-04-06 )))))))))))))))))))))))))))))))
.

2008-04-06 13:57 . 2008-04-06 13:57 d——– C:\Program Files\ViewAhead
2008-04-04 16:06 . 2008-04-04 16:06 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-04-04 16:06 . 2008-04-04 16:06 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-02 17:31 . 2008-04-02 17:31 d——– C:\Program Files\Trend Micro
2008-03-30 13:00 . 2008-03-30 13:00 d——– C:\Documents and Settings\Kevin\Application Data\CyberLink
2008-03-19 11:58 . 2008-04-06 14:01 d——– C:\Program Files\ABBYY FineReader 5.0 Sprint
2008-03-19 11:57 . 2008-03-19 11:57 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-03-19 11:56 . 2003-09-23 00:42 303,104 –a—— C:\WINDOWS\system32\LEXBCES.EXE
2008-03-19 11:56 . 2003-09-23 00:55 286,720 –a—— C:\WINDOWS\system32\lxbfcomm.dll
2008-03-19 11:56 . 2003-09-23 00:36 201,216 –a—— C:\WINDOWS\system32\LEXP2P32.DLL
2008-03-19 11:56 . 2003-09-23 00:45 196,096 –a—— C:\WINDOWS\system32\LEX2KUSB.DLL
2008-03-19 11:56 . 2003-09-23 00:37 192,512 –a—— C:\WINDOWS\system32\lexlmpm.dll
2008-03-19 11:56 . 2003-09-23 00:37 174,592 –a—— C:\WINDOWS\system32\LEXPPS.EXE
2008-03-19 11:56 . 2003-09-23 00:39 147,456 –a—— C:\WINDOWS\system32\LEXBCE.DLL
2008-03-19 11:56 . 2003-09-23 00:36 73,728 –a—— C:\WINDOWS\system32\lxbfpwr.dll
2008-03-19 11:56 . 2002-11-13 14:40 40,960 –a—— C:\WINDOWS\system32\lxbfvs.dll
2008-03-19 11:55 . 2008-03-27 16:16 d——– C:\Program Files\Lexmark X6100 Series
2008-03-19 11:16 . 2008-03-19 11:16 d——– C:\Lxk6100
2008-03-08 11:31 . 2001-05-30 09:53 1,044,480 –a—— C:\WINDOWS\system32\ROBOEX32.DLL
2008-03-07 16:35 . 2004-08-04 00:08 26,496 –a—— C:\WINDOWS\system32\dllcache\usbstor.sys
2008-03-07 12:05 . 2008-03-07 12:05 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-03-07 12:05 . 2008-03-07 12:05 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-03-07 10:55 . 2008-03-07 10:55 d——– C:\Program Files\ABBYY FineReader 6.0
2008-03-07 10:47 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-03-07 10:47 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-03-07 10:46 . 1997-04-08 20:08 299,520 –a—— C:\WINDOWS\uninst.exe
2008-03-07 10:14 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-07 10:14 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-07 10:13 . 2004-08-04 00:08 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-07 10:13 . 2004-08-04 00:08 31,616 –a—— C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-07 02:58 . 2008-03-10 18:17 d——– C:\Program Files\Windows Desktop Search
2008-03-07 02:57 . 2006-09-15 07:36 192,000 ——— C:\WINDOWS\system32\dllcache\offfilt.dll
2008-03-07 02:57 . 2006-09-15 07:36 98,304 ——— C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-03-07 02:57 . 2006-09-15 07:36 29,696 ——— C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-03-07 00:39 . 2008-02-22 03:33 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-03-06 23:28 . 2008-03-06 23:28 d——– C:\Documents and Settings\Kevin\WINDOWS
2008-03-06 23:28 . 2008-03-06 23:28 d——– C:\Documents and Settings\Kevin\viewone
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Sony Corporation
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Share-to-Web Upload Folder
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Roxio
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\PC Tools
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Palo Alto Software Inc
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\OfficeUpdate12
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Netscape
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Microsoft Web Folders
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Leadertech
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Lavasoft
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\IsolatedStorage
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\iPIX
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Intuit
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\InterVideo
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\InterTrust
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Interact Commerce
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\Intellisync Desktop
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\iambic
