[Closed] Removal of Ads Served by Intelligent advisor

Hi,
i've followed the thread on here: how to remove ads served by intelligent advisor.
i have now pased the contect after completing the HJT scan on my pc - as stated in the thread. your assistance would be much appreciated as i'm not to sure what i should look for - thank you. Stephanie.

Logfile of HijackThis v1.99.1
Scan saved at 19:44:10, on 03/08/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Yahoo!\common\YMailAdvisor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nike+ Utility\Nike+ Utility.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/def…://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sky.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.uk.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def…://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided By Sky Broadband
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: AdvancedTool - {6C4ECE5C-7CB8-36C5-6F3B-D414CE8F8E22} - C:\Program Files\AdvancedTool\AdvancedTool-1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [SiSTray] %ProgramFiles%\SiS VGA Utilities\SiSTray.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\SetApanel.cmd
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [{9775765e-f551-1bd0-c6ed-c1903ea0897a}] C:\Windows\System32\Rundll32.exe "C:\Windows\system32\xfvukwcjujahsf.dll" DllStart
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nike+ Utility.lnk = C:\Program Files\Nike+ Utility\Nike+ Utility.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Hi,
below i have pasted in the most recent scan. the computer still has pop ups from intelligent advisor and these pop up even when the computer isn't connected to the internet. before the results below appeared Hijackthis told me…

For some reason your system denied write access to the host files. if an hijacked domains are in this file, HijacThis may NOT be able to fix this. if this happens you need to edit the file your self to do this click Start, Run and type: notepad"C:\Windows\System32\drivers\etc\hosts"
& then press entre. find the line(s) HijacThis reports and delete them, save the file as "hosts" (with quotes) & reboot.
i tried to do this howere the PC came back and said that no file was able to be found.

antoher message i recieved was:

An unexpected error has occured at prodedure:
Modmain_CheckOther1Item0
Error#75-Path\Fileaccesserror

Please email me at [removed], reporting the following:
What you were trying to fix
how you can reproduce the error
a complete HJT scan log

Windows version: Windows NT6.00.1.1905
MSIE Version: 7.0.6001.1800
HJT Version: 1.99.1

——————————————————————————————
HJT SCAN RESULTS:
——————————————————————————————-
Logfile of HijackThis v1.99.1
Scan saved at 19:44:10, on 03/08/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Yahoo!\common\YMailAdvisor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nike+ Utility\Nike+ Utility.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/def…://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sky.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.uk.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def…://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided By Sky Broadband
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: AdvancedTool - {6C4ECE5C-7CB8-36C5-6F3B-D414CE8F8E22} - C:\Program Files\AdvancedTool\AdvancedTool-1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [SiSTray] %ProgramFiles%\SiS VGA Utilities\SiSTray.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\SetApanel.cmd
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [{9775765e-f551-1bd0-c6ed-c1903ea0897a}] C:\Windows\System32\Rundll32.exe "C:\Windows\system32\xfvukwcjujahsf.dll" DllStart
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nike+ Utility.lnk = C:\Program Files\Nike+ Utility\Nike+ Utility.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Your help and time is appreciated, Stephanie.

Hi,
The ComboFix scan results are:

ComboFix 08-08-16.01 - Lee & Steph 2008-08-17 16:23:48.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.309 [GMT 1:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active

.
Error: Cfiles.dat
Error: Cfolders.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Users\Lee & Steph\AppData\Local\Microsoft\Windows\Temporary Internet Files\e9ffd3a5-1ea9-b4ca-e6f8-cf621ffdd816
C:\Users\Lee & Steph\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp32D3.tmp
C:\Users\Lee & Steph\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp3BD7.tmp
C:\Users\Lee & Steph\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA3CD.tmp
C:\Users\Lee & Steph\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA83F.tmp
C:\Users\Lee & Steph\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB0A8.tmp
C:\Users\Lee & Steph\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB8B3.tmp
C:\Users\Lee & Steph\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpE149.tmp
C:\Users\Lee & Steph\AppData\Roaming\macromedia\Flash Player\#SharedObjects\ZXV9JR3U\interclick.com
C:\Users\Lee & Steph\AppData\Roaming\macromedia\Flash Player\#SharedObjects\ZXV9JR3U\interclick.com\ud.sol
C:\Users\Lee & Steph\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Users\Lee & Steph\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Users\Lee & Steph\AppData\Roaming\Microsoft\Windows\Cookies\lee_&[removed][2].txt
C:\Users\Lee & Steph\AppData\Roaming\Microsoft\Windows\Cookies\lee_&[removed][2].txt
C:\Users\Lee & Steph\AppData\Roaming\Microsoft\Windows\Cookies\lee_&[removed][1].txt
C:\Users\Lee & Steph\AppData\Roaming\Microsoft\Windows\Cookies\lee_&_steph@revsci[1].txt
C:\Users\Lee & Steph\AppData\Roaming\Microsoft\SystemCertificates\My . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2008-07-17 to 2008-08-17 )))))))))))))))))))))))))))))))
.

