[Closed] McAfee Virus scan won't work, possible other issues

The volunteers on this board have been very helpful to me in my malware issues, and a friend of mine is having bad malware issues as well. I cleared a few malware programs successfully (XP Antivirus 2008 and a few others) but I can't get his McAfee VirusScan to update nor run, and his Superantispyware crashes. I can't update it, nor can I update the .dat files for McAfee. I've also installed and run the Malwarebytes tool. Attached is his HJT log. Thank you for any suggestions you can offer!
______________________________

Logfile of HijackThis v1.99.1
Scan saved at 11:46:16 AM, on 8/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\program files\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://webmail.earthlink.net/wam/login.jsp…p;x=-1717680945
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: PnIEBrowserHelperObj Class - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Cyrillic Keyboard] C:\CYR2000\CYRKBD32.EXE
O4 - HKCU\..\Run: [MenaceFighter] C:\Program Files\SecurePCCleaner\GDC.exe
O4 - HKCU\..\Run: [con] C:\WINDOWS\system32\dllh8jkd1q2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [dziqtkpx] C:\WINDOWS\system32\zapgngfs.exe
O4 - HKCU\..\Run: [antispy] C:\Program Files\IEAntiVirus\ANTIVIR.exe
O4 - HKCU\..\Run: [Antivirus 2008] C:\Program Files\Antivirus 2008\antvrs.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.errorprotector.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E797DEA-40DC-49E1-B474-070C8C5E608F}: NameServer = 85.255.116.69,85.255.112.75
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.69 85.255.112.75
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E797DEA-40DC-49E1-B474-070C8C5E608F}: NameServer = 85.255.116.69,85.255.112.75
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.69 85.255.112.75
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: btrklfr - {47995E3E-1CA1-45D3-ADDF-6711CCC2E1F8} - C:\WINDOWS\btrklfr.dll (file missing)
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe

Thank you for your reply, and sorry for the delay. I've run the steps per your instructions. Attached are the three logs for your review:

Report.txt

Username "Frank" - 08/11/2008 11:11:22 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.116.69 85.255.112.75" HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{1E797DEA-40DC-49E1-B474-070C8C5E608F}
"nameserver"="85.255.116.69,85.255.112.75" HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{EA219350-B25F-4304-B0A7-CA6C15D25C3F}
"DhcpNameServer"="[removed],[removed]"
Successfully flushed the DNS Resolver Cache.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
….
….
~~~~~ Misc files.
….
~~~~~ Checking for older varients.
….

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe"
"IntelMeM"="C:\\Program Files\\Intel\\Modem Event Monitor\\IntelMEM.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"Dell Photo AIO Printer 942"="\"C:\\Program Files\\Dell Photo AIO Printer 942\\dlbubmgr.exe\""
"DellMCM"="\"C:\\Program Files\\Dell Photo AIO Printer 942\\memcard.exe\""
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~3\\mimboot.exe"
"SiteAdvisor"="\"C:\\Program Files\\SiteAdvisor\\6261\\SiteAdv.exe\""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Cyrillic Keyboard"="C:\\CYR2000\\CYRKBD32.EXE"
"MenaceFighter"="C:\\Program Files\\SecurePCCleaner\\GDC.exe"
"con"="C:\\WINDOWS\\system32\\dllh8jkd1q2.exe"
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"dziqtkpx"="C:\\WINDOWS\\system32\\zapgngfs.exe"
"antispy"="C:\\Program Files\\IEAntiVirus\\ANTIVIR.exe"
"Antivirus 2008"="C:\\Program Files\\Antivirus 2008\\antvrs.exe"
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"
"Antivirus-2008.exe"="C:\\Program Files\\Antivirus 2008\\Antivirus-2008.exe"
….
Hosts file was reset, If you use a custom hosts file please replace it…
~~~~~ End report ~~~~~




Combofix log


ComboFix 08-08-10.04 - Frank 2008-08-11 11:25:54.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.282 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Frank\Application Data\Antivirus 2008
C:\Documents and Settings\Frank\Application Data\macromedia\Flash Player\#SharedObjects\6GPF263D\interclick.com
C:\Documents and Settings\Frank\Application Data\macromedia\Flash Player\#SharedObjects\6GPF263D\interclick.com\ud.sol
C:\Documents and Settings\Frank\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Frank\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Frank\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008.lnk
C:\Documents and Settings\Frank\Desktop\Antivirus-2008.lnk
C:\Documents and Settings\Frank\Desktop\Error Cleaner.url
C:\Documents and Settings\Frank\Desktop\Privacy Protector.url
C:\Documents and Settings\Frank\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Frank\err.log
c:\documents and settings\frank\favorites\Error Cleaner.url
c:\documents and settings\frank\favorites\Privacy Protector.url
c:\documents and settings\frank\favorites\Spyware&Malware Protection.url
C:\Documents and Settings\Frank\ResErrors.log
C:\Documents and Settings\Frank\Start Menu\Programs\Antivirus 2008
C:\Documents and Settings\Frank\Start Menu\Programs\Antivirus 2008\Antivirus-2008.lnk
C:\Program Files\Antivirus 2008
C:\Program Files\Antivirus 2008\Antivirus-2008.exe
C:\Program Files\Antivirus 2008\vscan.tsi
C:\Program Files\Antivirus 2008\zlib.dll
C:\WINDOWS\bgrqfetx.dll
C:\WINDOWS\dat.txt
C:\WINDOWS\eqbn.exe
C:\WINDOWS\lnvegaow.exe
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\search_res.txt
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\clbinit.dll
C:\WINDOWS\system32\servers.ini
C:\WINDOWS\tfnslopk.dll
C:\WINDOWS\wnlmdakqanr.dll
C:\WINDOWS\xokvrpwg.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASC3550P
——-\Legacy_CLBDRIVER
——-\Legacy_FOPF
——-\Service_clbdriver
——-\Service_Driver


((((((((((((((((((((((((( Files Created from 2008-07-11 to 2008-08-11 )))))))))))))))))))))))))))))))
.

