What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Vundo virus

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Grab a fresh copy of Combofix from the link I gave earlier and drop it on your Desktop as before - sUBs updates it regularly and you might as well have the latest version. There's no need to download the Recovery Console file again as you already have it installed. Copy and paste the following into Notepad (Start > All Programs > Accessories > Notepad):

File::

C:\temp\2ow4t3sk.exe
C:\WINDOWS\system32\376oW6xQ.exe_
C:\WINDOWS\system32\c7fiT557.exe

Save it to your Desktop with the following filename: CFScript
Drag and drop CFScript.txt onto your copy of Combofix and let it do it's thing.
Let me have the log produced, as before, as well as a fresh HJT log and a description of how the PC is behaving.
Post #17
ComboFix 08-09-26.01 - jhitchens 2008-09-27 8:06:09.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.581 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\jhitchens\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-08-27 to 2008-09-27 )))))))))))))))))))))))))))))))
.

2008-09-20 12:28 . 2008-09-20 12:28 31,232 –a—— C:\temp\2ow4t3sk.exe
2008-09-19 20:27 . 2008-09-19 20:26 109,568 ——— C:\WINDOWS\system32\pxinsi64.exe
2008-09-19 20:27 . 2008-09-19 20:26 108,544 ——— C:\WINDOWS\system32\pxcpyi64.exe
2008-09-19 14:34 . 2008-09-27 07:09 d——– C:\Documents and Settings\LocalService\Application Data\WTablet
2008-09-18 16:28 . 2008-09-27 07:25 d——– C:\Documents and Settings\jhitchens\Application Data\WTablet
2008-09-18 16:28 . 2007-09-07 14:07 2,684,200 ——— C:\WINDOWS\system32\PenTablet.cpl
2008-09-18 16:28 . 2007-09-07 14:04 1,380,680 ——— C:\WINDOWS\system32\PenTablet.znc
2008-09-18 16:27 . 2008-09-18 16:27 d——– C:\WINDOWS\system32\WTablet
2008-09-18 16:27 . 2008-09-18 16:27 d——– C:\Program Files\Tablet
2008-09-18 16:27 . 2007-09-07 14:16 1,373,480 ——— C:\WINDOWS\system32\Pen_Tablet.exe
2008-09-18 16:27 . 2007-09-07 13:55 181,544 ——— C:\WINDOWS\system32\Wintab32.dll
2008-09-18 16:27 . 2007-09-07 14:09 128,296 ——— C:\WINDOWS\system32\Pen_Tablet.dll
2008-09-18 16:27 . 2007-02-16 14:30 12,848 –a—— C:\WINDOWS\system32\drivers\wacomvhid.sys
2008-09-18 16:27 . 2007-02-15 20:11 11,440 –a—— C:\WINDOWS\system32\drivers\WacomVKHid.sys
2008-09-18 16:27 . 2007-02-16 15:12 11,312 –a—— C:\WINDOWS\system32\drivers\wacommousefilter.sys
2008-09-15 20:28 . 2008-09-15 20:28 d——– C:\Program Files\iTunes
2008-09-15 20:28 . 2008-09-15 20:28 d——– C:\Program Files\iPod
2008-09-15 20:28 . 2008-09-15 20:28 d——– C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-15 20:26 . 2008-09-15 20:26 d——– C:\Program Files\Bonjour
2008-09-15 20:25 . 2008-09-15 20:25 d——– C:\Program Files\QuickTime
2008-09-14 11:26 . 2008-09-15 17:10 36,866 –a—— C:\WINDOWS\system32\376oW6xQ.exe_
2008-09-14 01:22 . 2008-09-14 01:22 30,456 –ah—– C:\WINDOWS\system32\mlfcache.dat
2008-09-12 10:55 . 2008-09-12 10:58 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 10:55 . 2008-09-12 10:55 d——– C:\Documents and Settings\jhitchens\Application Data\Malwarebytes
2008-09-12 10:55 . 2008-09-12 10:55 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-12 10:55 . 2008-09-10 00:04 38,528 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-12 10:55 . 2008-09-10 00:03 17,200 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 21:26 . 2008-09-08 21:30 d——– C:\Program Files\Game_Maker
2008-09-08 20:21 . 2008-09-08 20:21 d——– C:\Program Files\High-Logic
2008-09-08 20:21 . 2008-09-08 20:26 d——– C:\Documents and Settings\jhitchens\Application Data\FontCreator
2008-09-08 20:21 . 2008-09-08 20:21 146 –a—— C:\WINDOWS\fcp5.cfg
2008-09-07 10:23 . 2008-09-24 23:36 d——– C:\Hijackthis
2008-09-06 15:09 . 2008-09-06 15:09 90,112 –a—— C:\WINDOWS\system32\QuickTimeVR.qtx
2008-09-06 15:09 . 2008-09-06 15:09 57,344 –a—— C:\WINDOWS\system32\QuickTime.qts
2008-09-06 03:20 . 2008-09-06 03:20 29,824 –a—— C:\WINDOWS\system32\c7fiT557.exe
2008-09-01 02:49 . 2004-08-04 08:00 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-09-01 00:37 . 2008-09-01 00:37 d——– C:\WINDOWS\system32\scripting
2008-09-01 00:37 . 2008-09-01 00:37 d——– C:\WINDOWS\l2schemas
2008-09-01 00:36 . 2008-09-01 00:36 d——– C:\WINDOWS\system32\en
2008-09-01 00:36 . 2008-09-01 00:36 d——– C:\WINDOWS\system32\bits
2008-09-01 00:31 . 2008-09-01 00:37 d——– C:\WINDOWS\ServicePackFiles
2008-08-31 23:26 . 2008-08-31 23:26 d——– C:\Program Files\MSECache
2008-08-30 19:28 . 2008-09-01 10:40 d——– C:\Program Files\Angband
2008-08-29 19:25 . 2004-02-09 12:35 429 ——— C:\WINDOWS\uninsrus.iss
2008-08-29 19:24 . 2004-02-09 12:35 509 ——— C:\WINDOWS\uninskor.iss
2008-08-29 19:24 . 2004-02-09 12:35 429 ——— C:\WINDOWS\uninsspa.iss
2008-08-29 19:24 . 2004-02-09 12:35 429 ——— C:\WINDOWS\uninsita.iss
2008-08-29 19:24 . 2004-02-09 12:35 429 ——— C:\WINDOWS\uninsger.iss
2008-08-29 19:24 . 2004-02-09 12:35 429 ——— C:\WINDOWS\uninsfra.iss
2008-08-29 19:24 . 2004-02-09 12:35 429 ——— C:\WINDOWS\uninschi.iss
2008-08-29 19:23 . 2008-08-29 19:23 d——– C:\Program Files\Samsung
2008-08-29 19:23 . 2004-02-09 12:28 146,976 –a—— C:\WINDOWS\system32\Mfcoleui.dll
2008-08-29 19:23 . 2004-02-09 14:03 143,360 –a—— C:\WINDOWS\unis5add.dll
2008-08-29 19:23 . 2004-02-09 14:03 126,976 –a—— C:\WINDOWS\system32\SmartMedia.DLL
2008-08-29 19:23 . 2004-02-09 12:28 86,016 –a—— C:\WINDOWS\system32\SMIF.DLL
2008-08-29 19:23 . 2004-02-09 14:03 49,152 –a—— C:\WINDOWS\system32\gwcpl32.cpl
2008-08-29 19:23 . 2004-02-09 12:28 7,889 –a—— C:\WINDOWS\system32\ssUsbW2k.dll
2008-08-29 19:23 . 2008-08-29 19:23 183 –a—— C:\WINDOWS\system32\NULL
2008-08-29 19:23 . 2008-08-29 19:23 117 –a—— C:\WINDOWS\groupwar.ini
2008-08-29 19:22 . 2008-08-29 19:42 d——– C:\WINDOWS\samsung
2008-08-29 18:40 . 2008-04-13 14:47 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2008-08-29 10:18 . 2008-08-29 10:18 87,336 –a—— C:\WINDOWS\system32\dns-sd.exe
2008-08-29 09:53 . 2008-08-29 09:53 61,440 –a—— C:\WINDOWS\system32\dnssd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-27 11:26 ——— d—–w C:\Program Files\Steam
2008-09-27 03:42 ——— d—–w C:\Documents and Settings\jhitchens\Application Data\mIRC
2008-09-26 22:12 ——— d—–w C:\Program Files\mIRC
2008-09-25 20:25 ——— d—–w C:\Documents and Settings\jhitchens\Application Data\gtk-2.0
2008-09-20 00:30 ——— d—–w C:\Program Files\Common Files\Adobe
2008-09-20 00:26 20,640 ——w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-09-18 23:35 24 —-a-w C:\Documents and Settings\jhitchens\jagex_runescape_preferences.dat
2008-09-16 00:25 ——— d—–w C:\Program Files\Common Files\Apple
2008-09-07 22:01 ——— d—–w C:\Program Files\Ruff-Rose
2008-08-29 23:42 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-21 20:21 ——— d—–w C:\Program Files\Frets on Fire MFH
2008-08-16 14:12 ——— d—–w C:\Program Files\Malfador Machinations
2008-08-16 03:26 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-13 05:40 ——— d—–w C:\Documents and Settings\jhitchens\Application Data\DivX
2008-08-12 01:06 ——— d—–w C:\Program Files\Apple Software Update
2008-08-10 20:02 ——— d—–w C:\Program Files\Diablo II
2008-08-02 00:51 ——— d—–w C:\Program Files\GIMP-2.0
2008-08-01 15:52 ——— d—–w C:\Program Files\Java
2008-07-19 02:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 02:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 02:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 02:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 02:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 02:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 02:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 02:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-19 02:07 270,880 —-a-w C:\WINDOWS\system32\mucltui.dll
2008-07-19 02:07 210,976 —-a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:26 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-06-07 03:52 4,136 —-a-w C:\Program Files\Craftyov.ini
2008-04-08 20:47 56 –sh–r C:\WINDOWS\system32\AAF3253BE8.sys
2008-04-08 20:48 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-09-21_19.44.23.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-14 00:12:21 10,752 -c–a-w C:\WINDOWS\system32\dllcache\hh.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-03-28 1271032]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"Realtime Monitor"="C:\PROGRA~1\CA\ETRUST~1\realmon.exe" [2004-04-06 504080]
"Client Access Service"="C:\Program Files\IBM\Client Access\cwbsvstr.exe" [2005-06-05 20480]
"Client Access Help Update"="C:\Program Files\IBM\Client Access\cwbinhlp.exe" [2005-06-05 24576]
"Client Access Check Version"="C:\Program Files\IBM\Client Access\cwbckver.exe" [2005-06-05 45106]
"Client Access Express Welcome"="C:\Program Files\IBM\Client Access\cwbwlwiz.exe" [2005-06-05 20480]
"Client Access PC5250 Sound"="C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe" [2005-06-05 40960]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-17 339968]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"GW Port Controller"="C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE" [2004-02-09 163840]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-12-22 67752]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2005-09-03 176128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv41"= ir41_32.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CA\\eTrust Antivirus\\InoRpc.exe"=
"C:\\Program Files\\CA\\eTrust Antivirus\\InocIT.exe"=
"C:\\Program Files\\CA\\eTrust Antivirus\\Realmon.exe"=
"C:\\Program Files\\CA\\eTrust Antivirus\\InoNmSrv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Autodesk\\backburner\\monitor.exe"=
"C:\\Program Files\\Autodesk\\backburner\\manager.exe"=
"C:\\Program Files\\Autodesk\\backburner\\server.exe"=
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 CcmExec;SMS Agent Host;C:\WINDOWS\system32\CCM\CcmExec.exe [2007-04-13 590712]
R2 TabletServicePen;TabletServicePen;C:\WINDOWS\system32\Pen_Tablet.exe [2007-09-07 1373480]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2007-02-16 12848]
R3 WacomVKHid;Virtual Keyboard Driver;C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys [2007-02-15 11440]
S2 LogWatch;Event Log Watch;C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe [ ]
S3 Ch2kHUB;Cherry USB Hub Driver for CDI;C:\WINDOWS\system32\drivers\Ch2kHUB.sys [2003-07-15 82048]
S3 Ch2kUSB;Cherry USB Driver for CDI;C:\WINDOWS\system32\drivers\Ch2kUSB.sys [2003-07-15 82382]
S3 prepdrvr;SMS Process Event Driver;C:\WINDOWS\system32\CCM\prepdrv.sys [2007-04-13 23416]
S3 SSLDrv;SSL-VPN NetExtender Adapter;C:\WINDOWS\system32\DRIVERS\SSLDrv.sys [2007-10-23 19376]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a334d25-3988-11da-8973-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL docs\index.html