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\HP
2008-03-06 23:18 . 2008-03-08 11:14 d——– C:\Documents and Settings\Kevin\Application Data\Corel
2008-03-06 23:18 . 2008-03-06 23:18 d——– C:\Documents and Settings\Kevin\Application Data\AdobeUM
2008-03-06 22:37 . 2008-03-06 22:37 d——– C:\WINDOWS\873D68B3EDE54DFD85ACFFC430FB7EE2.TMP
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\SSI
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Roguescanfix
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Quicken
2008-03-06 22:31 . 2008-03-06 22:31 d——– C:\Program Files\Project64 1.6
2008-03-06 22:30 . 2008-03-06 22:31 d——– C:\Program Files\Mplayer
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Microsoft SQL Server
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Microprose
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Eidos Interactive
2008-03-06 22:30 . 2008-03-06 22:30 d——– C:\Program Files\Common Files\Palo Alto Software
2008-03-06 22:28 . 2008-03-06 22:28 d——– C:\Documents and Settings\All Users\Application Data\Intuit
2008-03-06 20:12 . 2008-03-06 20:12 d——– C:\usr
2008-03-06 20:12 . 2008-03-06 20:12 d–h—– C:\system.sav
2008-03-06 19:52 . 2008-03-06 22:43 d-a—— C:\SwSetup
2008-03-06 19:52 . 2008-03-06 19:52 d——– C:\spoolerlogs
2008-03-06 19:52 . 2008-03-06 19:52 d——– C:\SIERRA
2008-03-06 19:51 . 2008-03-06 19:52 d——– C:\REALEST
2008-03-06 19:51 . 2008-03-06 19:51 d——– C:\My Download Files
2008-03-06 19:51 . 2008-03-06 19:51 d——– C:\cpqs
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\Windows Update Setup Files
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\VerizonOnline
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\SxsCaPendDel
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\Sun
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\SQLHotfix
2008-03-06 19:42 . 2008-03-06 19:42 d——– C:\WINDOWS\solcache
2008-03-06 19:42 . 2008-03-06 19:42 d–h—– C:\WINDOWS\PIF
2008-03-06 19:41 . 2008-03-06 19:41 d–h—– C:\WINDOWS\msdownld.tmp
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\Corel
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\Cache
2008-03-06 19:39 . 2008-03-06 19:39 d——– C:\WINDOWS\BBSTORE
2008-03-06 19:35 . 2008-03-06 19:35 d——– C:\Program Files\Windows Media Connect 2
2008-03-06 19:35 . 2008-03-06 19:35 d——– C:\Program Files\Web Publish
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\TaxMaster
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\TaxEstimator353
2008-03-06 19:34 . 2008-03-06 19:34 d——– C:\Program Files\Spyware Doctor
2008-03-06 19:32 . 2008-03-06 19:34 d——– C:\Program Files\Sony Handheld
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Sony
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\REFN
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Real
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Pocket Tanks
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\Netflix
2008-03-06 19:32 . 2008-03-06 19:32 d——– C:\Program Files\MSXML 4.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-06 19:37 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-06 19:18 3,932 —-a-w C:\Documents and Settings\Kevin\Application Data\LMLayout.dat
2008-04-06 19:18 268 —-a-w C:\Documents and Settings\Kevin\Application Data\LMCPaper.dat
2008-04-06 18:57 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-04-06 17:01 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-04-06 17:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-16 22:06 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-07 23:25 ——— d—–w C:\Program Files\Google
2008-03-07 23:23 ——— d—–w C:\Program Files\Common Files\Adobe
2008-03-07 06:12 ——— d—–w C:\Program Files\Microsoft Works
2008-03-07 05:39 ——— d—–w C:\Program Files\Java
2008-03-07 04:19 ——— d—–w C:\Documents and Settings\Kevin\Application Data\Symantec
2008-03-07 03:30 ——— d—–w C:\Program Files\CONEXANT
2008-03-07 02:32 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-07 02:32 23,904 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-07 02:32 10,537 —-a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-03-06 23:29 ——— d—–w C:\Program Files\Common Files\Roxio Shared