2008-08-13 16:54 . 2008-07-16 02:32 2,048 –a—— C:\Windows\System32\tzres.dll
2008-08-12 20:12 . 2008-06-19 04:31 361,984 –a—— C:\Windows\System32\IPSECSVC.DLL
2008-08-11 19:31 . 2008-08-11 19:31 d——– C:\PerfLogs
2008-08-03 18:49 . 2008-01-19 08:38 4,595,712 –a—— C:\Windows\System32\AuthFWSnapin.dll
2008-08-03 18:48 . 2008-01-19 08:33 8,139,264 –a—— C:\Windows\System32\ssBranded.scr
2008-08-03 18:47 . 2008-01-19 08:35 3,072,000 –a—— C:\Windows\System32\networkmap.dll
2008-08-03 18:46 . 2008-01-19 08:32 5,714,432 –a—— C:\Windows\System32\logon.scr
2008-08-03 18:45 . 2008-01-19 07:06 8,147,456 –a—— C:\Windows\System32\wmploc.DLL
2008-08-03 18:44 . 2008-01-19 08:33 599,552 –a—— C:\Windows\System32\vsp1cln.exe
2008-08-03 18:44 . 2008-01-05 12:31 145,455 –a—— C:\Windows\System32\perfmon.msc
2008-08-03 18:44 . 2008-01-05 12:22 144,909 –a—— C:\Windows\System32\fsmgmt.msc
2008-08-03 18:44 . 2008-01-05 12:34 15,181 –a—— C:\Windows\System32\gatherWirelessInfo.vbs
2008-08-03 18:44 . 2008-01-05 12:21 12,198 –a—— C:\Windows\System32\gatherWiredInfo.vbs
2008-08-03 18:44 . 2008-01-05 12:39 150 –a—— C:\Windows\System32\RacUREx.xml
2008-08-03 18:44 . 2008-01-05 12:31 3 –a—— C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
2008-08-03 18:43 . 2008-01-19 08:36 357,888 –a—— C:\Windows\System32\wbemcomn.dll
2008-08-03 18:42 . 2008-01-19 08:36 704,512 –a—— C:\Windows\System32\SmiEngine.dll
2008-08-03 18:42 . 2008-01-19 08:34 305,152 –a—— C:\Windows\System32\msdelta.dll
2008-08-03 18:42 . 2008-01-19 08:34 258,560 –a—— C:\Windows\System32\dpx.dll
2008-08-03 18:42 . 2008-01-19 08:34 246,784 –a—— C:\Windows\System32\drvstore.dll
2008-08-03 18:42 . 2008-01-19 08:36 218,624 –a—— C:\Windows\System32\wdscore.dll
2008-08-03 18:42 . 2008-01-19 08:36 139,264 –a—— C:\Windows\System32\SmiInstaller.dll
2008-08-03 18:42 . 2008-01-19 08:33 130,560 –a—— C:\Windows\System32\PkgMgr.exe
2008-08-03 18:42 . 2008-01-19 08:35 35,328 –a—— C:\Windows\System32\mspatcha.dll
2008-08-03 18:18 . 2008-08-03 18:18 d——– C:\Users\Lee & Steph\AppData\Roaming\Malwarebytes
2008-08-03 18:18 . 2008-08-03 18:18 d——– C:\Users\All Users\Malwarebytes
2008-08-03 18:18 . 2008-08-03 18:18 d——– C:\ProgramData\Malwarebytes
2008-08-03 18:18 . 2008-08-03 18:18 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-03 18:18 . 2008-07-30 20:07 38,472 –a—— C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-03 18:18 . 2008-07-30 20:07 17,144 –a—— C:\Windows\System32\drivers\mbam.sys
2008-07-28 22:57 . 2008-07-28 22:57 d——– C:\Program Files\Common Files\Scanner
2008-07-28 22:57 . 2008-07-28 23:00 d——– C:\Program Files\CA Yahoo! Anti-Spy
2008-07-28 22:53 . 2008-07-28 22:53 d——– C:\Users\Lee & Steph\AppData\Roaming\Yahoo!
2008-07-28 21:52 . 2008-07-29 00:09 d-a—— C:\Users\All Users\TEMP
2008-07-28 21:52 . 2008-07-29 00:09 d-a—— C:\ProgramData\TEMP
2008-07-27 02:36 . 2008-07-28 22:08 d——– C:\Program Files\AdvancedTool
2008-07-27 02:13 . 2008-07-27 02:23 64,324 –a—— C:\Windows\System32\gsfucpauuvliuu.exe
2008-07-18 19:46 . 2008-01-19 08:35 4,497,408 –a—— C:\Windows\System32\NlsData0019.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-16 11:23 ——— d—–w C:\Program Files\McAfee
2008-08-13 15:55 ——— d—–w C:\Program Files\Windows Mail
2008-08-11 18:47 174 –sha-w C:\Program Files\desktop.ini
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Sidebar
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Photo Gallery
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Journal
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Defender
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Collaboration
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Calendar
2008-08-11 17:51 82,432 —-a-w C:\Windows\System32\axaltocm.dll
2008-08-11 17:51 101,888 —-a-w C:\Windows\System32\ifxcardm.dll
2008-07-28 21:55 ——— d—–w C:\ProgramData\Yahoo! Companion
2008-07-27 01:46 ——— d—–w C:\Users\Lee & Steph\AppData\Roaming\LimeWire
2008-07-14 18:22 ——— d—–w C:\Program Files\ZyDAS Technology Corporation
2008-07-14 18:21 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-05 17:41 ——— d—–w C:\Program Files\iDump
2008-07-01 19:17 ——— d—–w C:\Program Files\Nike+ Utility
2008-06-27 04:15 827,392 —-a-w C:\Windows\System32\wininet.dll
2008-06-26 03:29 801,280 —-a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 —-a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 —-a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-12 05:28 541,696 —-a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-07 20:05 0 —-a-w C:\Users\Lee & Steph\AppData\Roaming\wklnhst.dat
2008-01-09 22:01 16,384 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-01-09 22:01 32,768 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-01-09 22:01 16,384 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

