I have something sneaky.., Dissapearing Icons, takes over browsers, an

So I just bought a new notebook from Toshiba and seemed to be clean. Hooked into the network (linksys router) and noticed after a few days the same nonsense I've been dealing with for months with my other PC. I was able to clean the other one out but somehow this one now has similar symptoms. I tried adaware and it found 161 files but when I went to remove them they were not visible in the display. It then crashed even in safe mode! Seamonkey and Firefox seem to get hijacked time to time. When I delete temp files in windows folder I see IE5.dat or IE5.log very strange. I think it hides in system volume info folder but who know? Thanks for your help in advance!

I have run Combofix right before hijack this 199.1 So here is my logs…

Logfile of HijackThis v1.99.1
Scan saved at 5:45:30 PM, on 8/12/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Shadow Defender\DefenderDaemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Users\Yimbo 2.0\Desktop\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Shadow Defender Daemon] "C:\Program Files\Shadow Defender\DefenderDaemon.exe" /auto
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\extensis\extensis suitcase 11\bonjour\mdnsnsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Jumpstart\jswpsapi.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: QKDESFIFSD - Unknown owner - C:\Users\YIMBO2~1.0\AppData\Local\Temp\QKDESFIFSD.exe (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: YHPT - Unknown owner - C:\Users\YIMBO2~1.0\AppData\Local\Temp\YHPT.exe (file missing)

ComboFix 08-08-04.01 - Yimbo 2.0 2008-08-12 16:39:54.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1671 [GMT -4:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-07-12 to 2008-08-12 )))))))))))))))))))))))))))))))
.

2008-08-12 14:57 . 2008-08-12 14:57 d——– C:\Program Files\Common Files\snpstd2
2008-08-12 01:46 . 2008-08-12 01:46 d——– C:\Users\All Users\Xerox
2008-08-12 01:46 . 2008-08-12 01:46 d——– C:\ProgramData\Xerox
2008-08-11 23:34 . 2008-08-11 23:34 d——– C:\Program Files\CyberLink
2008-08-11 21:18 . 2008-08-11 21:18 d–hs—- C:\Diskeeper
2008-08-11 17:40 . 2008-08-11 17:40 d——– C:\Users\All Users\Diskeeper Corporation
2008-08-11 17:40 . 2008-08-11 17:40 d——– C:\ProgramData\Diskeeper Corporation
2008-08-11 17:11 . 2008-08-11 17:11 d——– C:\Program Files\Diskeeper Corporation
2008-08-11 06:10 . 2008-08-11 06:10 d——– C:\Users\All Users\LightScribe
2008-08-11 06:10 . 2008-08-11 06:10 d——– C:\ProgramData\LightScribe
2008-08-11 05:04 . 2008-08-11 22:42 d——– C:\Users\Yimbo 2.0\AppData\Roaming\Ahead
2008-08-11 05:03 . 2008-08-11 22:42 d——– C:\Users\All Users\Ahead
2008-08-11 05:03 . 2008-08-11 22:42 d——– C:\ProgramData\Ahead
2008-08-11 03:16 . 2008-08-11 04:07 d——– C:\hjt
2008-08-11 01:06 . 2008-08-11 01:06 d——– C:\Program Files\dayam NFO Viewer
2008-08-11 00:44 . 2008-08-11 00:44 1,004 –a—— C:\Windows\diskpt0.dat
2008-08-10 19:20 . 2008-08-10 19:02 63,530,280 –a—— C:\Users\Yimbo 2.0\iTunesSetup.exe
2008-08-10 18:35 . 2008-08-10 18:37 d——– C:\Users\All Users\Lavasoft
2008-08-10 18:35 . 2008-08-10 18:37 d——– C:\ProgramData\Lavasoft
2008-08-10 09:04 . 2008-08-10 09:05 d——– C:\Program Files\SureThing CD Labeler 5
2008-08-10 02:11 . 2008-08-10 09:04 d——– C:\Program Files\Common Files\SureThing Shared
2008-08-10 02:11 . 2006-09-21 07:42 487,424 –a—— C:\Windows\System32\msvcp70.dll
2008-08-10 02:11 . 2006-09-21 07:42 344,064 –a—— C:\Windows\System32\msvcr70.dll
2008-08-09 21:14 . 2008-02-28 13:26 1,414,440 –a—— C:\Windows\System32\ShellManager310E2D762.dll
2008-08-09 21:14 . 2008-02-28 13:01 774,144 –a—— C:\Windows\System32\NEROINSTAEC43759.DB