2008-08-11 11:10 . 2008-08-11 11:14 d——– C:\fixwareout
2008-08-08 07:39 . 2008-08-08 07:39 26,624 –a—— C:\WINDOWS\CYKA7.tmp
2008-08-05 12:12 . 2008-08-05 12:12 26,624 –a—— C:\WINDOWS\CYK95.tmp
2008-08-04 09:47 . 2008-08-04 09:47 26,624 –a—— C:\WINDOWS\CYK86.tmp
2008-08-02 13:43 . 2008-08-02 13:43 26,624 –a—— C:\WINDOWS\CYK94.tmp
2008-08-02 11:41 . 2008-08-02 11:41 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-08-02 10:17 . 2008-08-02 10:17 d——– C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-08-02 10:01 . 2008-08-02 10:01 26,624 –a—— C:\WINDOWS\CYK85.tmp
2008-08-02 09:38 . 2008-08-02 09:38 d——– C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-07-26 17:37 . 2008-07-26 17:37 d——– C:\Documents and Settings\New Folder
2008-07-19 23:14 . 2008-07-19 23:14 26,624 –a—— C:\WINDOWS\CYK93.tmp
2008-07-19 22:28 . 2008-07-19 22:28 26,624 –a—— C:\WINDOWS\CYK90.tmp
2008-07-19 20:13 . 2008-07-19 20:13 26,624 –a—— C:\WINDOWS\CYK92.tmp
2008-07-19 19:49 . 2008-07-19 19:49 26,624 –a—— C:\WINDOWS\CYK8F.tmp
2008-07-19 10:39 . 2008-07-19 10:39 26,624 –a—— C:\WINDOWS\CYK91.tmp
2008-07-19 08:43 . 2008-07-19 08:43 26,624 –a—— C:\WINDOWS\CYK8E.tmp
2008-07-19 07:26 . 2008-07-19 07:26 26,624 –a—— C:\WINDOWS\CYKB9.tmp
2008-07-18 15:55 . 2008-07-18 15:55 26,624 –a—— C:\WINDOWS\CYK8D.tmp
2008-07-18 15:47 . 2008-07-18 15:47 26,624 –a—— C:\WINDOWS\CYK8C.tmp
2008-07-18 15:04 . 2004-08-04 06:00 4,224 –a—— C:\WINDOWS\system32\beep.sys
2008-07-18 15:04 . 2008-07-18 15:04 13 –a—— C:\WINDOWS\uid.dat
2008-07-18 14:41 . 2008-08-09 18:07 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-18 14:41 . 2008-07-18 14:41 1,409 –a—— C:\WINDOWS\QTFont.for
2008-07-17 09:36 . 2008-07-17 09:36 26,624 –a—— C:\WINDOWS\CYK8B.tmp
2008-07-14 07:19 . 2008-07-14 07:19 26,624 –a—— C:\WINDOWS\CYKA5.tmp
2008-07-12 05:41 . 2008-07-12 05:41 26,624 –a—— C:\WINDOWS\CYKA6.tmp
2008-07-11 20:01 . 2008-07-11 20:01 26,624 –a—— C:\WINDOWS\CYK8A.tmp
2008-07-11 16:57 . 2008-07-11 16:57 26,624 –a—— C:\WINDOWS\CYK9B.tmp
2008-07-11 13:49 . 2008-07-11 13:49 26,624 –a—— C:\WINDOWS\CYK89.tmp
2008-07-11 10:19 . 2008-07-11 10:19 26,624 –a—— C:\WINDOWS\CYK87.tmp
2008-07-11 07:41 . 2008-07-11 07:41 26,624 –a—— C:\WINDOWS\CYK46.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-05 19:18 ——— d—–w C:\Documents and Settings\Frank\Application Data\SiteAdvisor
2008-08-02 15:41 ——— d—–w C:\Program Files\SUPERAntiSpyware
2008-08-02 13:17 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-02 13:09 ——— d—–w C:\Program Files\SpywareBlaster
2008-08-01 21:11 ——— d—–w C:\Documents and Settings\Frank\Application Data\Menologion
2008-07-26 11:57 ——— d—–w C:\Program Files\EarthLink TotalAccess
2008-07-19 17:55 17 —-a-w C:\Program Files\stng399.opt
2008-07-17 11:57 ——— d—–w C:\Documents and Settings\Frank\Application Data\AdobeUM
2008-07-10 16:21 26,624 —-a-w C:\WINDOWS\CYK84.tmp
2008-07-07 15:11 26,624 —-a-w C:\WINDOWS\CYK7D.tmp
2008-07-06 03:05 26,624 —-a-w C:\WINDOWS\CYK83.tmp
2008-07-05 18:07 50,688 —-a-w C:\Program Files\ATF-Cleaner.exe
2008-07-05 18:00 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-07-05 18:00 ——— d—–w C:\Documents and Settings\Frank\Application Data\Malwarebytes
2008-07-05 18:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-05 17:53 1,973,255 —-a-w C:\Program Files\stng399.exe
2008-07-05 17:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\zibwhahc
2008-07-05 17:01 ——— d—–w C:\Documents and Settings\Frank\Application Data\SUPERAntiSpyware.com
2008-07-05 17:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-05 16:07 26,624 —-a-w C:\WINDOWS\CYK82.tmp
2008-07-03 15:40 26,624 —-a-w C:\WINDOWS\CYK88.tmp
2008-06-30 17:19 26,624 —-a-w C:\WINDOWS\CYK81.tmp
2008-06-30 13:17 26,624 —-a-w C:\WINDOWS\CYK7F.tmp
2008-06-29 00:09 26,624 —-a-w C:\WINDOWS\CYK7E.tmp
2008-06-28 18:20 34,296 —-a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-28 18:20 17,144 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-06-28 12:26 26,624 —-a-w C:\WINDOWS\CYK80.tmp
2008-06-27 13:41 26,624 —-a-w C:\WINDOWS\CYK7C.tmp
2008-06-20 14:16 26,624 —-a-w C:\WINDOWS\CYK7B.tmp
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 13:13 26,624 —-a-w C:\WINDOWS\CYK7A.tmp
2008-06-15 07:47 26,624 —-a-w C:\WINDOWS\CYK79.tmp
2008-06-14 21:28 26,624 —-a-w C:\WINDOWS\CYK78.tmp
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 10:46 26,624 —-a-w C:\WINDOWS\CYK77.tmp
2008-06-09 16:53 26,624 —-a-w C:\WINDOWS\CYK76.tmp
2008-06-09 11:56 26,624 —-a-w C:\WINDOWS\CYK75.tmp
2008-06-08 03:03 26,624 —-a-w C:\WINDOWS\CYK73.tmp