2008-03-06 23:28 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-03-06 23:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-03-06 23:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-03-05 03:23 ——— d–h–w C:\Documents and Settings\Kevin\Application Data\GTek
2008-03-04 13:42 ——— d—–w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-03-04 04:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Dell
2008-03-04 03:44 ——— d—–w C:\Documents and Settings\Kevin\Application Data\Spearit
2008-03-04 03:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spearit
2008-03-04 03:44 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Spearit
2008-03-04 03:43 ——— d—–w C:\Program Files\Laplink
2008-03-04 03:43 ——— d—–w C:\Program Files\Common Files\Laplink
2008-03-04 02:53 ——— d—–w C:\Program Files\Norton Internet Security
2008-03-04 02:48 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-04 02:48 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-04 02:48 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-04 02:48 ——— d—–w C:\Program Files\Symantec
2008-03-04 02:29 ——— d—–w C:\Documents and Settings\Kevin\Application Data\Dell
2008-02-26 16:38 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-26 16:37 ——— d—–w C:\Program Files\Windows Sidebar
2008-02-26 16:35 ——— d–h–w C:\Documents and Settings\Administrator\Application Data\GTek
2008-02-26 16:35 ——— d—–w C:\Program Files\DellAutomatedPCTuneUp
2008-02-26 16:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Gtek
2008-02-26 16:34 ——— d—–w C:\Program Files\MSECache
2008-02-26 16:32 ——— d—–w C:\Program Files\Dell Support Center
2008-02-26 16:32 ——— d—–w C:\Program Files\Dell
2008-02-26 16:32 ——— d—–w C:\Program Files\CyberLink
2008-02-26 16:32 ——— d—–w C:\Program Files\Common Files\supportsoft
2008-02-26 16:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-26 16:31 ——— d—–w C:\Program Files\Dell Network Assistant
2008-02-26 16:31 ——— d—–w C:\Documents and Settings\All Users\Application Data\SingleClick Systems
2008-02-26 16:29 ——— d—–w C:\Program Files\Microsoft.NET
2008-02-26 16:26 ——— d—–w C:\Program Files\Roxio
2008-02-26 16:26 ——— d—–w C:\Program Files\Common Files\SureThing Shared
2008-02-26 16:26 ——— d—–w C:\Program Files\Common Files\Sonic Shared
2008-02-26 16:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\Sonic
2008-02-26 16:25 ——— d—–w C:\Program Files\Sigmatel
2008-02-26 16:21 ——— d—–w C:\Program Files\WIDCOMM
2008-02-26 16:21 ——— d—–w C:\Program Files\NetWaiting
2008-02-26 16:21 ——— d—–w C:\Program Files\Modem Diagnostic Tool
2008-02-26 16:21 ——— d—–w C:\Program Files\Digital Line Detect
2008-02-26 16:21 ——— d—–w C:\Program Files\Broadcom
2008-02-26 16:21 ——— d—–w C:\Documents and Settings\Kevin\Application Data\InstallShield
2008-02-26 16:21 ——— d—–w C:\Documents and Settings\Administrator\Application Data\InstallShield
2008-02-26 16:20 ——— d—–w C:\Program Files\SetPoint
2008-02-26 16:20 ——— d—–w C:\Program Files\Common Files\Logitech
2008-02-26 16:20 ——— d—–w C:\Documents and Settings\Kevin\Application Data\Logitech
2008-02-26 16:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 16:20 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Logitech
2008-02-26 16:17 ——— d—–w C:\Program Files\Common Files\Java
2008-02-26 16:16 ——— d—–w C:\Program Files\MSXML 6.0
2008-02-26 16:00 ——— d—–w C:\Program Files\Synaptics
2008-02-26 15:52 7,411 —-a-w C:\WINDOWS\system32\drivers\1028_Dell_VOS_1500.mrk
2008-02-19 19:44 96,432 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-02-19 19:44 41,008 —-a-w C:\WINDOWS\system32\drivers\symndisv.sys
2008-02-19 19:44 38,576 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2008-02-19 19:44 37,424 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-02-19 19:44 31,408 —-a-w C:\WINDOWS\system32\drivers\SymIM.sys
2008-02-19 19:44 22,320 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-02-19 19:44 188,464 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-02-19 19:44 13,616 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-02-19 19:44 13,021 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2008-02-19 19:44 1,612 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2004-07-27 15:41 632 —-a-w C:\Program Files\Shortcut to TaxEstimator35.lnk
2002-01-18 14:52 3,932 —-a-w C:\Documents and Settings\LocalService\Application Data\LMLayout.dat