——- Sigcheck ——-

2008-01-19 08:33 21504 3794b461c45882e06856f282eef025af C:\Windows\System32\svchost.exe
2006-11-02 10:45 22016 10da15933d582d2fedcf705efe394b09 C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6000.16386_none_b38497a50862ad11\svchost.exe
2008-01-19 08:33 21504 3794b461c45882e06856f282eef025af C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe

2008-01-19 08:36 627200 b974d9f06dc7d1908e825dc201681269 C:\Windows\System32\user32.dll
2006-11-02 10:46 633856 e698a5437b89a285aca3ff022356810a C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
2007-09-14 04:16 633856 63b4f59d7c89b1bf5277f1ffefd491cd C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
2007-09-14 04:16 633856 9d9f061eda75425fc67f0365e3467c86 C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
2008-01-19 08:36 627200 b974d9f06dc7d1908e825dc201681269 C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

2008-01-19 08:37 179200 b304d47d5744ba20fcb99fb8b2c07b0b C:\Windows\System32\ws2_32.dll
2006-11-02 10:46 178688 d99a071c1018bb3d4abaad4b62048ac2 C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_6.0.6000.16386_none_f080eec6d16af4f0\ws2_32.dll
2008-01-19 08:37 179200 b304d47d5744ba20fcb99fb8b2c07b0b C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_6.0.6001.18000_none_f2b7b0c2ce5605c4\ws2_32.dll

2008-06-27 05:15 827392 618a51b5fb9dd5810960f6044c0e9289 C:\Windows\System32\wininet.dll
2006-11-02 10:46 822272 214a456aadcc7dd1b36e2287ba71a9ca C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16386_none_ffb23181a4e80112\wininet.dll
2007-12-14 06:22 822784 7dbb98ebb2d267acf9e6bc04aec6cbf3 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16448_none_ffdf73aba4c5c123\wininet.dll
2007-12-14 06:23 822784 9c1c977fa682d428c7133cf29013211b C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16473_none_ffba0275a4e29643\wininet.dll
2008-01-11 20:24 824832 f3b7b70b789056994406377ca8b06829 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16575_none_ffbc04efa4e0c618\wininet.dll
2008-02-13 10:31 824832 0ad9be4f82f0389ec9b8a58f2fd16442 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16609_none_000bb771a4a46504\wininet.dll
2008-02-21 05:43 826368 daeed2799d4d19f955c3e90b22a1e91e C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16643_none_ffda7605a4ca3cbe\wininet.dll
2008-04-25 05:23 826368 9191790bf02a8d759ec2b4e4fa868407 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16681_none_ffad35c1a4ec79d4\wininet.dll
2008-06-27 04:54 826368 e74d932ca7b3da8cdb7a5f11f5a03abc C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16711_none_fff8e71ba4b3b364\wininet.dll
2007-12-14 06:22 823296 1ea5200f3d45efdfc25f630a52ddf9e5 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20547_none_0068102cbde44796\wininet.dll
2007-12-14 06:23 823808 355f1f19daad8f769936752f993ea8bf C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20583_none_0038cf54be0851fe\wininet.dll
2008-01-11 20:24 825344 0683cba27e3111cb87b682ca66475c0c C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20697_none_00320276be0cd072\wininet.dll
2008-02-13 10:31 825344 39fbdec53d5f7c5f4b7c35b9b1926a0f C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20734_none_006fe306bdded9ee\wininet.dll
2008-02-22 05:52 827392 f7ff1e0d443788d6ae4cbca593530099 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20777_none_0047a434bdfc95b7\wininet.dll
2008-04-25 05:09 827392 f40594128a6bfda6c3f0900796895078 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20823_none_0079b48ebdd7a1cd\wininet.dll
2008-06-27 04:49 827904 ae7150c0696c656d02fdd48259f4eff5 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20868_none_00537650bdf39044\wininet.dll
2008-01-19 08:36 825856 455d715a840579bdc1cf8e5c1da76849 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18000_none_01e8f37da1d311e6\wininet.dll
2008-02-22 06:01 826880 482bccbf1fcbb3378100ff97081438c1 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18023_none_01d65483a1e095cd\wininet.dll
2008-04-25 05:35 826880 44fd3968ad885026d94450832a78de8a C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18063_none_01ab14d3a2010591\wininet.dll
2008-06-27 05:15 827392 618a51b5fb9dd5810960f6044c0e9289 C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18099_none_0190a6cba213f16e\wininet.dll
2008-02-22 05:52 826880 4e962b645608e6edb7d31b75921d07fa C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22120_none_025cf070bb00e992\wininet.dll
2008-04-25 05:22 826880 a86218059c228e7691a13e4cb63c4cdf C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22167_none_0238b2c6bb1b0ab7\wininet.dll
2008-06-27 04:50 827904 edf59d63ddbc8be0bb4836efffc04bdc C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22212_none_0269c2d6baf6fd76\wininet.dll