2008-06-08 02:29 26,624 —-a-w C:\WINDOWS\CYK74.tmp
2008-06-07 22:45 26,624 —-a-w C:\WINDOWS\CYK72.tmp
2008-06-07 21:53 26,624 —-a-w C:\WINDOWS\CYK71.tmp
2008-06-07 20:23 26,624 —-a-w C:\WINDOWS\CYK70.tmp
2008-06-06 15:54 26,624 —-a-w C:\WINDOWS\CYK6F.tmp
2008-06-05 11:34 26,624 —-a-w C:\WINDOWS\CYK6E.tmp
2008-06-01 17:42 26,624 —-a-w C:\WINDOWS\CYK6D.tmp
2008-06-01 00:31 26,624 —-a-w C:\WINDOWS\CYK6C.tmp
2008-05-31 20:34 26,624 —-a-w C:\WINDOWS\CYK6B.tmp
2008-05-22 22:01 26,624 —-a-w C:\WINDOWS\CYK6A.tmp
2008-05-22 18:21 26,624 —-a-w C:\WINDOWS\CYK69.tmp
2008-05-19 13:20 26,624 —-a-w C:\WINDOWS\CYK68.tmp
2008-05-17 22:16 26,624 —-a-w C:\WINDOWS\CYK67.tmp
2008-05-16 15:06 26,624 —-a-w C:\WINDOWS\CYK66.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Cyrillic Keyboard"="C:\CYR2000\CYRKBD32.EXE" [2001-12-12 04:03 113664]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 20:42 1404928]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48 32881]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12 221184]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"Dell Photo AIO Printer 942"="C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe" [2005-02-03 04:08 294912]
"DellMCM"="C:\Program Files\Dell Photo AIO Printer 942\memcard.exe" [2004-07-27 10:08 262144]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-08-28 18:38 98304]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-15 12:06 185896]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe" [2006-01-19 11:06 11776]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-03-30 11:42 36904]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispSettingPage"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winlogon.sys]
@="driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
–a—— 2007-03-15 11:09 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-02-23 17:19 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2005-08-28 18:38 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-06-15 12:06 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"=

S3 PSFactoryBuffer;PSFactoryBuffer Service;C:\WINDOWS\system32\svchost.exe [2004-08-04 06:00]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
PSFactoryBuffer
.
Contents of the 'Scheduled Tasks' folder

2007-07-15 C:\WINDOWS\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-01-17 19:02]

2008-03-01 C:\WINDOWS\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-01-17 19:02]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{968232F5-0910-483D-B059-4C6AB5C785DC} - C:\WINDOWS\bgrqfetx.dll
HKCU-Run-MenaceFighter - C:\Program Files\SecurePCCleaner\GDC.exe
HKCU-Run-con - C:\WINDOWS\system32\dllh8jkd1q2.exe
HKCU-Run-SpybotSD TeaTimer - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
HKCU-Run-dziqtkpx - C:\WINDOWS\system32\zapgngfs.exe
SSODL-btrklfr-{47995E3E-1CA1-45D3-ADDF-6711CCC2E1F8} - C:\WINDOWS\btrklfr.dll
MSConfigStartUp-mmtask - C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
MSConfigStartUp-PAS_Check - C:\Program Files\Common Files\DriveCleaner Free\udcpas.exe
MSConfigStartUp-SDR6_Check - C:\Program Files\Common Files\DriveCleaner Free\udcsdr.exe
MSConfigStartUp-SiteAdvisor - C:\Program Files\SiteAdvisor\6066\SiteAdv.exe


.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Frank\Application Data\Mozilla\Firefox\Profiles\i1f923xq.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxps://webmail.earthlink.net/wam/login.jsp?redirect=%2Fwam%2Findex.jsp&x=-1717680945


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-11 11:31:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6261\saHook.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee\MSC\mcuimgr.exe
C:\WINDOWS\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-08-11 11:40:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-11 15:40:18

Pre-Run: 64,989,356,032 bytes free
Post-Run: 66,524,037,120 bytes free

273 — E O F — 2008-07-27 04:13:20




New HiJack This log


Logfile of HijackThis v1.99.1
Scan saved at 11:45, on 2008-08-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\program files\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://antivir–2008.com/buy.php?aff=1001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: PnIEBrowserHelperObj Class - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Cyrillic Keyboard] C:\CYR2000\CYRKBD32.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.errorprotector.com
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe


Thank you once again for your assistance!