2006-07-27 00:37 56 –sha-r C:\WINDOWS\system32\CB5678212A.sys
2006-11-01 15:11 1,786 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-03_13.51.57.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-05-24 17:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2002-07-11 14:34:14 77,824 —-a-r C:\WINDOWS\system32\LMBGlay.dll
+ 2002-07-11 19:34:14 77,824 —-a-w C:\WINDOWS\system32\LMBGlay.dll
- 2002-07-11 14:34:02 57,344 —-a-r C:\WINDOWS\system32\LMBGmnt.dll
+ 2002-07-11 19:34:02 57,344 —-a-w C:\WINDOWS\system32\LMBGmnt.dll
- 2002-07-11 14:34:24 57,344 —-a-r C:\WINDOWS\system32\LMBGpapr.dll
+ 2002-07-11 19:34:24 57,344 —-a-w C:\WINDOWS\system32\LMBGpapr.dll
- 2002-07-11 14:34:34 28,672 —-a-r C:\WINDOWS\system32\LMBGqlty.dll
+ 2002-07-11 19:34:34 28,672 —-a-w C:\WINDOWS\system32\LMBGqlty.dll
- 2002-07-11 14:33:20 147,456 —-a-r C:\WINDOWS\system32\LMBGSHEX.DLL
+ 2002-07-11 19:33:20 147,456 —-a-w C:\WINDOWS\system32\LMBGSHEX.DLL
- 2002-07-11 14:34:42 40,960 —-a-r C:\WINDOWS\system32\LMBGsts.dll
+ 2002-07-11 19:34:42 40,960 —-a-w C:\WINDOWS\system32\LMBGsts.dll
- 2002-07-11 14:32:46 32,768 —-a-r C:\WINDOWS\system32\LMGetSt.dll
+ 2002-07-11 19:32:46 32,768 —-a-w C:\WINDOWS\system32\LMGetSt.dll
- 2002-07-11 14:32:04 167,936 —-a-r C:\WINDOWS\system32\LMInkUtl.dll
+ 2002-07-11 19:32:04 167,936 —-a-w C:\WINDOWS\system32\LMInkUtl.dll
- 2002-01-18 07:52:12 3,932 —-a-r C:\WINDOWS\system32\LMLayout.dat
+ 2002-01-18 12:52:12 3,932 —-a-w C:\WINDOWS\system32\LMLayout.dat
- 2002-07-11 14:31:36 81,920 —-a-r C:\WINDOWS\system32\LMLayout.dll
+ 2002-07-11 19:31:36 81,920 —-a-w C:\WINDOWS\system32\LMLayout.dll
- 2002-07-11 14:31:48 65,536 —-a-r C:\WINDOWS\system32\LMPDPMON.DLL
+ 2002-07-11 19:31:48 65,536 —-a-w C:\WINDOWS\system32\LMPDPMON.DLL
- 2002-07-11 14:33:44 98,304 —-a-r C:\WINDOWS\system32\LMPdpStr.DLL
+ 2002-07-11 19:33:44 98,304 —-a-w C:\WINDOWS\system32\LMPdpStr.DLL
- 2002-07-11 14:33:56 53,248 —-a-r C:\WINDOWS\system32\LMPDPUI.exe
+ 2002-07-11 19:33:56 53,248 —-a-w C:\WINDOWS\system32\LMPDPUI.exe
- 2002-05-03 09:59:58 14,508 —-a-r C:\WINDOWS\system32\LXBGUSB.DLL
+ 2002-05-03 14:59:58 14,508 —-a-w C:\WINDOWS\system32\LXBGUSB.DLL
- 2008-04-02 04:14:46 27,335 —-a-w C:\WINDOWS\system32\nvModes.dat
+ 2008-04-06 03:08:36 27,335 —-a-w C:\WINDOWS\system32\nvModes.dat
- 2008-04-02 22:30:45 54,682 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-06 19:16:33 54,682 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-02 22:30:45 385,164 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-06 19:16:33 385,164 —-a-w C:\WINDOWS\system32\perfh009.dat
- 2002-07-11 14:32:40 57,344 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGCc32.dll
+ 2002-07-11 19:32:40 57,344 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGCc32.dll
- 2002-07-11 14:34:14 77,824 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGlay.dll
+ 2002-07-11 19:34:14 77,824 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGlay.dll
- 2002-07-11 14:34:02 57,344 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGmnt.dll
+ 2002-07-11 19:34:02 57,344 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGmnt.dll
- 2002-07-11 14:34:24 57,344 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGpapr.dll
+ 2002-07-11 19:34:24 57,344 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGpapr.dll
- 2002-07-11 14:34:34 28,672 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGqlty.dll
+ 2002-07-11 19:34:34 28,672 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGqlty.dll
- 2002-07-11 14:32:26 1,167,360 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGres.dll
+ 2002-07-11 19:32:26 1,167,360 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGres.dll
- 2002-07-11 14:33:20 147,456 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGSHEX.DLL
+ 2002-07-11 19:33:20 147,456 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGSHEX.DLL
- 2002-07-11 14:34:42 40,960 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGsts.dll
+ 2002-07-11 19:34:42 40,960 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGsts.dll
- 2002-07-11 14:32:46 32,768 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMGetSt.dll
+ 2002-07-11 19:32:46 32,768 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMGetSt.dll