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{896f3869-26f0-11da-8633-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL docs\index.html
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-27 08:10:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-27 8:12:21
ComboFix-quarantined-files.txt 2008-09-27 12:12:03
ComboFix2.txt 2008-09-21 23:44:57

Pre-Run: 21,839,392,768 bytes free
Post-Run: 21,830,336,512 bytes free

202 — E O F — 2008-09-20 15:36:25

Logfile of HijackThis v1.99.1
Scan saved at 8:14:42 AM, on 9/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [Client Access PC5250 Sound] "C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.crabtree-evelyn.ca
O15 - Trusted Zone: http://www.kaspersky.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1128965542125
O16 - DPF: {79D6214F-CFCE-480F-9901-27950E78F1E6} (WebCacheCleaner Class) - https://ssl-vpn.crabtree-evelyn.com/MLWebCacheCleaner.cab
O16 - DPF: {A6A216EB-4F7C-11D5-8438-0000B456BA3D} (Matn5250 Control) - https://ssl-vpn.crabtree-evelyn.com/cgi-bin….1/matn5250.cab
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - http://www.yoyogames.com/downloads/activex/YoYo.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ctree.net
O17 - HKLM\Software\..\Telephony: DomainName = ctree.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ctree.net
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe

and the following popped up while ComboFix was running

The REG/Bangsoft.A was detected in C:\COMBOFIX\TEMP00.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.
Post #18
The AV detection appears to be a false positive that is part of CF, but i'm trying to find out for sure. Are you still getting pop-ups and the other AV detections?
Post #20
That's good. I'd like you to run the PC normally for a day or two, and then let me have one last HJT log and the obligatory PC description. All being well, the last set of nasties removed were the source of the problems and all should be well. The last AV detection was a legitimate file - part of CF - so nothing to worry about there.
Post #21
bad news

Here are some eTrust reports from last two days, saved by my son

SEPT. 28, 2008 11:30ishAM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\01CREX78.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/VMalum.DTAQ was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\01CREX78.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: Cure failed, file restored.