2008-04-26 09:26 891448 82e266bee5f0167e41c6ecfdd2a79c02 C:\Windows\System32\drivers\tcpip.sys
2008-01-19 08:43 891448 fc6e2835d667774d409c7c7021eaf9c4 C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys
2008-04-26 09:26 891448 82e266bee5f0167e41c6ecfdd2a79c02 C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1\tcpip.sys
2008-04-26 09:08 891448 01ec1e92595f839bee70d439c46796e3 C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22167_none_b36dd19b7fae39c7\tcpip.sys
2006-11-02 09:58 802816 d944522b048a5feb7700b5170d3d9423 C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16386_none_5f4ed3e0926e99e4\tcpip.sys
2008-01-11 20:33 802816 028061c7f6d2d03068c72e2a27e4228a C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16567_none_5f6577ce925d75a7\tcpip.sys
2008-02-13 10:34 803328 5df77458aa92fdb36fce79c60f74ab5d C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16627_none_5f90b964923d030a\tcpip.sys
2008-01-11 20:33 804352 43eae40b50fe3e60d194dd9c97ebb1fd C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.20689_none_5fdb7555ab898001\tcpip.sys
2008-02-13 10:34 806400 52a8bd6294f7d1443c6184c67ae13af4 C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.20752_none_5ff4e4f9ab7777f4\tcpip.sys

2008-01-19 08:33 314880 c2610b6bdbefc053bbdab4f1b965cb24 C:\Windows\System32\winlogon.exe
2006-11-02 10:45 308224 9f75392b9128a91abafb044ea350baad C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
2008-01-19 08:33 314880 c2610b6bdbefc053bbdab4f1b965cb24 C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

2008-01-19 08:43 529464 9bdc71790fa08f0a0b5f10462b1bd0b1 C:\Windows\System32\drivers\ndis.sys
2006-11-02 10:51 500840 227c11e1e7cf6ef8afb2a238d209760c C:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.0.6000.16386_none_a59069cb1f23fc44\ndis.sys
2008-01-19 08:43 529464 9bdc71790fa08f0a0b5f10462b1bd0b1 C:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.0.6001.18000_none_a7c72bc71c0f0d18\ndis.sys

2008-04-26 09:25 3600952 6bb1994f5b62fef6268f1ebb4014e293 C:\Windows\System32\ntkrnlpa.exe
2006-11-02 10:51 3502184 cadaa2fcb7f3d18be056a34d84ee2ca1 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16386_none_69f99fa4b7380194\ntkrnlpa.exe
2008-01-13 22:09 3504824 b0315aab99ca2cf6576e68465b3ac554 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntkrnlpa.exe
2008-01-11 20:26 3504824 a676d072ff3967821ec292f5c885a32d C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16551_none_6a1511c2b724295c\ntkrnlpa.exe
2008-01-11 20:23 3504824 7b3de8f172bd5ba3842237088595e0dd C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16575_none_6a037312b730c69a\ntkrnlpa.exe
2008-02-13 10:35 3504696 0be027340c32d14abecda068e45e532a C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934\ntkrnlpa.exe
2008-01-13 22:09 3504824 a59c7ea8f866ba9ebe06cb57f01fa5e1 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntkrnlpa.exe
2008-01-11 20:26 3504824 99ac9f5573f9376970a82d77731be62a C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20670_none_6a880e6bd052e7b1\ntkrnlpa.exe
2008-01-11 20:22 3505848 0bdca5c80ed74ad207eec0535d2af508 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20697_none_6a797099d05cd0f4\ntkrnlpa.exe
2008-02-13 10:35 3505720 4821ab9f49b32cc17887ae861895826e C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20707_none_6adac1cbd013d2a2\ntkrnlpa.exe
2008-01-19 08:43 3600440 fe51e8dbbef2d01ef886499fecbf2d78 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6001.18000_none_6c3061a0b4231268\ntkrnlpa.exe
2008-04-26 09:25 3600952 6bb1994f5b62fef6268f1ebb4014e293 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6001.18063_none_6bf282f6b4510613\ntkrnlpa.exe
2008-04-26 09:11 3601464 68eef02a8846442fe98ad0e0517ee6bc C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6001.22167_none_6c8020e9cd6b0b39\ntkrnlpa.exe