Thank you once again for your patience. Since I had to leave the computer and come back to it later, I'm not sure if I can find the Kaspersky log. Attached at the Combofix log and the new HJT log:

ComboFix log
ComboFix 08-08-10.04 - Frank 2008-08-14 16:21:36.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.301 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Frank\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\CYK46.tmp
C:\WINDOWS\CYK66.tmp
C:\WINDOWS\CYK67.tmp
C:\WINDOWS\CYK68.tmp
C:\WINDOWS\CYK69.tmp
C:\WINDOWS\CYK6A.tmp
C:\WINDOWS\CYK6B.tmp
C:\WINDOWS\CYK6C.tmp
C:\WINDOWS\CYK6D.tmp
C:\WINDOWS\CYK6E.tmp
C:\WINDOWS\CYK6F.tmp
C:\WINDOWS\CYK70.tmp
C:\WINDOWS\CYK71.tmp
C:\WINDOWS\CYK72.tmp
C:\WINDOWS\CYK73.tmp
C:\WINDOWS\CYK74.tmp
C:\WINDOWS\CYK75.tmp
C:\WINDOWS\CYK76.tmp
C:\WINDOWS\CYK77.tmp
C:\WINDOWS\CYK78.tmp
C:\WINDOWS\CYK79.tmp
C:\WINDOWS\CYK7A.tmp
C:\WINDOWS\CYK7B.tmp
C:\WINDOWS\CYK7C.tmp
C:\WINDOWS\CYK7D.tmp
C:\WINDOWS\CYK7E.tmp
C:\WINDOWS\CYK7F.tmp
C:\WINDOWS\CYK80.tmp
C:\WINDOWS\CYK81.tmp
C:\WINDOWS\CYK82.tmp
C:\WINDOWS\CYK83.tmp
C:\WINDOWS\CYK84.tmp
C:\WINDOWS\CYK85.tmp
C:\WINDOWS\CYK86.tmp
C:\WINDOWS\CYK87.tmp
C:\WINDOWS\CYK88.tmp
C:\WINDOWS\CYK89.tmp
C:\WINDOWS\CYK8A.tmp
C:\WINDOWS\CYK8B.tmp
C:\WINDOWS\CYK8C.tmp
C:\WINDOWS\CYK8D.tmp
C:\WINDOWS\CYK8E.tmp
C:\WINDOWS\CYK8F.tmp
C:\WINDOWS\CYK90.tmp
C:\WINDOWS\CYK91.tmp
C:\WINDOWS\CYK92.tmp
C:\WINDOWS\CYK93.tmp
C:\WINDOWS\CYK94.tmp
C:\WINDOWS\CYK95.tmp
C:\WINDOWS\CYK9B.tmp
C:\WINDOWS\CYKA5.tmp
C:\WINDOWS\CYKA6.tmp
C:\WINDOWS\CYKA7.tmp
C:\WINDOWS\CYKB9.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\zibwhahc
C:\WINDOWS\CYK46.tmp
C:\WINDOWS\CYK66.tmp
C:\WINDOWS\CYK67.tmp
C:\WINDOWS\CYK68.tmp
C:\WINDOWS\CYK69.tmp
C:\WINDOWS\CYK6A.tmp
C:\WINDOWS\CYK6B.tmp
C:\WINDOWS\CYK6C.tmp
C:\WINDOWS\CYK6D.tmp
C:\WINDOWS\CYK6E.tmp
C:\WINDOWS\CYK6F.tmp
C:\WINDOWS\CYK70.tmp
C:\WINDOWS\CYK71.tmp
C:\WINDOWS\CYK72.tmp
C:\WINDOWS\CYK73.tmp
C:\WINDOWS\CYK74.tmp
C:\WINDOWS\CYK75.tmp
C:\WINDOWS\CYK76.tmp
C:\WINDOWS\CYK77.tmp
C:\WINDOWS\CYK78.tmp
C:\WINDOWS\CYK79.tmp
C:\WINDOWS\CYK7A.tmp
C:\WINDOWS\CYK7B.tmp
C:\WINDOWS\CYK7C.tmp
C:\WINDOWS\CYK7D.tmp
C:\WINDOWS\CYK7E.tmp
C:\WINDOWS\CYK7F.tmp
C:\WINDOWS\CYK80.tmp
C:\WINDOWS\CYK81.tmp
C:\WINDOWS\CYK82.tmp
C:\WINDOWS\CYK83.tmp
C:\WINDOWS\CYK84.tmp
C:\WINDOWS\CYK85.tmp
C:\WINDOWS\CYK86.tmp
C:\WINDOWS\CYK87.tmp
C:\WINDOWS\CYK88.tmp
C:\WINDOWS\CYK89.tmp
C:\WINDOWS\CYK8A.tmp
C:\WINDOWS\CYK8B.tmp
C:\WINDOWS\CYK8C.tmp
C:\WINDOWS\CYK8D.tmp
C:\WINDOWS\CYK8E.tmp
C:\WINDOWS\CYK8F.tmp
C:\WINDOWS\CYK90.tmp
C:\WINDOWS\CYK91.tmp
C:\WINDOWS\CYK92.tmp
C:\WINDOWS\CYK93.tmp
C:\WINDOWS\CYK94.tmp
C:\WINDOWS\CYK95.tmp
C:\WINDOWS\CYK9B.tmp
C:\WINDOWS\CYKA5.tmp
C:\WINDOWS\CYKA6.tmp
C:\WINDOWS\CYKA7.tmp
C:\WINDOWS\CYKB9.tmp
C:\WINDOWS\system32\9.tmp
C:\WINDOWS\system32\A.tmp
C:\WINDOWS\system32\B.tmp
C:\WINDOWS\system32\C.tmp
C:\WINDOWS\system32\D.tmp
C:\WINDOWS\system32\E.tmp
C:\WINDOWS\system32\F.tmp
C:\WINDOWS\system32\huqhrhbl.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SYSREST.SYS
——-\Legacy_TDSSSERV


((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 )))))))))))))))))))))))))))))))
.

2008-08-14 16:13 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-08-14 16:11 . 2008-08-14 16:13 d——– C:\Program Files\Java
2008-08-14 16:11 . 2008-08-14 16:11 d——– C:\Program Files\Common Files\Java
2008-08-14 11:44 . 2008-08-14 11:44 26,624 –a—— C:\WINDOWS\CYK98.tmp
2008-08-14 10:58 . 2008-07-30 20:07 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-14 07:44 . 2008-08-14 07:44 26,624 –a—— C:\WINDOWS\CYKA8.tmp
2008-08-11 14:48 . 2008-08-14 11:43 94,208 –a—— C:\WINDOWS\system32\13.tmp
2008-08-11 14:48 . 2008-08-14 11:43 94,208 –a—— C:\WINDOWS\system32\12.tmp
2008-08-11 12:23 . 2008-08-11 12:23 26,624 –a—— C:\WINDOWS\CYK97.tmp
2008-08-11 11:10 . 2008-08-11 11:14 d——– C:\fixwareout
2008-08-02 11:41 . 2008-08-02 11:41 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-08-02 10:17 . 2008-08-02 10:17 d——– C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-08-02 09:38 . 2008-08-02 09:38 d——– C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-07-26 17:37 . 2008-07-26 17:37 d——– C:\Documents and Settings\New Folder
2008-07-18 15:04 . 2004-08-04 06:00 4,224 –a—— C:\WINDOWS\system32\beep.sys
2008-07-18 15:04 . 2008-07-18 15:04 13 –a—— C:\WINDOWS\uid.dat
2008-07-18 14:41 . 2008-08-09 18:07 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-18 14:41 . 2008-07-18 14:41 1,409 –a—— C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-14 19:50 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-14 19:48 ——— d—–w C:\Program Files\SpywareBlaster
2008-08-14 14:58 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-11 17:16 ——— d—–w C:\Program Files\McAfee
2008-08-11 16:23 ——— d—–w C:\Program Files\Common Files\McAfee
2008-08-05 19:18 ——— d—–w C:\Documents and Settings\Frank\Application Data\SiteAdvisor
2008-08-02 15:41 ——— d—–w C:\Program Files\SUPERAntiSpyware
2008-08-01 21:11 ——— d—–w C:\Documents and Settings\Frank\Application Data\Menologion
2008-07-31 00:07 17,144 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-07-26 11:57 ——— d—–w C:\Program Files\EarthLink TotalAccess