SEPT. 28, 2008 2:15PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\BQ2D7KX8.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.
–2 infections

SEPT. 28, 2008 4:15PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\70NJM7T1.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/VMalum.DTAQ was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\70NJM7T1.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: Cure failed, file restored.

SEPT. 28, 2008 6:15PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\KHOR37N7.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.
–2 infections

SEPT. 28, 2008 8:15PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\Y7C7N537.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/VMalum.DTAQ was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\X58OIV0P.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: Cure failed, file restored.

SEPT. 28, 2008 10:16PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\2LK5S20O.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.
–2 infections

SEPT. 29, 2008 3:43PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\84IU2V0H.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.
–2 infections

SEPT. 29, 2008 5:43PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\6WK4J03N.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.
–2 infections

here is an HJT log
Logfile of HijackThis v1.99.1
Scan saved at 7:23:57 PM, on 9/29/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [Client Access PC5250 Sound] "C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.crabtree-evelyn.ca
O15 - Trusted Zone: http://www.kaspersky.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1128965542125
O16 - DPF: {79D6214F-CFCE-480F-9901-27950E78F1E6} (WebCacheCleaner Class) - https://ssl-vpn.crabtree-evelyn.com/MLWebCacheCleaner.cab
O16 - DPF: {A6A216EB-4F7C-11D5-8438-0000B456BA3D} (Matn5250 Control) - https://ssl-vpn.crabtree-evelyn.com/cgi-bin….1/matn5250.cab
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - http://www.yoyogames.com/downloads/activex/YoYo.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ctree.net
O17 - HKLM\Software\..\Telephony: DomainName = ctree.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ctree.net
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe
Post #22
Download gmer.zip from here and save it to your Desktop.
You will need to unzip it before you run it.

To do this: Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

Double click gmer.exe to begin:
  • If you get a message about "system modification", click Yes and work through the rest of the instructions.
  • Ensure that the Rootkit Tab at the top is selected.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click the Scan button on the right.
  • When the scan has completed, (you'll have time for a snack and a cuppa!), click the Copy button underneath - this will save the report to your Clipboard.
  • Paste it into Notepad (Start > All Programs > Accessories > Notepad) and save it somewhere convenient.
  • Click the >>> Tab at the top and select the Autostart Tab.
  • Click the Scan button on the right - this one should only take seconds to complete.
  • Save the log as before.
Copy and paste both reports into your next reply - you may need to post them separately.
The Preview option may show the whole logs being posted, but they sometimes get cut down when the actual post is made, so check the post once it is completed.
Post #23
Also:
  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<
Post #24
GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-09-30 22:47:17
Windows 5.1.2600 Service Pack 3


—- Devices - GMER 1.0.14 —-

AttachedDevice \FileSystem\Ntfs \Ntfs ino_flpy.sys (CA eTrust Antivirus/InoculateIT File System Mounting Filter Driver for Windows 2000/XP/.Net/Computer Associates)
AttachedDevice \FileSystem\Fastfat \Fat ino_fltr.sys (CA eTrust Antivirus/InoculateIT File System Filter Driver for Windows 2000/XP/2003/Computer Associates)
AttachedDevice \FileSystem\Fastfat \Fat ino_flpy.sys (CA eTrust Antivirus/InoculateIT File System Mounting Filter Driver for Windows 2000/XP/.Net/Computer Associates)

—- EOF - GMER 1.0.14 —-
GMER 1.0.14.14536 - http://www.gmer.net
Autostart scan 2008-09-30 22:48:22
Windows 5.1.2600 Service Pack 3