2008-04-26 09:25 3549240 c9cd31b3cba8134f2b47fb5e78376acc C:\Windows\System32\ntoskrnl.exe
2006-11-02 10:51 3467880 883d5b644bfa3dc7298d4731b13af499 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16386_none_69f99fa4b7380194\ntoskrnl.exe
2008-01-13 22:09 3470008 4f2488ec5d0ebfe868f47681bcf315d3 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntoskrnl.exe
2008-01-11 20:26 3471032 0e8f7801d17c7437cee216099b975163 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16551_none_6a1511c2b724295c\ntoskrnl.exe
2008-01-11 20:22 3470520 2d202d94c6d0ec6b1483d2d47016fa0a C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16575_none_6a037312b730c69a\ntoskrnl.exe
2008-02-13 10:35 3470392 a0bf353a68b434f2bbff238feeb51486 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16584_none_69f7a2dcb739c934\ntoskrnl.exe
2008-01-13 22:09 3470520 99b743be7149970eb8d9c48fb0a41bf7 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntoskrnl.exe
2008-01-11 20:26 3471544 9e6991f557248a5e6e742d1081583969 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20670_none_6a880e6bd052e7b1\ntoskrnl.exe
2008-01-11 20:22 3472056 2df67260dd3167402abc14dc11112686 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20697_none_6a797099d05cd0f4\ntoskrnl.exe
2008-02-13 10:35 3471928 b23072ae0fd60a2be57fd48f81ddb5bb C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20707_none_6adac1cbd013d2a2\ntoskrnl.exe
2008-01-19 08:43 3548728 6700f35eba206e5c89ac27c9a124dc01 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6001.18000_none_6c3061a0b4231268\ntoskrnl.exe
2008-04-26 09:25 3549240 c9cd31b3cba8134f2b47fb5e78376acc C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6001.18063_none_6bf282f6b4510613\ntoskrnl.exe
2008-04-26 09:11 3549240 22d444d3d88a4c299894b3638a114bf7 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6001.22167_none_6c8020e9cd6b0b39\ntoskrnl.exe

2008-01-19 08:33 2927104 ffa764631cb70a30065c12ef8e174f9f C:\Windows\explorer.exe
2006-11-02 10:45 2923520 fd8c53fb002217f6f888bcf6f5d7084d C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
2008-01-11 20:35 2923520 6d06cd98d954fe87fb2db8108793b399 C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
2008-01-11 20:35 2923520 bd06f0bf753bc704b653c3a50f89d362 C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
2008-01-19 08:33 2927104 ffa764631cb70a30065c12ef8e174f9f C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

2008-01-19 08:33 279040 2b336ab6286d6c81fa02cbab914e3c6c C:\Windows\System32\services.exe
2006-11-02 10:45 279552 329cf3c97ce4c19375c8abcabae258b0 C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe
2008-01-19 08:33 279040 2b336ab6286d6c81fa02cbab914e3c6c C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe

2008-01-19 08:33 9728 dcf733788c7d088d814e5f80eb4b3e0f C:\Windows\System32\lsass.exe
2006-11-02 10:45 7680 6a0e382e74280e4cc0df17fe2661d003 C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16386_none_a413c8c65fe02762\lsass.exe
2008-01-19 08:33 9728 dcf733788c7d088d814e5f80eb4b3e0f C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18000_none_a64a8ac25ccb3836\lsass.exe

2006-11-02 10:45 8704 22bfd03df51065a9ed8d17f8fb72296b C:\Windows\System32\ctfmon.exe
2006-11-02 10:45 8704 22bfd03df51065a9ed8d17f8fb72296b C:\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.0.6000.16386_none_9af9cad793a67953\ctfmon.exe

2008-01-19 08:33 125952 846cdf9a3cf4da9b306adfb7d55ee4c2 C:\Windows\System32\spoolsv.exe
2006-11-02 10:45 124928 da612ef2556776df2630b68bf2d48935 C:\Windows\winsxs\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.0.6000.16386_none_d414e125c49db442\spoolsv.exe
2008-01-19 08:33 125952 846cdf9a3cf4da9b306adfb7d55ee4c2 C:\Windows\winsxs\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.0.6001.18000_none_d64ba321c188c516\spoolsv.exe

2008-01-19 08:33 43008 8e93cdf0ea8edba63f07e2898a9b2147 C:\Windows\System32\wuauclt.exe
2006-11-02 10:46 41472 ff81090b6ef1a42a19df226632711d25 C:\Windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_6.0.6000.16386_none_acab9aecacae685d\wuauclt.exe
2008-01-10 16:16 53080 f3e9065eb617a7e3a832a7976bfa021b C:\Windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.0.6000.381_none_981d19142bc9942c\wuauclt.exe
2008-01-19 08:33 43008 8e93cdf0ea8edba63f07e2898a9b2147 C:\Windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.0.6001.18000_none_a052d92e34802200\wuauclt.exe