2008-07-19 17:55 17 —-a-w C:\Program Files\stng399.opt
2008-07-17 11:57 ——— d—–w C:\Documents and Settings\Frank\Application Data\AdobeUM
2008-07-05 18:07 50,688 —-a-w C:\Program Files\ATF-Cleaner.exe
2008-07-05 18:00 ——— d—–w C:\Documents and Settings\Frank\Application Data\Malwarebytes
2008-07-05 18:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-05 17:53 1,973,255 —-a-w C:\Program Files\stng399.exe
2008-07-05 17:01 ——— d—–w C:\Documents and Settings\Frank\Application Data\SUPERAntiSpyware.com
2008-07-05 17:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-11_11.39.22.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-02 14:23:19 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-14 19:33:11 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-02 14:23:19 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-14 19:33:11 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-08-02 14:23:19 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-14 19:33:11 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-06-25 18:54:44 71,496 —-a-w C:\WINDOWS\system32\drivers\mfeavfk.sys
+ 2007-11-22 10:44:08 79,304 —-a-w C:\WINDOWS\system32\drivers\mfeavfk.sys
- 2007-06-25 14:57:10 34,184 —-a-w C:\WINDOWS\system32\drivers\mfebopk.sys
+ 2007-11-22 10:44:08 35,240 —-a-w C:\WINDOWS\system32\drivers\mfebopk.sys
- 2008-02-06 13:51:44 171,400 —-a-w C:\WINDOWS\system32\drivers\mfehidk.sys
+ 2007-11-22 10:44:08 201,320 —-a-w C:\WINDOWS\system32\drivers\mfehidk.sys
- 2007-06-25 14:57:24 32,008 —-a-w C:\WINDOWS\system32\drivers\mferkdk.sys
+ 2007-11-22 10:44:04 33,832 —-a-w C:\WINDOWS\system32\drivers\mferkdk.sys
- 2007-06-25 14:57:28 37,480 —-a-w C:\WINDOWS\system32\drivers\mfesmfk.sys
+ 2007-12-02 16:51:42 40,488 —-a-w C:\WINDOWS\system32\drivers\mfesmfk.sys
- 2007-03-02 18:16:52 109,608 —-a-w C:\WINDOWS\system32\drivers\Mpfp.sys
+ 2007-07-13 10:20:24 113,952 —-a-w C:\WINDOWS\system32\drivers\Mpfp.sys
- 2003-11-19 21:36:26 24,681 —-a-w C:\WINDOWS\system32\java.exe
+ 2008-06-10 05:21:01 135,168 —-a-w C:\WINDOWS\system32\java.exe
- 2003-11-19 21:36:30 28,779 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-10 05:21:04 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-10 06:32:34 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Cyrillic Keyboard"="C:\CYR2000\CYRKBD32.EXE" [2001-12-12 04:03 113664]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 20:42 1404928]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12 221184]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"Dell Photo AIO Printer 942"="C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe" [2005-02-03 04:08 294912]
"DellMCM"="C:\Program Files\Dell Photo AIO Printer 942\memcard.exe" [2004-07-27 10:08 262144]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-08-28 18:38 98304]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-15 12:06 185896]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe" [2006-01-19 11:06 11776]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-03-30 11:42 36904]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispSettingPage"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winlogon.sys]
@="driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
–a—— 2007-03-15 11:09 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-02-23 17:19 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2005-08-28 18:38 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-06-15 12:06 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

S3 PSFactoryBuffer;PSFactoryBuffer Service;C:\WINDOWS\system32\svchost.exe [2004-08-04 06:00]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
PSFactoryBuffer
.
Contents of the 'Scheduled Tasks' folder

2007-07-15 C:\WINDOWS\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2008-03-01 C:\WINDOWS\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-14 16:25:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


C:\WINDOWS\CYK66.tmp 26624 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6261\saHook.dll
.
———————— Other Running Processes ————————
.
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mcuimgr.exe
C:\WINDOWS\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-08-14 16:35:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-14 20:35:13
ComboFix2.txt 2008-08-11 15:40:37

Pre-Run: 66,248,048,640 bytes free
Post-Run: 66,238,406,656 bytes free

316 — E O F — 2008-07-27 04:13:20



HJT log, after the Kaspersky Virus Scan


Logfile of HijackThis v1.99.1
Scan saved at 7:40:36 PM, on 2008-08-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: PnIEBrowserHelperObj Class - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Cyrillic Keyboard] C:\CYR2000\CYRKBD32.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe


Everything seems to be running much, much better now. Thank you for your assistance.

Hi,

Thank you again for your patience. The Kaspersky antivirus disappears after a while. It found one object, about 60% through, and then shut down, disappeared. I really don't know what happened. I can't seem to shut down McAfee without it coming back again, although it seems to be working properly now.