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
dimsntfy@DLLName = %SystemRoot%\System32\dimsntfy.dll
igfxcui@DLLName = igfxdev.dll
WgaLogon@DLLName = WgaLogon.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
AdobeActiveFileMonitor5.0@ = C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
Apple Mobile Device@ = "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
Ati HotKey Poller@ = %SystemRoot%\system32\Ati2evxx.exe
ATI Smart@ = C:\WINDOWS\system32\ati2sgag.exe
Bonjour Service@ = "C:\Program Files\Bonjour\mDNSResponder.exe"
CcmExec@ = C:\WINDOWS\system32\CCM\CcmExec.exe
ImapiService@ = %systemroot%\system32\imapi.exe
InoRPC@ = "C:\Program Files\CA\eTrust Antivirus\InoRpc.exe"
InoRT@ = "C:\Program Files\CA\eTrust Antivirus\InoRT.exe"
InoTask@ = "C:\Program Files\CA\eTrust Antivirus\InoTask.exe"
LogWatch@ = "C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe" /*file not found*/
ScsiPort@ = %SystemRoot%\system32\drivers\scsiport.sys
TabletServicePen@ = C:\WINDOWS\system32\Pen_Tablet.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@ISUSPM StartupC:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup = C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
@ISUSScheduler"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start = "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
@Realtime MonitorC:\PROGRA~1\CA\ETRUST~1\realmon.exe -s = C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
@Client Access Service"C:\Program Files\IBM\Client Access\cwbsvstr.exe" = "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
@Client Access Help Update"C:\Program Files\IBM\Client Access\cwbinhlp.exe" = "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
@Client Access Check Version"C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN = "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
@Client Access Express Welcome"C:\Program Files\IBM\Client Access\cwbwlwiz.exe" = "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
@Client Access PC5250 Sound"C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe" = "C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe"
@SoundMAXPnPC:\Program Files\Analog Devices\Core\smax4pnp.exe = C:\Program Files\Analog Devices\Core\smax4pnp.exe
@ATIPTAC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
@igfxtrayC:\WINDOWS\system32\igfxtray.exe = C:\WINDOWS\system32\igfxtray.exe
@igfxhkcmdC:\WINDOWS\system32\hkcmd.exe = C:\WINDOWS\system32\hkcmd.exe
@igfxpersC:\WINDOWS\system32\igfxpers.exe = C:\WINDOWS\system32\igfxpers.exe
@SunJavaUpdateSched"C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" = "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
@GW Port ControllerC:\Program Files\Samsung\SmarThru\PORTCTRL.EXE = C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
@QuickTime Task"C:\Program Files\QuickTime\QTTask.exe" -atboottime = "C:\Program Files\QuickTime\QTTask.exe" -atboottime
@AppleSyncNotifierC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe = C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
@iTunesHelper"C:\Program Files\iTunes\iTunesHelper.exe" = "C:\Program Files\iTunes\iTunesHelper.exe"
@Adobe Photo Downloader"C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" = "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@ctfmon.exeC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
@Steam"C:\Program Files\Steam\Steam.exe" -silent = "C:\Program Files\Steam\Steam.exe" -silent
@updateMgr"C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 = "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Display Panning CPL Extension*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/C:\WINDOWS\system32\twext.dll = C:\WINDOWS\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/C:\WINDOWS\system32\twext.dll = C:\WINDOWS\system32\twext.dll
@{30D02401-6A81-11d0-8274-00C04FD5AE38} /*IE Search Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /*Shell DocObject Viewer*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FBF23B40-E3F0-101B-8488-00AA003E56F8} /*InternetShortcut*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /*Microsoft Url History Service*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FF393560-C2A7-11CF-BFF4-444553540000} /*History*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /*Microsoft Url Search Hook*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /*The Internet*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{871C5380-42A0-1069-A2EA-08002B30309D} /*Internet Name Space*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\WINDOWS\system32\extmgr.dll = C:\WINDOWS\system32\extmgr.dll
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Web Folders*/C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook Desktop Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook Custom Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Program Files\Microsoft Office\OFFICE11\msohev.dll = C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
@{DCED20BE-3645-11D4-BC95-00C04F0E0588} /*InoShell*/C:\Program Files\CA\eTrust Antivirus\InoShell.dll = C:\Program Files\CA\eTrust Antivirus\InoShell.dll
@{EEB5B6C2-E405-11d0-9318-0004AC946C18} /*AS/400 Shell Extensions - AS/400 IPL*/C:\Program Files\IBM\Client Access\Shared\cwbunas4.dll = C:\Program Files\IBM\Client Access\Shared\cwbunas4.dll
@{38482e00-0ad5-11cf-bc9d-0004ac325a18} /*AS/400 Network*/C:\Program Files\IBM\Client Access\Shared\cwbunshf.dll = C:\Program Files\IBM\Client Access\Shared\cwbunshf.dll
@{DCA251A0-38AC-11d0-82BD-08005AA74F5C} /*AS/400 Shell Extensions - AS/400 Network*/C:\Program Files\IBM\Client Access\Shared\cwbunshf.dll = C:\Program Files\IBM\Client Access\Shared\cwbunshf.dll
@{8CA2EBC1-40C7-4451-AD01-7DEEB4690358} /*AS/400 Related Tasks*/C:\Program Files\IBM\Client Access\Shared\cwbunshf.dll = C:\Program Files\IBM\Client Access\Shared\cwbunshf.dll
@{658B579F-26F7-4f28-83E4-2D1301FBC10B} /*iSeries Navigator Data Server - ANSI plug-ins*/cwbunapi.dll /*file not found*/ = cwbunapi.dll /*file not found*/
@{806756FB-CC6D-42cd-A6AE-F7F4916C5E22} /*iSeries Navigator Shell Extensions - ANSI plug-ins*/cwbunapi.dll /*file not found*/ = cwbunapi.dll /*file not found*/
@{07C45BB1-4A8C-4642-A1F5-237E7215FF66} /*IE Microsoft BrowserBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{1C1EDB47-CE22-4bbb-B608-77B48F83C823} /*IE Fade Task*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{205D7A97-F16D-4691-86EF-F3075DCCA57D} /*IE Menu Desk Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3028902F-6374-48b2-8DC6-9725E775B926} /*IE AutoComplete*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{43886CD5-6529-41c4-A707-7B3C92C05E68} /*IE Navigation Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{44C76ECD-F7FA-411c-9929-1B77BA77F524} /*IE Menu Site*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{4B78D326-D922-44f9-AF2A-07805C2A3560} /*IE Menu Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6038EF75-ABFC-4e59-AB6F-12D397F6568D} /*IE Microsoft History AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} /*IE Tracking Shell Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6CF48EF8-44CD-45d2-8832-A16EA016311B} /*IE IShellFolderBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{73CFD649-CD48-4fd8-A272-2070EA56526B} /*IE BandProxy*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} /*IE MRU AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} /*IE RSS Feeder Folder*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} /*IE Microsoft Shell Folder AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{B31C5FAE-961F-415b-BAF0-E697A5178B94} /*IE Microsoft Multiple AutoComplete List Container*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} /*Microsoft Browser Architecture*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} /*IE Shell Rebar BandSite*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E6EE9AAC-F76B-4947-8260-A9F136138E11} /*IE Shell Band Site Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F2CF5485-4E02-4f68-819C-B92DE9277049} /*&Links*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} /*IE Registry Tree Options Utility*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} /*IE User Assist*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} /*IE Custom MRU AutoCompleted List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@CorelDRAW Shell Extension Component /*CorelDRAW Shell Extension Component*/(null) =
@{acb4a560-3606-11d3-aef4-00104bd0f92d} /*KodakShellExtension*/C:\Program Files\Common Files\Kodak\ifscore\KodakShX.dll = C:\Program Files\Common Files\Kodak\ifscore\KodakShX.dll
@{2D140D0A-ED49-11D3-93DF-0010A4F52FF6} /*BitZipperShellExt*/(null) =
@{64BC5640-700F-4E7E-8462-D3092DD74B0F} /*VDMSound LaunchPad*/C:\Program Files\VDMSound\LaunchPad.dll = C:\Program Files\VDMSound\LaunchPad.dll
@{e82a2d71-5b2f-43a0-97b8-81be15854de8} /*ShellLink for Application References*/c:\WINDOWS\system32\dfshim.dll = c:\WINDOWS\system32\dfshim.dll
@{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} /*Shell Icon Handler for Application References*/c:\WINDOWS\system32\dfshim.dll = c:\WINDOWS\system32\dfshim.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/C:\Program Files\WinRAR\rarext.dll = C:\Program Files\WinRAR\rarext.dll
@{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} /*Microsoft Office Metadata Handler*/C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
@{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} /*Microsoft Office Thumbnail Handler*/C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
@{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} /*Messenger Sharing Folders*/C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll = C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll
@{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} /*iTunes*/C:\Program Files\iTunes\iTunesMiniPlayer.dll = C:\Program Files\iTunes\iTunesMiniPlayer.dll

HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved@{63560240-BB5D-4F81-B0B9-AEBEA2FE3DD5} /*Shell Extension for High-Logic FontCreator*/ = C:\PROGRA~1\HIGH-L~1\FONTCR~1\FONTCR~1.DLL

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
InoShell@{DCED20BE-3645-11D4-BC95-00C04F0E0588} = C:\Program Files\CA\eTrust Antivirus\InoShell.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
InoShell@{DCED20BE-3645-11D4-BC95-00C04F0E0588} = C:\Program Files\CA\eTrust Antivirus\InoShell.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
MBAMShlExt@{57CE581A-0CB6-4266-9CA0-19364C90A0B3} = C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
PhotagSearch@{181ED3BC-91D2-4424-B8E1-922B8F55BF56} = C:\Program Files\PhoTags Express\PWSSearchHandler.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll = C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
@{9030D464-4C02-4ABF-8ECC-5164760863C6}C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157
@Start Pagehttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://google.ca/ = http://google.ca/
@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\system32\itss.dll
livecall@CLSID = C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\system32\itss.dll
msnim@CLSID = C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
mso-offdap11@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll
wia@CLSID = C:\WINDOWS\system32\wiascr.dll

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters@Domain = ctree.net

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004@LibraryPath = C:\Program Files\Bonjour\mdnsNSP.dll

C:\Documents and Settings\All Users\Start Menu\Programs\Startup >>>
Adobe Reader Speed Launch.lnk = Adobe Reader Speed Launch.lnk
Kodak EasyShare software.lnk = Kodak EasyShare software.lnk