2008-08-09 21:09 . 2008-08-09 21:09 0 –a—— C:\Windows\Irremote.ini
2008-08-09 18:50 . 2008-08-09 18:50 d——– C:\Program Files\NeroInstall.bak
2008-08-09 18:39 . 2008-08-11 07:06 d——– C:\Users\All Users\Nero
2008-08-09 18:39 . 2008-08-11 07:06 d——– C:\ProgramData\Nero
2008-08-09 18:39 . 2008-08-09 21:15 d——– C:\Program Files\Common Files\Nero
2008-08-09 17:25 . 2008-08-09 17:25 d——– C:\Program Files\Alcohol Soft
2008-08-09 17:19 . 2008-08-09 17:19 715,248 –a—— C:\Windows\System32\drivers\sptd.sys
2008-08-09 09:59 . 2008-08-10 00:02 d——– C:\Users\Yimbo 2.0\AppData\Roaming\dvdcss
2008-08-09 09:52 . 2008-08-09 09:52 d——– C:\Program Files\Albatross
2008-08-09 03:21 . 2008-08-10 21:06 d——– C:\Program Files\atts
2008-08-09 01:51 . 2008-08-09 01:51 dr——- C:\Users\Public\Recorded TV
2008-08-09 01:38 . 2008-08-09 01:38 d——– C:\Windows\Logo Design Studio Pro
2008-08-09 01:38 . 2008-08-09 01:38 d——– C:\Program Files\Summitsoft
2008-08-09 01:11 . 2008-08-09 01:11 d——– C:\Users\Yimbo 2.0\AppData\Roaming\Alien Skin
2008-08-08 23:56 . 2008-08-08 23:56 d——– C:\Program Files\Smart Projects
2008-08-08 23:40 . 2008-08-08 23:40 2,838 –a—— C:\Windows\machine.ver
2008-08-08 23:40 . 2008-08-08 23:41 67 –a—— C:\Windows\swupdate.INI
2008-08-08 22:44 . 2008-08-08 22:44 d——– C:\Users\Yimbo 2.0\AppData\Roaming\Axialis
2008-08-08 22:44 . 2008-08-08 22:44 d——– C:\Program Files\Axialis
2008-08-08 22:35 . 2008-08-08 22:36 d——– C:\Users\Yimbo 2.0\AppData\Roaming\Extensis
2008-08-08 22:35 . 2008-08-09 20:08 d——– C:\Users\All Users\Extensis
2008-08-08 22:35 . 2008-08-09 20:08 d——– C:\ProgramData\Extensis
2008-08-08 22:34 . 2008-08-08 22:34 d——– C:\Program Files\Extensis
2008-08-08 20:11 . 2008-08-08 20:11 817,664 —h—– C:\Windows\System32\wodfamoh.dll
2008-08-08 18:47 . 2008-08-08 18:47 d——– C:\Users\Yimbo 2.0\AppData\Roaming\Shadow Defender
2008-08-08 16:50 . 2008-08-09 01:01 2,560 –a—— C:\Windows\System32\drivers\mchInjDrv.sys
2008-08-08 13:39 . 2008-08-08 13:39 104 –a—— C:\index.ini
2008-08-08 07:51 . 2008-08-08 07:51 0 –a—— C:\Windows\diskpt.dat
2008-08-08 07:50 . 2008-08-08 07:50 d——– C:\Program Files\Shadow Defender
2008-08-08 07:50 . 2008-06-30 09:33 181,340 –a—— C:\Windows\System32\drivers\diskpt.sys
2008-08-08 07:50 . 2008-06-30 09:33 6,656 –a—— C:\Windows\System32\dpstart.exe
2008-08-08 07:50 . 2008-08-08 07:50 48 –a—— C:\Windows\diskpt.crt
2008-08-08 01:49 . 2008-08-08 01:49 d——– C:\Program Files\IMPlus for Skype 1.00 for PocketPC
2008-08-08 00:22 . 2008-08-08 00:22 d——– C:\Program Files\AAALOGO
2008-08-07 21:47 . 2008-08-07 21:50 d——– C:\Alien Skin
2008-08-07 21:45 . 2008-08-07 21:45 d——– C:\Program Files\Alien Skin
2008-08-07 21:35 . 2008-08-07 21:35 d——– C:\Users\Yimbo 2.0\Program Files
2008-08-07 21:28 . 2008-08-11 07:06 d——– C:\Users\All Users\FLEXnet
2008-08-07 21:28 . 2008-08-11 07:06 d——– C:\ProgramData\FLEXnet
2008-08-07 21:24 . 2008-08-07 21:24 d——– C:\Program Files\Bonjour
2008-08-07 21:14 . 2008-08-07 21:14 d——– C:\Program Files\Common Files\Macrovision Shared
2008-08-07 19:38 . 2008-08-08 08:04 d——– C:\Users\Yimbo 2.0\AppData\Roaming\DNA
2008-08-07 17:54 . 2008-08-07 18:42 d——– C:\Users\All Users\PrevxCSI
2008-08-07 17:54 . 2008-08-07 18:42 d——– C:\ProgramData\PrevxCSI
2008-08-07 01:22 . 2008-08-07 01:25 d——– C:\Users\Yimbo 2.0\AppData\Roaming\uSirius
2008-08-07 01:17 . 2008-08-07 01:17 dr——- C:\Users\Public\Videos
2008-08-07 00:30 . 2008-08-07 00:30 d——– C:\Windows\System32\QuickTime
2008-08-07 00:30 . 2008-03-12 02:37 107,864 –a—— C:\Windows\System32\tsccvid.dll
2008-08-06 18:46 . 2008-08-06 18:46 d——– C:\Program Files\DNA
2008-08-06 12:27 . 2008-08-07 02:41 d——– C:\Program Files\a-squared Anti-Malware
2008-08-06 11:39 . 2008-08-06 11:41 d——– C:\Program Files\MediaCoder