- 2002-07-11 14:32:56 53,248 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMGrxNT.DLL
+ 2002-07-11 19:32:56 53,248 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMGrxNT.DLL
- 2002-07-11 14:32:04 167,936 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMInkUtl.dll
+ 2002-07-11 19:32:04 167,936 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMInkUtl.dll
- 2002-01-18 07:52:12 3,932 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMLayout.dat
+ 2002-01-18 12:52:12 3,932 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMLayout.dat
- 2002-07-11 14:31:36 81,920 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMLayout.dll
+ 2002-07-11 19:31:36 81,920 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMLayout.dll
- 2002-07-11 14:31:48 65,536 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPDPMON.DLL
+ 2002-07-11 19:31:48 65,536 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPDPMON.DLL
- 2002-07-11 14:31:56 45,056 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMpdpsrv.exe
+ 2002-07-11 19:31:56 45,056 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMpdpsrv.exe
- 2002-07-11 14:33:44 98,304 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPdpStr.DLL
+ 2002-07-11 19:33:44 98,304 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPdpStr.DLL
- 2002-07-11 14:33:56 53,248 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPDPUI.exe
+ 2002-07-11 19:33:56 53,248 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPDPUI.exe
- 2002-07-11 14:33:14 176,128 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPriNT.dll
+ 2002-07-11 19:33:14 176,128 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPriNT.dll
- 2002-07-11 14:33:42 143,360 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMUiNT.DLL
+ 2002-07-11 19:33:42 143,360 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMUiNT.DLL
- 2002-02-26 12:48:44 1,667,072 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgclr.dll
+ 2002-02-26 17:48:44 1,667,072 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgclr.dll
- 2002-02-26 12:48:42 57,344 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgfc5c.dll
+ 2002-02-26 17:48:42 57,344 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgfc5c.dll
- 2002-02-26 12:48:46 290,816 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgicur.dll
+ 2002-02-26 17:48:46 290,816 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgicur.dll
- 2002-02-22 08:21:48 86,016 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LXBGMDM.DLL
+ 2002-02-22 13:21:48 86,016 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LXBGMDM.DLL
- 2002-05-03 09:59:58 14,508 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LXBGUSB.DLL
+ 2002-05-03 14:59:58 14,508 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LXBGUSB.DLL
- 2001-05-30 09:53:46 1,044,480 —-a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\ROBOEX32.DLL
+ 2001-05-30 14:53:46 1,044,480 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\ROBOEX32.DLL
- 2002-07-11 14:33:14 176,128 —-a-r C:\WINDOWS\system32\spool\prtprocs\w32x86\LMPriNT.dll
+ 2002-07-11 19:33:14 176,128 —-a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\LMPriNT.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2008-01-07 12:47 316784 –a—— C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-03-03 21:47 116088 –a—— C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2008-01-07 12:47 316784]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 15:20 851968]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-01-29 16:14 8491008]
"nwiz"="nwiz.exe" [2008-01-29 16:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2008-01-29 16:14 86016 C:\WINDOWS\system32\nvhotkey.dll]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-01-29 16:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Logitech Hardware Abstraction Layer"="C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2007-10-09 09:09 100888]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 04:10 1392640]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-05-14 15:23 1191936]
"SigmatelSysTrayApp"="stsystra.exe" [2007-06-06 16:28 405504 C:\WINDOWS\stsystra.exe]
"KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 15:05 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 10:00 1116920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-11-01 16:39 189736]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 12:01 51048]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2008-01-07 12:49 714608]
"Intellisync Handheld Launcher"="C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" [2006-12-18 01:49 1558224]
"CARPService"="carpserv.exe" [2003-05-21 15:35 4608 C:\WINDOWS\system32\carpserv.exe]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [ ]
"srmclean"="C:\Cpqs\Scom\srmclean.exe" [2001-07-24 16:34 36864]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [ ]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-10-09 09:09 100888 C:\WINDOWS\KHALMNPR.Exe]
"Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 01:01 57344]
"LMPDPSRV"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE" [2002-07-11 14:31 45056]

C:\Documents and Settings\Kevin\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-03-09 12:22:59 256000]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-05-17 16:43:18 568176]
Dell Network Assistant.lnk - C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2008-02-26 11:31:14 7168]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-02-26 11:21:18 50688]
HotSync Manager.lnk - C:\Program Files\Sony Handheld\HOTSYNC.EXE [2002-08-09 15:36:20 299008]
Lexmark X125 Settings Utility.lnk - C:\Program Files\Lexmark X125\LEX125SU.exe [2008-04-06 13:56:32 1810432]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-02-26 11:20:23 679936]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"C:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC

R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 11:35]
R2 datunidr;DellAutomatedPCTuneUp UniDriver;C:\WINDOWS\system32\DRIVERS\datunidr.sys [2007-08-23 19:29]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 19:56]
R3 DXEC02;DXEC02;C:\WINDOWS\system32\drivers\dxec02.sys [2006-11-02 13:31]
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-19 14:44]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]
S3 DellAMBrokerService;DellAMBrokerService;"C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe" [2007-10-11 10:49]
S3 LLUSBFLT;LLUSBFLT;C:\WINDOWS\system32\drivers\llusbflt.sys [2005-08-03 16:59]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc2.sys [2005-08-03 16:59]
S3 PTproct;PTproct;C:\Program Files\DellAutomatedPCTuneUp\GTAction\triggers\PTproct.sys [2006-10-05 17:07]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-19 14:44]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-03-11 01:55:41 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Kevin.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-06 14:37:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\DLAAPI_W.DLL
.
———————— Other Running Processes ————————
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
C:\\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2008-04-06 14:41:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-06 19:40:57
ComboFix2.txt 2008-04-04 20:59:25
ComboFix3.txt 2008-04-03 18:52:14
Pre-Run: 90,340,864,000 bytes free
Post-Run: 90,340,364,288 bytes free
.
2008-03-14 16:21:44 — E O F —


Malwarebytes' Anti-Malware 1.10
Database version: 597

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 122329
Time elapsed: 44 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 21
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stfngdvw.bovp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stfngdvw.ToolBar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:48 PM, on 04/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.cnn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cnn.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Intellisync Handheld Launcher] "C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" /logon
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: SetPoint.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - http://symantec.atgnow.com/sdccommon/download/ssrc.cab
O16 - DPF: {01119400-3E00-11D2-8470-0060089874ED} (SupportSoft Listener Control) - http://symantec.atgnow.com/sdccommon/download/sprtctlln.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 11222 bytes