2008-01-19 08:33 25088 0e135526e9785d085bcd9aede6fbcbf9 C:\Windows\System32\userinit.exe
2006-11-02 10:45 24576 22027835939f86c3e47ad8e3fbde3d11 C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
2008-01-19 08:33 25088 0e135526e9785d085bcd9aede6fbcbf9 C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
2008-06-25 18:13 160496 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 08:33 1233920]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 08:36 2153472 C:\Windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="C:\Acer\Empowering Technology\SysMonitor.exe" [2007-06-01 00:35 326440]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-26 00:33 457216]
"PCMMediaSharing"="C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2007-06-22 02:33 204908]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 22:48 57344]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 23:49 151552]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"YMailAdvisor"="C:\Program Files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 23:06 125208]
"Malwarebytes Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-07-30 20:07 1187448]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-20 09:56 4493312 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-06-15 09:45 1826816 C:\Windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 23:49 151552]
"DelayShred"="c:\PROGRA~1\mcafee\mshr\ShrCL.EXE" [2007-12-04 13:32 111904]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 12:44:06 29696]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-09-14 04:38:32 535336]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
Nike+ Utility.lnk - C:\Program Files\Nike+ Utility\Nike+ Utility.exe [2008-04-30 16:33:46 1228800]
ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-07-14 19:22:04 475136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.mkdmp3enc"= C:\PROGRA~1\ACERAR~1\ACERVI~1\Kernel\Burner\MKDMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{70313D0E-2D73-4A56-AFD6-6DE194F07AED}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B56D3BF4-3F81-4B33-85F3-23EB7C3A8D5B}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{19E90D49-E626-40AC-8CC0-B24D5344399A}"= C:\Program Files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{96734FEA-FF44-4EF2-960F-6A020D237C80}"= C:\Program Files\Acer Arcade Live\Acer DV Magician\Acer DV Magician.exe:Acer DV Magician
"{DDA71D86-E87D-43B1-97D0-A0FF5CEDA9E7}"= C:\Program Files\Acer Arcade Live\Acer SlideShow DVD\Acer SlideShow DVD.exe:Acer SlideShow DVD
"{6EED23F9-336D-43A2-8477-17A2BB6F3F15}"= C:\Program Files\Acer Arcade Live\Acer DVDivine\Acer DVDivine.exe:Acer DVDivine
"{B18354C5-FBCC-49BE-9FA1-DCD4CA785D0B}"= C:\Program Files\Acer Arcade Live\Acer VideoMagician\Acer VideoMagician.exe:Acer VideoMagician
"{48C4529A-D0C4-4E7B-A6A5-ACA0E25F22CF}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia\Acer HomeMedia.exe:Acer HomeMedia
"{C3C0593F-EB72-431D-9221-A69405F1AAA9}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect
"{5CA689BC-45A5-4953-A562-BB126BA0CF1A}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:Acer HomeMedia Connect Service
"{79C8CC84-3B2D-4E9A-BA11-E0CF1433E17F}"= UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{D4DDFF20-8C12-4378-A7DE-3F568AB476AC}"= TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{8471463F-3B4F-48C0-91EB-8BF54CB4504B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{89244C0D-A0E3-4090-B217-EBC09689762F}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{0E2DB4E6-9B0E-4D41-9275-DF4C6ACCD605}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{941AE77F-351F-46CE-8FC2-65E8CF1B7324}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{370E513F-53FA-4888-BDEB-0D3ABB19ADA7}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{01C23780-CBD1-4DB8-949E-031832E4584A}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{FF36DDE5-5115-4F6D-96C4-4EF227DF0D9E}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{5B4F0E72-D700-4405-9871-3E11CFF7B8E3}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{1DF41B28-506E-49A3-B105-EFD5566C7FD7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
"C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
"C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption

R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-06-22 02:33]
R3 SiS6350;SiS6350;C:\Windows\system32\DRIVERS\SISGRKMD.sys [2007-06-05 12:08]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSGB6.sys [2007-01-22 09:09]
R3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\Windows\system32\DRIVERS\zd1211Bu.sys [2005-08-17 15:43]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2008-01-06 C:\Windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2008-01-06 C:\Windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Apanel - C:\ACERSW\config\SetApanel.cmd
HKLM-Run-{9775765e-f551-1bd0-c6ed-c1903ea0897a} - C:\Windows\system32\xfvukwcjujahsf.dll
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)


.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.sky.com
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
R0 -: HKLM-Main,Start Page = hxxp://en.uk.acer.yahoo.com
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R1 -: HKCU-SearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
O8 -: E&xport; to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 -: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-17 16:32:19
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Windows\System32\audiodg.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\System32\WUDFHost.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
.
**************************************************************************
.
Completion time: 2008-08-17 16:37:35 - machine was rebooted [Lee & Steph]
ComboFix-quarantined-files.txt 2008-08-17 15:37:11

Pre-Run: 49,985,810,432 bytes free
Post-Run: 49,842,692,096 bytes free

341 — E O F — 2008-08-13 15:55:36

Hi,
Limewire is removwed and should have been removed about 4 weeks ago, but it is definately removed now.
PC is doing alot better - not as frequent pop ups from the intelligent advisor and since connecting i don't think i remember seeing one. i need to log on the pc for longer to ensure that i recieve no more pop ups from IA.

Scan results as followed are:

ComboFix 08-08-18.05 - Lee & Steph 2008-08-19 22:00:27.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.305 [GMT 1:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Users\Lee & Steph\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active


FILE ::
C:\Windows\System32\gsfucpauuvliuu.exe
C:\Windows\system32\xfvukwcjujahsf.dll
.
Error: Cfiles.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Bonjour
C:\Program Files\Bonjour\About Bonjour.rtf
C:\Program Files\Bonjour\mdnsNSP.dll
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\gsfucpauuvliuu.exe

.
((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 )))))))))))))))))))))))))))))))
.