—- EOF - GMER 1.0.14 —-
Post #25
Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-09-30 22:50:44
Microsoft Windows XP Professional Service Pack 3
System drive C: has 20 GB (26%) free of 76 GB
Total RAM: 1014 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:50:52 PM, on 9/30/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\jhitchens\Desktop\RSIT.exe
C:\Program Files\trend micro\jhitchens.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [Client Access PC5250 Sound] "C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.crabtree-evelyn.ca
O15 - Trusted Zone: http://www.kaspersky.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1128965542125
O16 - DPF: {79D6214F-CFCE-480F-9901-27950E78F1E6} (WebCacheCleaner Class) - https://ssl-vpn.crabtree-evelyn.com/MLWebCacheCleaner.cab
O16 - DPF: {A6A216EB-4F7C-11D5-8438-0000B456BA3D} (Matn5250 Control) - https://ssl-vpn.crabtree-evelyn.com/cgi-bin….1/matn5250.cab
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - http://www.yoyogames.com/downloads/activex/YoYo.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ctree.net
O17 - HKLM\Software\..\Telephony: DomainName = ctree.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ctree.net
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe

–
End of file - 8885 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job
C:\WINDOWS\tasks\New Task.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-06-16 221184]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-06-16 81920]
"Realtime Monitor"=C:\PROGRA~1\CA\ETRUST~1\realmon.exe [2004-04-06 504080]
"Client Access Service"=C:\Program Files\IBM\Client Access\cwbsvstr.exe [2005-06-05 20480]
"Client Access Help Update"=C:\Program Files\IBM\Client Access\cwbinhlp.exe [2005-06-05 24576]
"Client Access Check Version"=C:\Program Files\IBM\Client Access\cwbckver.exe [2005-06-05 45106]
"Client Access Express Welcome"=C:\Program Files\IBM\Client Access\cwbwlwiz.exe [2005-06-05 20480]
"Client Access PC5250 Sound"=C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe [2005-06-05 40960]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2004-10-14 1404928]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-03-17 339968]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-10-14 94208]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-10-14 77824]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-10-14 114688]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"GW Port Controller"=C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE [2004-02-09 163840]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-09-10 289576]
"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe [2006-12-22 67752]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"Steam"=C:\Program Files\Steam\Steam.exe [2008-03-28 1271032]
"updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-10-14 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CA\eTrust Antivirus\InoRpc.exe"="C:\Program Files\CA\eTrust Antivirus\InoRpc.exe:*:Enabled:eTrust Antivirus - RPC Server"
"C:\Program Files\CA\eTrust Antivirus\InocIT.exe"="C:\Program Files\CA\eTrust Antivirus\InocIT.exe:*:Enabled:eTrust Antivirus - Local Scanner"
"C:\Program Files\CA\eTrust Antivirus\Realmon.exe"="C:\Program Files\CA\eTrust Antivirus\Realmon.exe:*:Enabled:eTrust Antivirus - Realtime monitor"
"C:\Program Files\CA\eTrust Antivirus\InoNmSrv.exe"="C:\Program Files\CA\eTrust Antivirus\InoNmSrv.exe:*:Enabled:eTrust Antivirus - Admin Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Autodesk\backburner\monitor.exe"="C:\Program Files\Autodesk\backburner\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\Program Files\Autodesk\backburner\manager.exe"="C:\Program Files\Autodesk\backburner\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\Program Files\Autodesk\backburner\server.exe"="C:\Program Files\Autodesk\backburner\server.exe:*:Enabled:backburner 2.3 server"
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"="C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a334d25-3988-11da-8973-806d6172696f}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL docs\index.html

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{896f3869-26f0-11da-8633-806d6172696f}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL docs\index.html


======List of files/folders created in the last 1 months======

2008-09-30 22:50:45 —-D—- C:\Program Files\trend micro
2008-09-30 22:50:44 —-D—- C:\rsit
2008-09-30 22:29:21 —-A—- C:\WINDOWS\gmer.ini
2008-09-30 22:29:18 —-A—- C:\WINDOWS\gmer_uninstall.cmd
2008-09-30 22:29:18 —-A—- C:\WINDOWS\gmer.exe
2008-09-30 22:29:18 —-A—- C:\WINDOWS\gmer.dll
2008-09-28 13:48:05 —-A—- C:\WINDOWS\system32\vfwwdm32.dll
2008-09-28 13:44:07 —-D—- C:\Program Files\MyDSC2
2008-09-28 13:44:07 —-D—- C:\Program Files\Mars
2008-09-28 13:44:04 —-D—- C:\Program Files\JL2005C
2008-09-28 13:43:07 —-D—- C:\Program Files\PhoTags Express
2008-09-28 09:56:10 —-SHD—- C:\RECYCLER
2008-09-27 08:12:23 —-D—- C:\WINDOWS\temp
2008-09-27 08:12:22 —-A—- C:\ComboFix.txt
2008-09-21 19:28:46 —-A—- C:\Boot.bak
2008-09-21 19:28:34 —-D—- C:\cmdcons
2008-09-21 19:27:54 —-D—- C:\WINDOWS\erdnt
2008-09-21 19:27:40 —-D—- C:\QooBox
2008-09-21 19:27:38 —-A—- C:\WINDOWS\zip.exe
2008-09-21 19:27:38 —-A—- C:\WINDOWS\VFind.exe
2008-09-21 19:27:38 —-A—- C:\WINDOWS\swxcacls.exe
2008-09-21 19:27:38 —-A—- C:\WINDOWS\SWSC.exe
2008-09-21 19:27:38 —-A—- C:\WINDOWS\swreg.exe
2008-09-21 19:27:38 —-A—- C:\WINDOWS\sed.exe
2008-09-21 19:27:38 —-A—- C:\WINDOWS\Nircmd.exe
2008-09-21 19:27:38 —-A—- C:\WINDOWS\grep.exe
2008-09-21 19:27:38 —-A—- C:\WINDOWS\fdsv.exe
2008-09-19 20:27:20 —-N—- C:\WINDOWS\system32\pxsfs.dll
2008-09-19 20:27:20 —-N—- C:\WINDOWS\system32\pxinsi64.exe
2008-09-19 20:27:20 —-N—- C:\WINDOWS\system32\pxinsa64.exe
2008-09-19 20:27:20 —-N—- C:\WINDOWS\system32\pxcpyi64.exe
2008-09-19 20:27:20 —-N—- C:\WINDOWS\system32\pxcpya64.exe
2008-09-18 16:28:33 —-D—- C:\Documents and Settings\jhitchens\Application Data\WTablet
2008-09-18 16:27:40 —-D—- C:\WINDOWS\system32\WTablet
2008-09-18 16:27:38 —-N—- C:\WINDOWS\system32\Wintab32.dll
2008-09-18 16:27:38 —-N—- C:\WINDOWS\system32\Pen_Tablet.dll
2008-09-18 16:27:37 —-N—- C:\WINDOWS\system32\Pen_Tablet.exe
2008-09-18 16:27:32 —-D—- C:\Program Files\Tablet
2008-09-15 20:28:07 —-D—- C:\Program Files\iPod
2008-09-15 20:28:05 —-D—- C:\Program Files\iTunes
2008-09-15 20:28:05 —-D—- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-15 20:26:34 —-D—- C:\Program Files\Bonjour
2008-09-15 20:25:22 —-D—- C:\Program Files\QuickTime
2008-09-14 11:26:42 —-A—- C:\WINDOWS\system32\376oW6xQ.exe_
2008-09-12 10:55:42 —-D—- C:\Documents and Settings\jhitchens\Application Data\Malwarebytes
2008-09-12 10:55:38 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 10:55:38 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-09 22:57:18 —-HDC—- C:\WINDOWS\$NtUninstallKB938464$
2008-09-08 21:26:32 —-D—- C:\Program Files\Game_Maker
2008-09-08 20:21:34 —-D—- C:\Program Files\High-Logic
2008-09-08 20:21:34 —-D—- C:\Documents and Settings\jhitchens\Application Data\FontCreator
2008-09-07 10:23:25 —-D—- C:\Hijackthis
2008-09-06 03:20:40 —-A—- C:\WINDOWS\system32\c7fiT557.exe
2008-09-01 23:12:48 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-09-01 02:49:37 —-A—- C:\WINDOWS\system32\wmpns.dll
2008-09-01 02:48:38 —-D—- C:\WINDOWS\Prefetch
2008-09-01 00:43:36 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-09-01 00:43:28 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-09-01 00:43:21 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-09-01 00:43:13 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-09-01 00:43:06 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-01 00:43:00 —-HDC—- C:\WINDOWS\$NtUninstallKB951376$
2008-09-01 00:42:48 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-09-01 00:42:41 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-09-01 00:42:34 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-09-01 00:42:24 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-09-01 00:37:01 —-D—- C:\WINDOWS\system32\scripting
2008-09-01 00:37:00 —-D—- C:\WINDOWS\l2schemas
2008-09-01 00:36:59 —-D—- C:\WINDOWS\system32\en
2008-09-01 00:36:57 —-D—- C:\WINDOWS\system32\bits
2008-09-01 00:31:33 —-D—- C:\WINDOWS\ServicePackFiles
2008-09-01 00:21:21 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-08-31 23:26:55 —-D—- C:\Program Files\MSECache