2008-08-06 11:34 . 2008-08-06 11:34 d——– C:\Users\Yimbo 2.0\AppData\Roaming\vlc
2008-08-05 22:32 . 2008-08-05 22:32 54,156 –ah—– C:\Windows\QTFont.qfn
2008-08-05 22:32 . 2008-08-05 22:32 1,409 –a—— C:\Windows\QTFont.for
2008-08-05 21:27 . 2008-08-06 00:10 d——– C:\Users\Yimbo 2.0\AppData\Roaming\Any Video Converter
2008-08-05 21:27 . 2008-08-05 21:27 d——– C:\Program Files\Any Video Converter
2008-08-05 00:56 . 2008-03-14 13:22 368,640 –a—— C:\Windows\System32\ReWire.dll
2008-08-05 00:56 . 2008-03-14 13:22 233,472 –a—— C:\Windows\System32\REX Shared Library.dll
2008-08-04 09:54 . 2008-08-11 23:34 d——– C:\Users\YIMBO2~1~0\AppData
2008-08-04 09:54 . 2008-08-04 09:54 d——– C:\Users\YIMBO2~1~0
2008-08-04 05:12 . 2008-08-04 05:12 d——– C:\Users\All Users\eSellerate
2008-08-04 05:12 . 2008-08-04 05:12 d——– C:\ProgramData\eSellerate
2008-08-03 21:12 . 2008-08-03 21:12 d——– C:\Users\Public\Pictures
2008-08-03 04:44 . 2008-08-08 05:24 d——– C:\Users\Yimbo 2.0\BlackBerry Downloads
2008-08-03 04:37 . 2008-08-09 08:53 d——– C:\Users\Yimbo 2.0\Eargasmic Sounds
2008-08-03 04:17 . 2008-08-07 08:46 dr——- C:\Users\Public\Music
2008-08-03 04:12 . 2008-08-07 21:25 dr——- C:\Users\Public\Documents
2008-08-03 01:52 . 2008-08-07 23:55 2,828 –ahs—- C:\Users\All Users\KGyGaAvL.sys
2008-08-03 01:52 . 2008-08-07 23:55 2,828 –ahs—- C:\ProgramData\KGyGaAvL.sys
2008-08-03 01:52 . 2008-08-03 01:52 8 -r-hs—- C:\Users\All Users\349CCBD895.sys
2008-08-03 01:52 . 2008-08-03 01:52 8 -r-hs—- C:\ProgramData\349CCBD895.sys
2008-08-03 01:50 . 2008-08-03 01:50 d——– C:\Program Files\Common Files\Protexis
2008-08-03 01:45 . 2008-08-03 01:45 d——– C:\Program Files\Corel
2008-08-03 00:05 . 2008-08-03 00:05 d——– C:\Program Files\Xara
2008-08-03 00:05 . 2008-08-03 00:06 d——– C:\Program Files\Common Files\Xara
2008-08-02 23:40 . 2008-08-10 04:45 dr——- C:\Users\Yimbo 2.0\Pictures
2008-08-02 23:40 . 2008-08-03 01:52 d——– C:\Users\Yimbo 2.0\AppData\Roaming\Corel
2008-08-02 23:39 . 2008-08-03 02:04 952 –ahs—- C:\Windows\System32\KGyGaAvL.sys
2008-08-02 23:37 . 2008-08-02 23:37 506 –a—— C:\Windows\System32\mapisvc.inf
2008-08-02 23:35 . 2008-08-03 01:50 d——– C:\Users\All Users\Corel
2008-08-02 23:35 . 2008-08-02 23:36 d——– C:\Users\All Users\Borland
2008-08-02 23:35 . 2008-08-03 01:50 d——– C:\ProgramData\Corel
2008-08-02 23:35 . 2008-08-02 23:36 d——– C:\ProgramData\Borland
2008-08-02 23:35 . 2008-08-02 23:36 d——– C:\Program Files\WordPerfect Office X3
2008-08-02 23:35 . 2008-08-02 23:35 d——– C:\Program Files\Common Files\Corel
2008-08-02 23:35 . 2008-08-02 23:35 d——– C:\Program Files\Common Files\Borland Shared
2008-08-02 23:30 . 2008-08-07 08:47 dr——- C:\Users\Yimbo 2.0\Music
2008-08-02 16:00 . 2008-08-02 16:07 727 –ah—– C:\IPH.PH
2008-08-02 14:44 . 2008-08-07 08:46 d——– C:\Users\Yimbo 2.0\Adobe Fonts
2008-08-02 13:50 . 2008-08-02 13:50 0 –ah—– C:\ntuser.dat.LOG2
2008-08-02 13:50 . 2008-08-02 13:50 0 –ah—– C:\ntuser.dat.LOG1
2008-08-02 13:50 . 2008-08-02 13:50 0 –a—— C:\ntuser.dat
2008-08-02 11:07 . 2008-08-05 21:02 d——– C:\Program Files\MSECache
2008-08-02 08:39 . 2008-08-07 02:02 69 –a—— C:\Windows\NeroDigital.ini
2008-08-02 08:36 . 2008-08-02 08:36 d——– C:\Program Files\Aimersoft
2008-08-02 07:21 . 2008-08-02 07:21 d——– C:\Users\Yimbo 2.0\AppData\Roaming\HP
2008-08-02 05:25 . 2008-08-06 16:59 d——– C:\N360_BACKUP
2008-08-02 02:18 . 2008-08-02 02:18 d——– C:\Users\Yimbo 2.0\AppData\Roaming\Roxio
2008-08-02 01:58 . 2008-08-02 01:58 d——– C:\Users\Yimbo 2.0\net
2008-08-02 01:56 . 2008-08-02 01:56 d——– C:\Users\Yimbo 2.0\AppData\Roaming\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-12 18:56 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-11 11:05 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-08-09 00:11 1,645,320 —-a-w C:\Windows\System32\gdiplus.dll