2008-08-13 16:54 . 2008-07-16 02:32 2,048 –a—— C:\Windows\System32\tzres.dll
2008-08-12 20:12 . 2008-06-19 04:31 361,984 –a—— C:\Windows\System32\IPSECSVC.DLL
2008-08-11 19:31 . 2008-08-11 19:31 d——– C:\PerfLogs
2008-08-03 18:49 . 2008-01-19 08:38 4,595,712 –a—— C:\Windows\System32\AuthFWSnapin.dll
2008-08-03 18:48 . 2008-01-19 08:33 8,139,264 –a—— C:\Windows\System32\ssBranded.scr
2008-08-03 18:47 . 2008-01-19 08:35 3,072,000 –a—— C:\Windows\System32\networkmap.dll
2008-08-03 18:46 . 2008-01-19 08:32 5,714,432 –a—— C:\Windows\System32\logon.scr
2008-08-03 18:45 . 2008-01-19 07:06 8,147,456 –a—— C:\Windows\System32\wmploc.DLL
2008-08-03 18:44 . 2008-01-19 08:33 599,552 –a—— C:\Windows\System32\vsp1cln.exe
2008-08-03 18:44 . 2008-01-05 12:31 145,455 –a—— C:\Windows\System32\perfmon.msc
2008-08-03 18:44 . 2008-01-05 12:22 144,909 –a—— C:\Windows\System32\fsmgmt.msc
2008-08-03 18:44 . 2008-01-05 12:34 15,181 –a—— C:\Windows\System32\gatherWirelessInfo.vbs
2008-08-03 18:44 . 2008-01-05 12:21 12,198 –a—— C:\Windows\System32\gatherWiredInfo.vbs
2008-08-03 18:44 . 2008-01-05 12:39 150 –a—— C:\Windows\System32\RacUREx.xml
2008-08-03 18:44 . 2008-01-05 12:31 3 –a—— C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
2008-08-03 18:43 . 2008-01-19 08:36 357,888 –a—— C:\Windows\System32\wbemcomn.dll
2008-08-03 18:42 . 2008-01-19 08:36 704,512 –a—— C:\Windows\System32\SmiEngine.dll
2008-08-03 18:42 . 2008-01-19 08:34 305,152 –a—— C:\Windows\System32\msdelta.dll
2008-08-03 18:42 . 2008-01-19 08:34 258,560 –a—— C:\Windows\System32\dpx.dll
2008-08-03 18:42 . 2008-01-19 08:34 246,784 –a—— C:\Windows\System32\drvstore.dll
2008-08-03 18:42 . 2008-01-19 08:36 218,624 –a—— C:\Windows\System32\wdscore.dll
2008-08-03 18:42 . 2008-01-19 08:36 139,264 –a—— C:\Windows\System32\SmiInstaller.dll
2008-08-03 18:42 . 2008-01-19 08:33 130,560 –a—— C:\Windows\System32\PkgMgr.exe
2008-08-03 18:42 . 2008-01-19 08:35 35,328 –a—— C:\Windows\System32\mspatcha.dll
2008-08-03 18:18 . 2008-08-03 18:18 d——– C:\Users\Lee & Steph\AppData\Roaming\Malwarebytes
2008-08-03 18:18 . 2008-08-03 18:18 d——– C:\Users\All Users\Malwarebytes
2008-08-03 18:18 . 2008-08-03 18:18 d——– C:\ProgramData\Malwarebytes
2008-08-03 18:18 . 2008-08-03 18:18 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-03 18:18 . 2008-07-30 20:07 38,472 –a—— C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-03 18:18 . 2008-07-30 20:07 17,144 –a—— C:\Windows\System32\drivers\mbam.sys
2008-07-28 22:57 . 2008-07-28 22:57 d——– C:\Program Files\Common Files\Scanner
2008-07-28 22:57 . 2008-07-28 23:00 d——– C:\Program Files\CA Yahoo! Anti-Spy
2008-07-28 22:53 . 2008-07-28 22:53 d——– C:\Users\Lee & Steph\AppData\Roaming\Yahoo!
2008-07-28 21:52 . 2008-07-29 00:09 d-a—— C:\Users\All Users\TEMP
2008-07-28 21:52 . 2008-07-29 00:09 d-a—— C:\ProgramData\TEMP
2008-07-27 02:36 . 2008-07-28 22:08 d——– C:\Program Files\AdvancedTool