======List of files/folders modified in the last 1 months======

2008-09-30 22:50:45 —-RD—- C:\Program Files
2008-09-30 22:48:52 —-D—- C:\Program Files\Mozilla Firefox
2008-09-30 22:29:21 —-D—- C:\WINDOWS
2008-09-30 22:29:18 —-D—- C:\WINDOWS\system32\drivers
2008-09-30 20:00:00 —-A—- C:\WINDOWS\SchedLgU.Txt
2008-09-30 14:43:55 —-D—- C:\Documents and Settings\jhitchens\Application Data\mIRC
2008-09-30 14:43:21 —-D—- C:\Program Files\mIRC
2008-09-30 07:13:35 —-D—- C:\WINDOWS\system32\CatRoot2
2008-09-30 06:41:12 —-D—- C:\Program Files\Steam
2008-09-30 06:39:07 —-A—- C:\WINDOWS\smscfg.ini
2008-09-29 16:39:24 —-A—- C:\WINDOWS\SSDS32.INI
2008-09-29 09:42:48 —-RSHDC—- C:\WINDOWS\system32\dllcache
2008-09-28 13:48:31 —-D—- C:\WINDOWS\system32
2008-09-28 13:47:42 —-HD—- C:\WINDOWS\inf
2008-09-28 13:44:07 —-D—- C:\WINDOWS\twain_32
2008-09-27 08:10:49 —-A—- C:\WINDOWS\system.ini
2008-09-27 08:08:35 —-D—- C:\WINDOWS\AppPatch
2008-09-27 08:08:35 —-D—- C:\Program Files\Common Files
2008-09-25 16:25:19 —-D—- C:\Documents and Settings\jhitchens\Application Data\gtk-2.0
2008-09-21 19:35:41 —-D—- C:\WINDOWS\system32\config
2008-09-21 19:28:47 —-RASH—- C:\boot.ini
2008-09-20 12:28:43 —-D—- C:\temp
2008-09-20 11:36:24 —-D—- C:\WINDOWS\system32\CatRoot
2008-09-20 01:42:28 —-D—- C:\WINDOWS\security
2008-09-19 20:37:07 —-SHD—- C:\WINDOWS\Installer
2008-09-19 20:36:38 —-D—- C:\Program Files\Adobe
2008-09-19 20:36:37 —-D—- C:\Documents and Settings\All Users\Application Data\Adobe
2008-09-19 20:33:29 —-D—- C:\Documents and Settings\jhitchens\Application Data\Adobe
2008-09-19 20:30:26 —-D—- C:\Program Files\Common Files\Adobe
2008-09-19 20:27:17 —-D—- C:\WINDOWS\RegisteredPackages
2008-09-19 20:26:20 —-N—- C:\WINDOWS\system32\vxblock.dll
2008-09-19 20:26:17 —-N—- C:\WINDOWS\system32\pxdrv.dll
2008-09-19 20:26:17 —-A—- C:\WINDOWS\system32\px.dll
2008-09-19 20:26:16 —-N—- C:\WINDOWS\system32\pxwave.dll
2008-09-19 20:26:16 —-N—- C:\WINDOWS\system32\pxmas.dll
2008-09-19 20:26:16 —-N—- C:\WINDOWS\system32\pxhpinst.exe
2008-09-19 20:26:01 —-A—- C:\WINDOWS\ODBCINST.INI
2008-09-18 16:28:07 —-D—- C:\WINDOWS\system32\ReinstallBackups
2008-09-15 20:28:37 —-DC—- C:\WINDOWS\system32\DRVSTORE
2008-09-15 20:25:26 —-D—- C:\Program Files\Common Files\Apple
2008-09-13 08:11:45 —-SHD—- C:\WINDOWS\CSC
2008-09-09 22:57:19 —-D—- C:\WINDOWS\WinSxS
2008-09-07 18:01:03 —-D—- C:\Program Files\Ruff-Rose
2008-09-06 03:35:17 —-SD—- C:\WINDOWS\Tasks
2008-09-01 23:13:00 —-A—- C:\WINDOWS\imsins.BAK
2008-09-01 10:40:38 —-D—- C:\Program Files\Angband
2008-09-01 09:55:34 —-A—- C:\WINDOWS\OEWABLog.txt
2008-09-01 06:35:22 —-HD—- C:\WINDOWS\$hf_mig$
2008-09-01 02:50:37 —-A—- C:\WINDOWS\system32\PerfStringBackup.INI
2008-09-01 02:48:44 —-A—- C:\WINDOWS\setuplog.txt
2008-09-01 02:48:10 —-D—- C:\WINDOWS\system32\Setup
2008-09-01 02:48:09 —-D—- C:\WINDOWS\system32\wbem
2008-09-01 02:48:08 —-RSD—- C:\WINDOWS\Fonts
2008-09-01 00:42:27 —-D—- C:\Program Files\Messenger
2008-09-01 00:37:29 —-D—- C:\WINDOWS\system32\inetsrv
2008-09-01 00:37:28 —-D—- C:\WINDOWS\network diagnostic
2008-09-01 00:37:28 —-D—- C:\WINDOWS\ime
2008-09-01 00:37:28 —-D—- C:\WINDOWS\Help
2008-09-01 00:37:03 —-D—- C:\WINDOWS\system32\usmt
2008-09-01 00:37:03 —-D—- C:\WINDOWS\system32\en-US
2008-09-01 00:36:57 —-D—- C:\WINDOWS\PeerNet
2008-09-01 00:36:57 —-D—- C:\Program Files\Movie Maker
2008-09-01 00:31:16 —-D—- C:\WINDOWS\system32\Restore
2008-09-01 00:31:15 —-D—- C:\WINDOWS\system32\npp
2008-09-01 00:31:15 —-D—- C:\WINDOWS\mui
2008-09-01 00:31:13 —-D—- C:\WINDOWS\msagent
2008-09-01 00:31:11 —-D—- C:\WINDOWS\srchasst
2008-09-01 00:31:09 —-D—- C:\Program Files\NetMeeting
2008-09-01 00:31:07 —-D—- C:\WINDOWS\system32\Com
2008-09-01 00:31:01 —-D—- C:\Program Files\Windows Media Player
2008-09-01 00:31:00 —-D—- C:\Program Files\Windows NT
2008-09-01 00:31:00 —-D—- C:\Program Files\Outlook Express
2008-09-01 00:30:55 —-D—- C:\Program Files\Common Files\System
2008-09-01 00:30:24 —-D—- C:\WINDOWS\system32\oobe
2008-09-01 00:30:21 —-D—- C:\WINDOWS\system
2008-09-01 00:21:20 —-D—- C:\WINDOWS\ehome
2008-08-31 23:27:18 —-D—- C:\Program Files\Microsoft Office
2008-08-31 23:27:16 —-D—- C:\Program Files\Common Files\Microsoft Shared