2008-08-08 01:24 ——— d—–w C:\Program Files\Common Files\Adobe
2008-08-07 12:46 ——— d—–w C:\ProgramData\Microsoft Help
2008-08-07 12:46 ——— d—–w C:\Program Files\Picasa2
2008-08-07 12:46 ——— d—–w C:\Program Files\Microsoft Works
2008-08-04 21:32 ——— d—–w C:\ProgramData\Symantec
2008-08-04 09:12 ——— d-s—w C:\ProgramData\Memeo
2008-08-04 09:00 ——— d—–w C:\Program Files\Google
2008-08-04 08:48 ——— d—–w C:\Program Files\Memeo
2008-07-30 21:42 23,888 —-a-w C:\Windows\system32\drivers\COH_Mon.sys
2008-07-30 21:28 706 —-a-w C:\Windows\system32\drivers\COH_Mon.inf
2008-07-30 21:28 10,537 —-a-w C:\Windows\system32\drivers\coh_mon.cat
2008-07-28 13:49 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-07-27 08:48 ——— d—–w C:\ProgramData\WildTangent
2008-07-27 06:18 ——— d—–w C:\Program Files\Norton 360
2008-07-27 04:32 ——— d—–w C:\Program Files\Windows Mail
2008-07-27 02:54 805 —-a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-07-27 02:54 123,952 —-a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-07-27 02:54 10,671 —-a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-07-27 02:54 ——— d—–w C:\Program Files\Symantec
2008-06-23 13:44 62,464 —-a-w C:\Windows\system32\drivers\RTSTOR.sys
2008-06-16 22:23 50 —-a-w C:\Windows\system32\drivers\DCX.LOG
2008-06-16 22:21 ——— d—–w C:\Program Files\TOSHIBA
2008-06-16 22:19 ——— d—–w C:\Program Files\Common Files\Toshiba Shared
2008-06-16 22:17 ——— d—–w C:\ProgramData\Toshiba
2008-06-16 22:16 ——— d—–w C:\ProgramData\ATI
2008-06-16 22:12 ——— d—–w C:\ProgramData\Atheros
2008-06-16 22:12 ——— d—–w C:\Program Files\Jumpstart
2008-06-16 22:11 ——— d—–w C:\Program Files\Atheros
2008-06-16 22:09 ——— d—–w C:\Program Files\ltmoh
2008-06-16 21:56 0 —ha-w C:\Windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2008-06-16 21:56 ——— d—–w C:\Program Files\Synaptics
2008-06-16 21:52 319,456 —-a-w C:\Windows\DIFxAPI.dll
2008-06-16 21:52 315,392 —-a-w C:\Windows\HideWin.exe
2008-06-16 21:52 ——— d—–w C:\Program Files\Realtek
2008-06-16 21:50 ——— d—–w C:\Program Files\ATI Technologies
2008-06-16 21:46 ——— d—–w C:\Program Files\ATI
2008-06-16 21:42 ——— d—–w C:\Program Files\Microsoft Office Suite Activation Assistant
2008-06-16 21:36 ——— d—–w C:\Program Files\Microsoft.NET
2008-06-16 21:26 0 —ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-13 18:14 24,112 —-a-w C:\Windows\system32\drivers\SymIMV.sys
2008-06-13 18:14 13,093 —-a-w C:\Windows\system32\drivers\SymRedir.cat
2008-06-13 18:14 1,611 —-a-w C:\Windows\system32\drivers\SymRedir.inf
2008-06-13 18:13 96,432 —-a-w C:\Windows\system32\drivers\symfw.sys
2008-06-13 18:13 41,008 —-a-w C:\Windows\system32\drivers\symndisv.sys
2008-06-13 18:13 38,576 —-a-w C:\Windows\system32\drivers\symids.sys
2008-06-13 18:13 22,320 —-a-w C:\Windows\system32\drivers\symredrv.sys
2008-06-13 18:13 184,240 —-a-w C:\Windows\system32\drivers\symtdi.sys
2008-06-13 18:13 13,616 —-a-w C:\Windows\system32\drivers\symdns.sys
2008-06-03 05:36 499,712 —-a-w C:\Windows\System32\msvcp71.dll
2008-06-03 05:36 348,160 —-a-w C:\Windows\System32\msvcr71.dll
2008-05-30 18:19 507,400 —-a-w C:\Windows\System32\XAudio2_1.dll
2008-05-30 18:18 238,088 —-a-w C:\Windows\System32\xactengine3_1.dll
2008-05-30 18:17 65,032 —-a-w C:\Windows\System32\XAPOFX1_0.dll
2008-05-30 18:17 25,608 —-a-w C:\Windows\System32\X3DAudio1_4.dll
2008-05-30 18:11 467,984 —-a-w C:\Windows\System32\d3dx10_38.dll
2008-05-30 18:11 3,850,760 —-a-w C:\Windows\System32\D3DX9_38.dll
2008-05-30 18:11 1,491,992 —-a-w C:\Windows\System32\D3DCompiler_38.dll