Here are the other logs:

SD Fix:


SDFix: Version 1.216
Run by [removed] on 2008-08-15 at 10:11 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\Documents and Settings\Frank\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com\settings.sol - Deleted
C:\WINDOWS\system32\aliases.ini - Deleted
C:\WINDOWS\system32\control.ini - Deleted
C:\WINDOWS\system32\mirc.ico - Deleted
C:\WINDOWS\system32\mirc.ini - Deleted
C:\WINDOWS\system32\remote.ini - Deleted
C:\WINDOWS\system32\users.ini - Deleted



Folder C:\Documents and Settings\Frank\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 10:17:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"="C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe:*:Enabled:TaskPanl"
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe:*:Enabled:McAfee Network Agent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 13 Oct 2004 1,694,208 ..SH. — "C:\Program Files\Messenger\msmsgs.exe"
Fri 14 Jul 2006 4,348 ..SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 19 Oct 2007 875,520 …H. — "C:\Documents and Settings\Frank\My Documents\~WRL1192.tmp"
Sat 28 Jun 2008 693,248 …H. — "C:\Documents and Settings\Frank\My Documents\~WRL2544.tmp"
Fri 18 Jul 2008 722,432 …H. — "C:\Documents and Settings\Frank\My Documents\~WRL3548.tmp"
Mon 11 Aug 2008 20,487 A.SHR — "C:\Program Files\McAfee\MQC\MRU.bak"
Mon 11 Aug 2008 265 A.SHR — "C:\Program Files\McAfee\MQC\qcconf.bak"
Sat 2 Jun 2007 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 12 Nov 2004 37,376 …H. — "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
Thu 29 May 2008 8,548,984 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\27351338b61f8a3b1808532ac895046b\BIT185.tmp"
Thu 8 May 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\BIT71.tmp"
Fri 11 Jul 2008 8,723,064 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\5addd6f775e0368f244f62c739d66dd4\BIT99.tmp"
Fri 11 Apr 2008 8,161,400 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\65c2e436f9d7efd0bb1d2fcc20c6d135\BITAD.tmp"
Wed 25 Jun 2008 605,224 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\84143315a852d95942c39bb84712677e\BIT95.tmp"
Sat 15 Mar 2008 7,799,416 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\b857106b57491ac2a650851d43af1c92\BIT16A.tmp"
Mon 16 Jun 2008 8,846,888 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\ba203fc55df79697d61ee240fe4d59fa\BIT187.tmp"
Mon 16 Jun 2008 8,502,904 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\fa7431e5b6c6ef5b2a4a86419ca21980\BITC8.tmp"
Fri 11 Apr 2008 17,154,304 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\922b657f39febbc9726862609246d87a\download\BITF9.tmp"
Wed 18 Apr 2007 8 A..H. — "C:\Documents and Settings\Frank\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Wed 18 Apr 2007 8 A..H. — "C:\Documents and Settings\Frank\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Sat 21 Apr 2007 8 A..H. — "C:\Documents and Settings\Frank\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Mon 23 Apr 2007 8 A..H. — "C:\Documents and Settings\Frank\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"
Thu 26 Apr 2007 8 A..H. — "C:\Documents and Settings\Frank\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u5\lock.tmp"

Finished!



ComboFix
ComboFix 08-08-14.03 - Frank 2008-08-15 10:31:49.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.286 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Frank\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\stng399.opt
C:\WINDOWS\CYK97.tmp
C:\WINDOWS\CYK98.tmp
C:\WINDOWS\CYKA8.tmp
C:\WINDOWS\system32\12.tmp
C:\WINDOWS\system32\13.tmp
C:\WINDOWS\system32\beep.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\stng399.opt
C:\WINDOWS\CYK66.tmp
C:\WINDOWS\CYK97.tmp
C:\WINDOWS\CYK98.tmp
C:\WINDOWS\CYKA8.tmp
C:\WINDOWS\system32\beep.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SYSREST.SYS
——-\Legacy_TDSSSERV


((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 )))))))))))))))))))))))))))))))
.

2008-08-15 10:36 . 26,624 C:\WINDOWS\CYK66.tmp
2008-08-15 10:07 . 2008-08-15 10:07 d——– C:\WINDOWS\ERUNT
2008-08-15 09:58 . 2008-08-15 10:19 d——– C:\SDFix
2008-08-14 16:13 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-08-14 16:11 . 2008-08-14 16:13 d——– C:\Program Files\Java
2008-08-14 16:11 . 2008-08-14 16:11 d——– C:\Program Files\Common Files\Java
2008-08-14 15:53 . 2008-06-23 12:57 6,066,176 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-08-14 15:53 . 2007-04-17 05:32 2,455,488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-08-14 15:53 . 2007-03-08 01:10 991,232 ——— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-08-14 15:53 . 2008-06-23 12:57 459,264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-08-14 15:53 . 2008-06-23 12:57 383,488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-08-14 15:53 . 2008-06-23 12:57 267,776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-08-14 15:53 . 2008-06-23 12:57 63,488 ——— C:\WINDOWS\system32\dllcache\icardie.dll
2008-08-14 15:53 . 2008-06-23 12:57 52,224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-08-14 15:53 . 2008-06-23 05:20 13,824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-14 15:34 . 2008-05-01 10:30 331,776 ——— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-14 10:58 . 2008-07-30 20:07 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-11 11:10 . 2008-08-11 11:14 d——– C:\fixwareout
2008-08-02 11:41 . 2008-08-02 11:41 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-08-02 10:17 . 2008-08-02 10:17 d——– C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-08-02 09:38 . 2008-08-02 09:38 d——– C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-07-26 17:37 . 2008-07-26 17:37 d——– C:\Documents and Settings\New Folder
2008-07-18 15:04 . 2008-07-18 15:04 13 –a—— C:\WINDOWS\uid.dat
2008-07-18 14:41 . 2008-08-09 18:07 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-18 14:41 . 2008-07-18 14:41 1,409 –a—— C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-14 19:50 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-14 19:48 ——— d—–w C:\Program Files\SpywareBlaster
2008-08-14 14:58 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-11 17:16 ——— d—–w C:\Program Files\McAfee
2008-08-11 16:23 ——— d—–w C:\Program Files\Common Files\McAfee
2008-08-05 19:18 ——— d—–w C:\Documents and Settings\Frank\Application Data\SiteAdvisor
2008-08-02 15:41 ——— d—–w C:\Program Files\SUPERAntiSpyware
2008-08-01 21:11 ——— d—–w C:\Documents and Settings\Frank\Application Data\Menologion
2008-07-31 00:07 17,144 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-07-26 11:57 ——— d—–w C:\Program Files\EarthLink TotalAccess
2008-07-17 11:57 ——— d—–w C:\Documents and Settings\Frank\Application Data\AdobeUM
2008-07-07 20:32 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ——w C:\WINDOWS\system32\dllcache\es.dll
2008-07-05 18:07 50,688 —-a-w C:\Program Files\ATF-Cleaner.exe
2008-07-05 18:00 ——— d—–w C:\Documents and Settings\Frank\Application Data\Malwarebytes
2008-07-05 18:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-05 17:53 1,973,255 —-a-w C:\Program Files\stng399.exe
2008-07-05 17:01 ——— d—–w C:\Documents and Settings\Frank\Application Data\SUPERAntiSpyware.com