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 DcCam;Kodak Camera Proxy; C:\WINDOWS\system32\DRIVERS\DcCam.sys [2005-06-16 37150]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R2 DCFS2K;Kodak DCFS2K Driver; C:\WINDOWS\system32\drivers\dcfs2k.sys [2005-03-31 38673]
R2 DgivEcp;Team MFP Comm Driver; C:\WINDOWS\System32\Drivers\DgivEcp.Sys [2004-05-17 41984]
R2 INO_FLTR;INO_FLTR; \??\C:\WINDOWS\system32\Drivers\ino_fltr.sys []
R3 b57w2k;Broadcom NetXtreme 57xx Gigabit Controller; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-03-17 132608]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-10-14 1302812]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-09-17 732928]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-01-27 260352]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 wacommousefilter;Wacom Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
R3 wacomvhid;Wacom Virtual Hid Driver; C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2007-02-16 12848]
R3 WacomVKHid;Virtual Keyboard Driver; C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys [2007-02-15 11440]
S1 Exportit;Exportit; C:\WINDOWS\system32\DRIVERS\exportit.sys [2005-03-31 152081]
S3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys []
S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-03-14 1032192]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 Ch2kHUB;Cherry USB Hub Driver for CDI; C:\WINDOWS\System32\drivers\Ch2kHUB.sys [2003-07-15 82048]
S3 Ch2kUSB;Cherry USB Driver for CDI; C:\WINDOWS\System32\drivers\Ch2kUSB.sys [2003-07-15 82382]
S3 DcFpoint;DcFpoint; C:\WINDOWS\system32\DRIVERS\DcFpoint.sys [2005-03-31 61564]
S3 DcLps;Legacy Polling Service; C:\WINDOWS\system32\DRIVERS\DcLps.sys [2005-03-31 8022]
S3 DcPTP;dcptp; C:\WINDOWS\system32\DRIVERS\DcPTP.sys [2005-03-31 70262]
S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2008-09-30 85969]
S3 JL2005C;Dual Mode Camera; C:\WINDOWS\System32\Drivers\jl2005c.sys [2007-11-17 68954]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 prepdrvr;SMS Process Event Driver; \??\C:\WINDOWS\system32\CCM\prepdrv.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SSLDrv;SSL-VPN NetExtender Adapter; C:\WINDOWS\system32\DRIVERS\SSLDrv.sys [2007-10-23 19376]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeActiveFileMonitor5.0;Adobe Active File Monitor V5; C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [2006-12-22 108712]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-10 116040]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 CcmExec;SMS Agent Host; C:\WINDOWS\system32\CCM\CcmExec.exe [2007-04-13 590712]
R2 InoRPC;eTrust Antivirus RPC Server; C:\Program Files\CA\eTrust Antivirus\InoRpc.exe [2004-04-06 139536]
R2 InoRT;eTrust Antivirus Realtime Server; C:\Program Files\CA\eTrust Antivirus\InoRT.exe [2004-04-06 241936]
R2 InoTask;eTrust Antivirus Job Server; C:\Program Files\CA\eTrust Antivirus\InoTask.exe [2004-10-08 419369]
R2 TabletServicePen;TabletServicePen; C:\WINDOWS\system32\Pen_Tablet.exe [2007-09-07 1373480]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-09-10 536872]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-03-14 352256]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-03-17 516096]
S2 LogWatch;Event Log Watch; C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 KodakCCS;Kodak Camera Connection Software; C:\WINDOWS\system32\drivers\KodakCCS.exe [2005-03-30 411920]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WmcCds;Windows Media Connect (WMC); c:\program files\windows media connect\mswmccds.exe [2004-08-11 483328]
S3 WmcCdsLs;Windows Media Connect (WMC) Helper; C:\Program Files\Windows Media Connect\mswmcls.exe [2004-08-10 28160]

—————–EOF—————–
info.txt logfile of random's system information tool 1.04 2008-09-30 22:50:55