2008-05-27 05:21 1,582,592 —-a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 —-a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 —-a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 —-a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 —-a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 —-a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 —-a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 —-a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 —-a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 —-a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 —-a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 —-a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 —-a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 —-a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 —-a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 —-a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 —-a-w C:\Windows\System32\StructuredQuerySchema.bin
2008-01-21 02:43 174 –sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((( snapshot_2008-08-12_16.31.45.61 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-12 19:15:59 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-12 20:39:22 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-12 19:15:59 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-12 20:39:22 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-12 19:15:59 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-12 20:39:22 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-02-25 06:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-02-25 06:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-02-25 06:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-20 22:25 125952]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 04:40 218032]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 03:20 222080]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-20 22:25 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-17 17:37 51048]
"osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-25 12:50 988512]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-02-06 16:52 431456]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 16:35 716800]
"HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2007-11-01 01:01 54608]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 08:35 176128]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-03-06 16:19 236016]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 09:12 1029416]
"Shadow Defender Daemon"="C:\Program Files\Shadow Defender\DefenderDaemon.exe" [2008-06-30 09:34 200049]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 18:14 6037504 C:\Windows\RtHDVCpl.exe]
"NDSTray.exe"="NDSTray.exe" [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Memeo AutoBackup Launcher.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Memeo AutoBackup Launcher.lnk
backup=C:\Windows\pss\Memeo AutoBackup Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Suitcase 11.0.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Suitcase 11.0.lnk
backup=C:\Windows\pss\Suitcase 11.0.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Yimbo 2.0^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^AOL Desktop.lnk]
path=C:\Users\Yimbo 2.0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AOL Desktop.lnk
backup=C:\Windows\pss\AOL Desktop.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Yimbo 2.0^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Memeo AutoSync Launcher.lnk]
path=C:\Users\Yimbo 2.0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Memeo AutoSync Launcher.lnk
backup=C:\Windows\pss\Memeo AutoSync Launcher.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Users
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Users\Yimbo 2.0