2008-07-05 17:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-24 16:23 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ——w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 14:57 3,592,192 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:20 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:20 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-21 05:23 161,792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 —-a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ——w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\dllcache\bthport.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-11_11.39.22.73 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 20:27:04 163,328 —-a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-08-15 14:07:41 5,021,696 —-a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-08-15 14:07:41 1,159,168 —-a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-08-15 14:07:27 5,021,696 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-08-15 14:07:27 1,159,168 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2007-08-13 23:39:00 123,904 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\advpack.dll
+ 2007-08-13 23:35:46 346,624 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\dxtmsft.dll
+ 2007-08-13 23:35:38 214,528 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\dxtrans.dll
+ 2007-08-13 23:54:10 131,584 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\extmgr.dll
+ 2007-08-13 23:36:26 61,952 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\icardie.dll
+ 2007-08-13 23:39:06 54,784 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\ie4uinit.exe
+ 2007-08-13 23:39:26 152,064 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\ieakeng.dll
+ 2007-08-13 23:39:54 229,376 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\ieaksie.dll
+ 2007-08-13 22:56:54 161,792 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\ieakui.dll
+ 2007-02-12 21:10:12 2,451,312 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\ieapfltr.dat
+ 2007-07-11 17:27:48 383,488 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\ieapfltr.dll
+ 2007-08-13 23:39:50 382,976 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\iedkcs32.dll
+ 2007-08-13 23:54:10 6,049,280 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\ieframe.dll
+ 2007-08-13 23:39:10 43,008 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\iernonce.dll
+ 2007-08-13 23:34:04 266,752 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\iertutil.dll
+ 2007-08-13 23:39:10 13,312 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\ieudinit.exe
+ 2007-08-13 23:43:56 622,080 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\iexplore.exe
+ 2007-08-13 23:54:10 27,136 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\jsproxy.dll
+ 2007-08-13 23:54:10 458,752 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\msfeeds.dll
+ 2007-08-13 23:54:10 50,688 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\msfeedsbs.dll
+ 2007-08-13 23:54:12 3,578,368 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\mshtml.dll
+ 2007-08-13 23:54:10 475,648 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\mshtmled.dll
+ 2007-08-13 23:44:26 192,000 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\msrating.dll
+ 2007-08-13 23:54:10 670,720 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\mstime.dll
+ 2007-08-13 23:44:06 101,376 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\occache.dll
+ 2007-08-13 23:36:12 44,544 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\updspapi.dll
+ 2007-08-13 23:44:30 105,984 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\url.dll
+ 2007-08-13 23:54:10 1,162,240 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\urlmon.dll
+ 2007-08-13 23:54:10 231,424 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\webcheck.dll
+ 2007-08-13 23:54:10 818,688 -c—-w C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
- 2007-08-13 23:39:00 123,904 —-a-w C:\WINDOWS\system32\advpack.dll
+ 2008-06-23 16:57:27 124,928 —-a-w C:\WINDOWS\system32\advpack.dll
- 2008-08-02 14:23:19 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-15 11:45:16 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-02 14:23:19 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-15 11:45:16 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-08-13 23:39:00 123,904 ——w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-06-23 16:57:27 124,928 ——w C:\WINDOWS\system32\dllcache\advpack.dll
- 2007-08-13 23:35:46 346,624 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2007-08-13 23:35:38 214,528 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2007-08-13 23:54:10 131,584 —-a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-06-23 16:57:27 133,120 —-a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2007-08-13 23:39:26 152,064 ——w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 ——w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2007-08-13 23:39:54 229,376 ——w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 ——w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-08-13 23:39:50 382,976 ——w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 ——w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-08-13 23:39:10 43,008 ——w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-06-23 16:57:33 44,544 ——w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2007-08-21 06:15:44 683,520 ——w C:\WINDOWS\system32\dllcache\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 ——w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2007-08-13 23:54:10 27,136 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2007-08-13 23:54:10 475,648 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2007-08-13 23:44:26 192,000 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-06-23 16:57:39 193,024 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2007-08-13 23:54:10 670,720 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-06-23 16:57:40 671,232 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2007-08-13 23:44:06 101,376 ——w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-06-23 16:57:40 102,912 ——w C:\WINDOWS\system32\dllcache\occache.dll
- 2007-08-13 23:36:12 44,544 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-08-13 23:44:30 105,984 ——w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-06-23 16:57:40 105,984 ——w C:\WINDOWS\system32\dllcache\url.dll
- 2007-08-13 23:54:10 1,162,240 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2007-08-13 23:54:10 231,424 ——w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-06-23 16:57:41 233,472 ——w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2007-08-13 23:54:10 818,688 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-06-23 16:57:41 826,368 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2007-06-25 18:54:44 71,496 —-a-w C:\WINDOWS\system32\drivers\mfeavfk.sys
+ 2007-11-22 10:44:08 79,304 —-a-w C:\WINDOWS\system32\drivers\mfeavfk.sys
- 2007-06-25 14:57:10 34,184 —-a-w C:\WINDOWS\system32\drivers\mfebopk.sys
+ 2007-11-22 10:44:08 35,240 —-a-w C:\WINDOWS\system32\drivers\mfebopk.sys
- 2008-02-06 13:51:44 171,400 —-a-w C:\WINDOWS\system32\drivers\mfehidk.sys
+ 2007-11-22 10:44:08 201,320 —-a-w C:\WINDOWS\system32\drivers\mfehidk.sys
- 2007-06-25 14:57:24 32,008 —-a-w C:\WINDOWS\system32\drivers\mferkdk.sys