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-16 11:23 ——— d—–w C:\Program Files\McAfee
2008-08-13 15:55 ——— d—–w C:\Program Files\Windows Mail
2008-08-11 18:47 174 –sha-w C:\Program Files\desktop.ini
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Sidebar
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Photo Gallery
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Journal
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Defender
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Collaboration
2008-08-11 18:38 ——— d—–w C:\Program Files\Windows Calendar
2008-07-28 21:55 ——— d—–w C:\ProgramData\Yahoo! Companion
2008-07-27 01:46 ——— d—–w C:\Users\Lee & Steph\AppData\Roaming\LimeWire
2008-07-14 18:22 ——— d—–w C:\Program Files\ZyDAS Technology Corporation
2008-07-14 18:21 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-05 17:41 ——— d—–w C:\Program Files\iDump
2008-07-01 19:17 ——— d—–w C:\Program Files\Nike+ Utility
2008-06-12 05:28 541,696 —-a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-07 20:05 0 —-a-w C:\Users\Lee & Steph\AppData\Roaming\wklnhst.dat
2008-01-09 22:01 16,384 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-01-09 22:01 32,768 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-01-09 22:01 16,384 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-08-17_16.35.55.08 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-17 15:30:25 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-19 21:06:32 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-19 21:06:32 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-08-17 15:31:02 262,144 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-19 21:07:04 262,144 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-19 21:07:04 262,144 —ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-08-17 15:31:02 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-19 21:07:04 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-19 21:07:04 262,144 —ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-08-17 13:00:10 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-19 20:39:07 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-17 13:00:10 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-19 20:39:07 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-17 13:00:10 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-19 20:39:07 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-08-17 15:23:35 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-08-19 21:00:08 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
- 2008-08-17 15:03:53 105,448 —-a-w C:\Windows\System32\perfc009.dat
+ 2008-08-19 20:36:08 105,448 —-a-w C:\Windows\System32\perfc009.dat
- 2008-08-17 15:03:53 599,942 —-a-w C:\Windows\System32\perfh009.dat
+ 2008-08-19 20:36:08 599,942 —-a-w C:\Windows\System32\perfh009.dat
- 2008-08-17 15:01:18 6,946 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-73388062-1814890543-907049141-1000_UserData.bin
+ 2008-08-19 21:08:33 7,240 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-73388062-1814890543-907049141-1000_UserData.bin
- 2008-08-17 15:01:18 55,444 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-08-19 21:08:32 55,516 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-08-17 15:32:30 58,060 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-08-19 21:08:19 58,084 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
2008-06-25 18:13 160496 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 08:33 1233920]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 08:36 2153472 C:\Windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="C:\Acer\Empowering Technology\SysMonitor.exe" [2007-06-01 00:35 326440]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-26 00:33 457216]
"PCMMediaSharing"="C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2007-06-22 02:33 204908]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 22:48 57344]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 23:49 151552]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"YMailAdvisor"="C:\Program Files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 23:06 125208]
"Malwarebytes Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-07-30 20:07 1187448]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-20 09:56 4493312 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-06-15 09:45 1826816 C:\Windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 23:49 151552]
"DelayShred"="c:\PROGRA~1\mcafee\mshr\ShrCL.EXE" [2007-12-04 13:32 111904]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 12:44:06 29696]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-09-14 04:38:32 535336]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
Nike+ Utility.lnk - C:\Program Files\Nike+ Utility\Nike+ Utility.exe [2008-04-30 16:33:46 1228800]
ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-07-14 19:22:04 475136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.mkdmp3enc"= C:\PROGRA~1\ACERAR~1\ACERVI~1\Kernel\Burner\MKDMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{70313D0E-2D73-4A56-AFD6-6DE194F07AED}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B56D3BF4-3F81-4B33-85F3-23EB7C3A8D5B}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{19E90D49-E626-40AC-8CC0-B24D5344399A}"= C:\Program Files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{96734FEA-FF44-4EF2-960F-6A020D237C80}"= C:\Program Files\Acer Arcade Live\Acer DV Magician\Acer DV Magician.exe:Acer DV Magician
"{DDA71D86-E87D-43B1-97D0-A0FF5CEDA9E7}"= C:\Program Files\Acer Arcade Live\Acer SlideShow DVD\Acer SlideShow DVD.exe:Acer SlideShow DVD
"{6EED23F9-336D-43A2-8477-17A2BB6F3F15}"= C:\Program Files\Acer Arcade Live\Acer DVDivine\Acer DVDivine.exe:Acer DVDivine
"{B18354C5-FBCC-49BE-9FA1-DCD4CA785D0B}"= C:\Program Files\Acer Arcade Live\Acer VideoMagician\Acer VideoMagician.exe:Acer VideoMagician
"{48C4529A-D0C4-4E7B-A6A5-ACA0E25F22CF}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia\Acer HomeMedia.exe:Acer HomeMedia
"{C3C0593F-EB72-431D-9221-A69405F1AAA9}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect
"{5CA689BC-45A5-4953-A562-BB126BA0CF1A}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:Acer HomeMedia Connect Service
"{79C8CC84-3B2D-4E9A-BA11-E0CF1433E17F}"= UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{D4DDFF20-8C12-4378-A7DE-3F568AB476AC}"= TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{8471463F-3B4F-48C0-91EB-8BF54CB4504B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{89244C0D-A0E3-4090-B217-EBC09689762F}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{0E2DB4E6-9B0E-4D41-9275-DF4C6ACCD605}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{941AE77F-351F-46CE-8FC2-65E8CF1B7324}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{370E513F-53FA-4888-BDEB-0D3ABB19ADA7}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{01C23780-CBD1-4DB8-949E-031832E4584A}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{FF36DDE5-5115-4F6D-96C4-4EF227DF0D9E}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{5B4F0E72-D700-4405-9871-3E11CFF7B8E3}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{1DF41B28-506E-49A3-B105-EFD5566C7FD7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
"C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
"C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption

R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-06-22 02:33]
R3 SiS6350;SiS6350;C:\Windows\system32\DRIVERS\SISGRKMD.sys [2007-06-05 12:08]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSGB6.sys [2007-01-22 09:09]
R3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\Windows\system32\DRIVERS\zd1211Bu.sys [2005-08-17 15:43]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2008-01-06 C:\Windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2008-01-06 C:\Windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 22:07:49
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Windows\System32\audiodg.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\System32\WUDFHost.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\McAfee\VirusScan\mcsysmon.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\Windows\System32\wbem\WMIADAP.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-08-19 22:13:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-19 21:12:59
ComboFix2.txt 2008-08-17 15:37:36

Pre-Run: 49,686,683,648 bytes free
Post-Run: 49,565,376,512 bytes free

243 — E O F — 2008-08-13 15:55:36




Kindest Thanks, Stephanie.