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Users\Yimbo 2.0\AppData
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Users\Yimbo 2.0\AppData\Local
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Users\Yimbo 2.0\AppData\Local\Microsoft
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Users\Yimbo 2.0\AppData\Local\Microsoft\Windows
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Users\Yimbo 2.0\AppData\Local\Microsoft\Windows\Temporary Internet Files

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a-squared]
–a—— 2008-07-31 14:46 2131600 C:\Program Files\a-squared Anti-Malware\a2guard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
–a—— 2008-06-03 01:35 50528 C:\Program Files\AOL 9.1\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
–a—— 2007-05-25 13:16 42032 C:\Program Files\Common Files\aol\1217630815\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
–a—— 2006-09-11 04:40 218032 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
–a—— 2007-01-02 23:21 83568 C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
–a—— 2007-06-16 00:01 448080 C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
–a—— 2008-01-21 15:17 61440 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-07-27 21:54 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
–a—— 2007-12-06 09:12 1029416 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A423F439-5124-4C61-BE0E-2B6A1047B111}"= Disabled:TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{184BF5FC-961C-47F6-812F-EDBA0C6D5E67}"= UDP:C:\Program Files\Norton 360\MAINSTUB.EXE:Norton 360
"{24502677-70CF-4068-B6FA-BC7ECC75DA27}"= TCP:C:\Program Files\Norton 360\MAINSTUB.EXE:Norton 360
"{838C90CA-631F-479A-8403-DD7ACE219A74}"= UDP:C:\Program Files\Norton 360\MAINSTUB.EXE:Norton 360
"{230DF6E1-C783-48F5-A047-A89529EF5301}"= TCP:C:\Program Files\Norton 360\MAINSTUB.EXE:Norton 360
"{D697383E-BA29-4CAA-AA6C-E15D464B9202}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{6826EA8C-357E-4F67-82B8-312068DDDDC0}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{E1E8ED22-E99C-4D16-9A76-5B1144AB3459}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL Topspeed
"{27395E19-FA59-41E4-A725-57F7AD0B3173}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL Topspeed
"{974714FA-DB1A-40C4-B110-1A112B8C364D}"= UDP:C:\Program Files\Common Files\aol\1217201474\ee\AOLDesktop.exe:AOL Desktop
"{3C952C4C-CB36-4267-8072-AF3F54EDACB5}"= TCP:C:\Program Files\Common Files\aol\1217201474\ee\AOLDesktop.exe:AOL Desktop
"{D82776EF-69CF-4C66-BDFF-92B6125EAD24}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialer
"{6B81722C-637E-4C0B-884F-EBFB6F470024}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialer
"{63BB9ABF-7A23-42D5-9FC5-E356B4C6D6A8}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Service
"{CFBEBD96-C874-4B2D-9666-34716A7E0D7C}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Service
"{F4CD9CC5-91EE-4D23-BFE0-6151A0D28992}"= UDP:C:\Program Files\Common Files\aol\1217630815\ee\aolsoftware.exe:AOL Shared Components
"{9B9FD505-CD3E-4FBE-BBCF-E31E97037B99}"= TCP:C:\Program Files\Common Files\aol\1217630815\ee\aolsoftware.exe:AOL Shared Components
"{43ED9B61-8223-425A-980E-53535D0BBA63}"= UDP:C:\Program Files\AOL 9.1\waol.exe:AOL
"{BB61B62B-BE0E-420D-9219-3CB26E046395}"= TCP:C:\Program Files\AOL 9.1\waol.exe:AOL
"{185EB0B9-88CA-47BC-AC4F-E30EA9E73E7B}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{20FBE059-655D-4F7A-A303-52F45ADA2F14}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"TCP Query User{51E674A2-ED5E-450C-B66E-96B0E821740B}C:\\windows\\system32\\javaw.exe"= UDP:C:\windows\system32\javaw.exe:Java™ Platform SE binary
"UDP Query User{66786A27-0AF8-42CA-A93C-B206E99F20A4}C:\\windows\\system32\\javaw.exe"= TCP:C:\windows\system32\javaw.exe:Java™ Platform SE binary