+ 2007-11-22 10:44:04 33,832 —-a-w C:\WINDOWS\system32\drivers\mferkdk.sys
- 2007-06-25 14:57:28 37,480 —-a-w C:\WINDOWS\system32\drivers\mfesmfk.sys
+ 2007-12-02 16:51:42 40,488 —-a-w C:\WINDOWS\system32\drivers\mfesmfk.sys
- 2007-03-02 18:16:52 109,608 —-a-w C:\WINDOWS\system32\drivers\Mpfp.sys
+ 2007-07-13 10:20:24 113,952 —-a-w C:\WINDOWS\system32\drivers\Mpfp.sys
- 2007-08-13 23:35:46 346,624 —-a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 —-a-w C:\WINDOWS\system32\dxtmsft.dll
- 2007-08-13 23:35:38 214,528 —-a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 —-a-w C:\WINDOWS\system32\dxtrans.dll
- 2007-08-13 23:54:10 131,584 —-a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-06-23 16:57:27 133,120 —-a-w C:\WINDOWS\system32\extmgr.dll
- 2007-08-13 23:36:26 61,952 ——w C:\WINDOWS\system32\icardie.dll
+ 2008-06-23 16:57:28 63,488 —-a-w C:\WINDOWS\system32\icardie.dll
- 2007-08-13 23:39:06 54,784 —-a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 —-a-w C:\WINDOWS\system32\ie4uinit.exe
- 2007-08-13 23:39:26 152,064 —-a-w C:\WINDOWS\system32\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 —-a-w C:\WINDOWS\system32\ieakeng.dll
- 2007-08-13 23:39:54 229,376 —-a-w C:\WINDOWS\system32\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 —-a-w C:\WINDOWS\system32\ieaksie.dll
- 2007-08-13 22:56:54 161,792 —-a-w C:\WINDOWS\system32\ieakui.dll
+ 2008-06-21 05:23:54 161,792 —-a-w C:\WINDOWS\system32\ieakui.dll
- 2007-02-12 21:10:12 2,451,312 ——w C:\WINDOWS\system32\ieapfltr.dat
+ 2007-04-17 09:32:38 2,455,488 —-a-w C:\WINDOWS\system32\ieapfltr.dat
- 2007-07-11 17:27:48 383,488 ——w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 —-a-w C:\WINDOWS\system32\ieapfltr.dll
- 2007-08-13 23:39:50 382,976 —-a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 —-a-w C:\WINDOWS\system32\iedkcs32.dll
- 2007-08-13 23:54:10 6,049,280 ——w C:\WINDOWS\system32\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 —-a-w C:\WINDOWS\system32\ieframe.dll
- 2007-08-13 23:39:10 43,008 —-a-w C:\WINDOWS\system32\iernonce.dll
+ 2008-06-23 16:57:33 44,544 —-a-w C:\WINDOWS\system32\iernonce.dll
- 2007-08-13 23:34:04 266,752 ——w C:\WINDOWS\system32\iertutil.dll
+ 2008-06-23 16:57:34 267,776 —-a-w C:\WINDOWS\system32\iertutil.dll
- 2007-08-13 23:39:10 13,312 —-a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 —-a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-08-21 06:15:44 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
- 2003-11-19 21:36:26 24,681 —-a-w C:\WINDOWS\system32\java.exe
+ 2008-06-10 05:21:01 135,168 —-a-w C:\WINDOWS\system32\java.exe
- 2003-11-19 21:36:30 28,779 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-10 05:21:04 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-10 06:32:34 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
- 2007-08-13 23:54:10 27,136 —-a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 —-a-w C:\WINDOWS\system32\jsproxy.dll
- 2007-08-13 23:54:10 458,752 ——w C:\WINDOWS\system32\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 —-a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-08-13 23:54:10 50,688 ——w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 —-a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2007-08-13 23:54:12 3,578,368 —-a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-24 14:57:40 3,592,192 —-a-w C:\WINDOWS\system32\mshtml.dll
- 2007-08-13 23:54:10 475,648 —-a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 —-a-w C:\WINDOWS\system32\mshtmled.dll
- 2007-08-13 23:44:26 192,000 —-a-w C:\WINDOWS\system32\msrating.dll
+ 2008-06-23 16:57:39 193,024 —-a-w C:\WINDOWS\system32\msrating.dll
- 2007-08-13 23:54:10 670,720 —-a-w C:\WINDOWS\system32\mstime.dll
+ 2008-06-23 16:57:40 671,232 —-a-w C:\WINDOWS\system32\mstime.dll
- 2007-08-13 23:44:06 101,376 —-a-w C:\WINDOWS\system32\occache.dll
+ 2008-06-23 16:57:40 102,912 —-a-w C:\WINDOWS\system32\occache.dll
- 2007-08-13 23:36:12 44,544 —-a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 —-a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-11-13 11:31:11 60,416 ——w C:\WINDOWS\system32\tzchange.exe
+ 2008-07-14 11:09:18 62,976 ——w C:\WINDOWS\system32\tzchange.exe
- 2007-08-13 23:44:30 105,984 —-a-w C:\WINDOWS\system32\url.dll
+ 2008-06-23 16:57:40 105,984 —-a-w C:\WINDOWS\system32\url.dll
- 2007-08-13 23:54:10 1,162,240 —-a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 —-a-w C:\WINDOWS\system32\urlmon.dll
- 2007-08-13 23:54:10 231,424 —-a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-06-23 16:57:41 233,472 —-a-w C:\WINDOWS\system32\webcheck.dll
- 2007-08-13 23:54:10 818,688 —-a-w C:\WINDOWS\system32\wininet.dll
+ 2008-06-23 16:57:41 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Cyrillic Keyboard"="C:\CYR2000\CYRKBD32.EXE" [2001-12-12 04:03 113664]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 20:42 1404928]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12 221184]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"Dell Photo AIO Printer 942"="C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe" [2005-02-03 04:08 294912]
"DellMCM"="C:\Program Files\Dell Photo AIO Printer 942\memcard.exe" [2004-07-27 10:08 262144]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-08-28 18:38 98304]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-15 12:06 185896]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe" [2006-01-19 11:06 11776]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-03-30 11:42 36904]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispSettingPage"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winlogon.sys]
@="driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
–a—— 2007-03-15 11:09 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-02-23 17:19 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2005-08-28 18:38 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-06-15 12:06 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

S3 PSFactoryBuffer;PSFactoryBuffer Service;C:\WINDOWS\system32\svchost.exe [2004-08-04 06:00]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
PSFactoryBuffer
.
Contents of the 'Scheduled Tasks' folder

2007-07-15 C:\WINDOWS\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2008-03-01 C:\WINDOWS\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 10:36:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6261\saHook.dll
.
———————— Other Running Processes ————————
.
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mcuimgr.exe
C:\WINDOWS\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-08-15 10:44:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-15 14:44:24
ComboFix2.txt 2008-08-14 20:35:22
ComboFix3.txt 2008-08-11 15:40:37

Pre-Run: 65,970,229,248 bytes free
Post-Run: 65,971,834,880 bytes free

368 — E O F — 2008-08-14 23:51:16


New HJT
Logfile of HijackThis v1.99.1
Scan saved at 12:47:50 PM, on 2008-08-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: PnIEBrowserHelperObj Class - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Cyrillic Keyboard] C:\CYR2000\CYRKBD32.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe


I don't know why the Kaspersky AV quits on me - it's done that twice. I did see that one infected file was found, but I was unable to generate a report, since it quit on me.

Steve