"TCP Query User{F457D850-A31E-4D89-A95F-21949083126D}C:\\windows\\system32\\java.exe"= UDP:C:\windows\system32\java.exe:Java™ Platform SE binary
"UDP Query User{B7F601FF-BD17-4664-B537-9AFE9E3832A2}C:\\windows\\system32\\java.exe"= TCP:C:\windows\system32\java.exe:Java™ Platform SE binary
"TCP Query User{D16A47EC-8732-42CE-9A93-686B6A0B25FA}C:\\program files\\plazmic cdk 4.5\\_jvm\\bin\\javaw.exe"= UDP:C:\program files\plazmic cdk 4.5\_jvm\bin\javaw.exe:Java™ 2 Platform Standard Edition binary
"UDP Query User{2A613BDE-BCEF-4EB4-8B9F-B064BA77EB44}C:\\program files\\plazmic cdk 4.5\\_jvm\\bin\\javaw.exe"= TCP:C:\program files\plazmic cdk 4.5\_jvm\bin\javaw.exe:Java™ 2 Platform Standard Edition binary
"TCP Query User{EFAB236E-96EB-4695-AE06-AB70F1B82ACA}C:\\program files\\plazmic cdk 4.5\\_jvm\\bin\\java.exe"= UDP:C:\program files\plazmic cdk 4.5\_jvm\bin\java.exe:Java™ 2 Platform Standard Edition binary
"UDP Query User{4ACE2CD9-8D32-45F6-B789-8AE0A194BEB5}C:\\program files\\plazmic cdk 4.5\\_jvm\\bin\\java.exe"= TCP:C:\program files\plazmic cdk 4.5\_jvm\bin\java.exe:Java™ 2 Platform Standard Edition binary
"TCP Query User{3FBAD79C-29A1-4BB4-8ADC-4DD72C527427}C:\\program files\\research in motion\\blackberry smartphone simulators 4.3.0\\4.3.0.124 (8330)\\fledge.exe"= UDP:C:\program files\research in motion\blackberry smartphone simulators 4.3.0\4.3.0.124 (8330)\fledge.exe:BlackBerry Handheld Simulator
"UDP Query User{D57B31CD-F4A2-4CB3-B07C-52E443257F2A}C:\\program files\\research in motion\\blackberry smartphone simulators 4.3.0\\4.3.0.124 (8330)\\fledge.exe"= TCP:C:\program files\research in motion\blackberry smartphone simulators 4.3.0\4.3.0.124 (8330)\fledge.exe:BlackBerry Handheld Simulator
"{F55CBCE3-AEBB-45D4-9622-FDDDAF8C25E4}"= Disabled:UDP:C:\Program Files\AIM6\aim6.exe:AIM
"{E120C01F-74F1-4DA6-9102-1FAFA75EDFF5}"= Disabled:TCP:C:\Program Files\AIM6\aim6.exe:AIM
"{0B55A3BD-E387-4797-8624-FBA1B19D6BC5}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{C8117014-DB20-48E7-A642-2DA22AFEAB56}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{15963D19-3B20-4E56-81E0-804AEE6B42AA}"= UDP:C:\Program Files\Orb Networks\Orb\bin\Orb.exe:Orb
"{1FA74676-0413-49E8-A3A6-C2AFF7E8D87C}"= TCP:C:\Program Files\Orb Networks\Orb\bin\Orb.exe:Orb
"{4DDFCE10-235D-46DC-9C6F-AC1D1050B28B}"= UDP:C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:OrbTray
"{CA44CB54-E03A-4EAF-9AB0-16158C867118}"= TCP:C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:OrbTray
"{0ED286B7-1E15-4856-B533-527ED7044105}"= UDP:C:\Program Files\Orb Networks\Orb\bin\OrbIR.exe:OrbIR
"{7BD84BC2-A812-49AB-B0D0-D2A0A801655A}"= TCP:C:\Program Files\Orb Networks\Orb\bin\OrbIR.exe:OrbIR
"{B68644B0-B793-4E59-9256-C1CA71D4A2D0}"= UDP:C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:Orb Stream Client
"{27E00F74-5D77-4677-AD8E-56519B205151}"= TCP:C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:Orb Stream Client
"{EB030871-6855-4923-8E2F-9ACB10B92C46}"= UDP:C:\Program Files\DNA\btdna.exe:DNA (TCP-In)
"{A197509D-9BCB-4FAE-930F-CF748C12F007}"= TCP:C:\Program Files\DNA\btdna.exe:DNA (UDP-In)
"{41DA770E-CDCE-43B0-8F46-3E3F2EBC875C}"= Disabled:UDP:C:\Program Files\AOL 9.1\waol.exe:AOL
"{D2FC1313-AE09-492F-B51E-068D65B8F35F}"= Disabled:TCP:C:\Program Files\AOL 9.1\waol.exe:AOL
"{00D0E93F-58D2-4355-9C07-FC74569EDA2D}"= Disabled:UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Service
"{EA988BF7-AB1B-4F0B-8FB9-B087ED52FA22}"= Disabled:TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Service
"{8640D54E-11BD-47BC-8764-7A8350F0C9E4}"= Disabled:UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialer
"{5AE99031-DBD9-44C8-8E63-A354A3498D38}"= Disabled:TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialer
"{59044A50-614B-4ADA-9F14-E7F94D7AA430}"= Disabled:UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{A095C071-BA46-4D63-A461-4C158962F497}"= Disabled:TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{B138DAAC-BFD9-44AB-A404-62CA37F21752}"= Disabled:UDP:C:\Program Files\Common Files\aol\1217201474\ee\aolsoftware.exe:AOL Shared Components
"{56B3E0DC-9526-4BF2-9D0A-FC20B774524B}"= Disabled:TCP:C:\Program Files\Common Files\aol\1217201474\ee\aolsoftware.exe:AOL Shared Components
"{88221BE5-0156-4E89-995A-32880639A6ED}"= Disabled:UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{2514CA39-36F2-4A91-B8C8-711F9DBF32E8}"= Disabled:TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{F758884F-8EFE-4BED-9AF4-9C2624346F1A}"= Disabled:UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{0302EE50-BED0-4056-B487-B1336A6767A5}"= Disabled:TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"DoNotAllowExceptions"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"= C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine
"C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 14:23]
R0 diskpt;diskpt;C:\Windows\system32\drivers\diskpt.sys [2008-06-30 09:33]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080808.001\IDSvix86.sys [2008-07-16 19:50]
R1 jswpslwf;JumpStart Wireless Filter Driver;C:\Windows\system32\DRIVERS\jswpslwf.sys [2008-04-28 19:59]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-17 03:19]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-17 17:37]
R2 PSI_SVC_2;Protexis Licensing V2;c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 11:15]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 20:03]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-04-23 03:36]
R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 17:11]
R3 RTSTOR;Realtek USB 2.0 Card Reader;C:\Windows\system32\drivers\RTSTOR.SYS [2008-06-23 09:44]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2008-06-13 14:13]
S3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
S3 jswpsapi;Jumpstart Wifi Protected Setup;C:\Program Files\Jumpstart\jswpsapi.exe [2008-04-16 18:53]
S3 QKDESFIFSD;QKDESFIFSD;C:\Users\YIMBO2~1.0\AppData\Local\Temp\QKDESFIFSD.exe []
S3 SVRPEDRV;SVRPEDRV;C:\Windows\System32\sysprep\PEDrv.sys [2008-01-18 12:22]
S3 YHPT;YHPT;C:\Users\YIMBO2~1.0\AppData\Local\Temp\YHPT.exe []
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-20 22:23]
S4 GameConsoleService;GameConsoleService;C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [2008-01-29 13:09]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-20 22:23]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\shell\AutoRun\command - D:\wd_windows_tools\setup.exe

*Newly Created Service* - COMHOST
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Users\Yimbo 2.0\AppData\Roaming\Mozilla\Firefox\Profiles\94t3870p.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava11.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava12.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava13.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava14.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava32.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npoji610.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npunagi2.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-12 16:41:56
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-12 16:43:20
ComboFix-quarantined-files.txt 2008-08-12 20:43:10
ComboFix2.txt 2008-08-12 20:32:14
ComboFix3.txt 2008-08-11 07:48:53

Pre-Run: 24,661,422,080 bytes free
Post-Run: 24,314,179,584 bytes free

438 — E O F — 2008-08-08 10:42:58