======Uninstall list======

–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL10.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL11.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL12.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL13.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL14.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL2.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL3.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\Emulator\DeIsL1.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\Emulator\DeIsL2.isu"
–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\Emulator\DeIsL8.isu"
–>MsiExec.exe /I{C4CBAD7E-DF4A-4FEC-AC17-8BC709AFB844}
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2547E065-D92D-11D6-8586-006008CA5356}\setup.exe" -l0x9 uninstall
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{333D93A7-505C-11D6-857A-006008CA5356}\setup.exe" -l0x9 uninstall
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{501F5586-5040-11D6-857A-006008CA5356}\setup.exe" -l0x9 uninstall
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D94854D4-505E-11D6-857A-006008CA5356}\setup.exe" -l0x9 uninstall
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D9485541-505E-11D6-857A-006008CA5356}\setup.exe" -l0x9 uninstall
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D94855AD-505E-11D6-857A-006008CA5356}\setup.exe" -l0x9 uninstall
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E226D4BA-4FAD-11D6-857A-006008CA5356}\setup.exe" -l0x9 uninstall
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Help Center 2.1–>MsiExec.exe /I{25569723-DC5A-4467-A639-79535BF01B71}
Adobe Photoshop Elements 5.0–>msiexec /I {A7B609FB-83D8-4FC3-8477-1BC65ECFE85B}
Adobe Reader 7.0.9–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
Adobe Shockwave Player–>C:\WINDOWS\system32\Adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Age of Chivalry 1.0.0–>c:\program files\steam\SteamApps\SourceMods\ageofchivalry\uninst.exe
Age of Mythology - The Titans Expansion–>"C:\Program Files\Microsoft Games\Age of Mythology\UNINSTXP.EXE" /runtemp /addremove
Age of Mythology–>"C:\Program Files\Microsoft Games\Age of Mythology\UNINSTAL.EXE" /runtemp /addremove
Angband 3.0.5–>"C:\Program Files\Angband\uninst\unins000.exe"
Anvil Studio–>C:\WINDOWS\system32\AsUninst.exe
Apple Mobile Device Support–>MsiExec.exe /I{AA9768AA-FF0B-4C66-A085-31E934F77841}
Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI - Software Uninstall Utility–>C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Control Panel–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver–>rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6–>"C:\Program Files\Audacity\unins000.exe"
Audiosurf Demo–>"C:\Program Files\Steam\steam.exe" steam://uninstall/12910
Autodesk 3ds Max 8 Reference Files–>MsiExec.exe /I{73C935A7-36C6-48B5-A32E-FD5BD96FD25C}
Autodesk 3ds Max 8 Tutorials–>MsiExec.exe /I{BAE0C8E1-D7EF-4493-8D07-9CC1FC7A346C}
Autodesk DWF Viewer–>C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove
Backburner–>MsiExec.exe /I{3D347E6D-5A03-4342-B5BA-6A771885F379}
Blender (remove only)–>"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Blitz3D Demo V1.83–>"C:\Program Files\Blitz3D Demo\unins000.exe"
Bonjour–>MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Broadcom Gigabit Integrated Controller–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BE6890C7-31EF-478C-812E-1E2899ABFCA9} /l1033
CA eTrust Antivirus–>MsiExec.exe /X{99747F0D-D4F8-4877-9CA0-4AE96D963633}
CardRd81–>MsiExec.exe /I{54C8FE84-89C4-40E8-976C-439EB0729BD6}
Cavaj Java Decompiler–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Cavaj Java Decompiler\Uninst.isu"
CCScore–>MsiExec.exe /I{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}
Compatibility Pack for the 2007 Office system–>MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
CorelDRAW Graphics Suite 12 Setup Files–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BD65CAC7-6D63-4D56-BED0-B610281256DF}\setup.exe" -l0x9 -removeonly
CorelDRAW Graphics Suite 12–>MsiExec.exe /I{465DC07E-3390-401A-A190-6078D73AB4C6}
CR2–>MsiExec.exe /I{432C3720-37BF-4BD7-8E49-F38E090246D0}
Crafty 1.0.0 Alpha 14–>"C:\Program Files\Crafty\unins000.exe"
DeleD 3D Editor 1.81 LITE–>"C:\Program Files\DeleD LITE\unins000.exe"
Diablo II–>C:\WINDOWS\DIIUnin.exe C:\WINDOWS\DIIUnin.dat
DivX Codec–>C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
Dungeon Keeper Gold–>C:\WINDOWS\uninst.exe -fC:\WINDOWS\SYSTEM\KEEPER\DeIsL2.isu
Dungeon Siege–>"C:\Program Files\Microsoft Games\Dungeon Siege\UNINSTAL.EXE" /runtemp /addremove
ESSBrwr–>MsiExec.exe /I{643EAE81-920C-4931-9F0B-4B343B225CA6}
ESSCDBK–>MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}
ESScore–>MsiExec.exe /I{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}
ESSCT–>MsiExec.exe /I{8BB4B58A-A402-4DE8-8FCD-287E60B88DD8}
ESSEMAIL–>MsiExec.exe /I{FEDE2483-87B7-44C1-A5BB-D75AEB8B6340}
ESSgui–>MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A}
ESShelp–>MsiExec.exe /I{87843A41-7808-4F2E-B13F-25C1E67CF2FD}
ESSini–>MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765}
ESSPCD–>MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}
ESSPDock–>MsiExec.exe /I{FCDB1C92-03C6-4C76-8625-371224256091}
ESSSONIC–>MsiExec.exe /I{4F677FC7-7AA8-412B-A957-F13CBE1C7331}
ESSTOOLS–>MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589}
ESSTUTOR–>MsiExec.exe /I{CA60320D-6A16-49C8-A34F-84EEF4799567}
essvcpt–>MsiExec.exe /I{D1973749-F5E7-40EB-B528-F2B78685B9FF}
ESSvpaht–>MsiExec.exe /I{A5B3EB8A-4071-42F0-8E8E-7A8342AA8E69}
ESSvpot–>MsiExec.exe /I{48C82F7A-F100-4DAB-A310-8E18BF2159E1}
eTIMEsheet–>C:\WINDOWS\IsUninst.exe -f"c:\Program Files\e-TIMEsheet\Uninst.isu" -c"c:\Program Files\e-TIMEsheet\_UNODBC.DLL"
Finale NotePad 2006–>C:\WINDOWS\unvise32.exe C:\Program Files\Finale NotePad 2006\uninstal.log
Flash Decompiler Trillix–>"C:\Program Files\Eltima Software\Flash Decompiler Trillix\unins000.exe"
FontCreator 5.6–>"C:\Program Files\High-Logic\FontCreator\unins000.exe"
Frets on Fire MFH-Alarian Mod v2.955–>"C:\Program Files\Frets on Fire MFH\unins000.exe"
Frets On Fire–>"C:\Program Files\Frets on Fire\Uninstall.exe"
Game Cam 2.1–>C:\Program Files\Game Cam V2\uninst.exe
Game Maker 7.0–>C:\Program Files\Game_Maker7\Uninstal.exe
GameSpy Arcade–>C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG
GCFScape 1.6.7–>"C:\Program Files\GCFScape\unins000.exe"
GIMP 2.4.6–>"C:\Program Files\GIMP-2.0\setup\unins000.exe"
Guild Wars–>"C:\Program Files\Guild Wars\Gw.exe" -uninstall
Half-Life 2: Episode One–>"C:\Program Files\Steam\steam.exe" steam://uninstall/380
Half-Life 2: Episode Two–>"C:\Program Files\Steam\steam.exe" steam://uninstall/420
Half-Life 2–>"C:\Program Files\Steam\steam.exe" steam://uninstall/220
Heroes of Might and Magic II–>C:\WINDOWS\uninst.exe -f"C:\Program Files\Heroes2\DeIsL1.isu"
HighMAT Extension to Microsoft Windows XP CD Writing Wizard–>MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
Hijackthis 1.99.1–>"C:\Hijackthis\unins000.exe"
HijackThis 2.0.2–>"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HLPIndex–>MsiExec.exe /I{38441BE7-79B0-42B8-8297-833704F949FE}
HLPPDOCK–>MsiExec.exe /I{154508C0-07C5-4659-A7A0-E49968750D21}
HLPSFO–>MsiExec.exe /I{8DD94CA3-BCD2-49C0-B537-F3B5D95FF0C8}
Hotfix for Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
HyperCam 2–>"C:\Program Files\HyCam2\UnHyCam2.exe"
IBM iSeries Access for Windows SI18651–>"C:\Program Files\IBM\Client Access\cwbunsp.exe"
IBM iSeries Access for Windows–>"C:\Program Files\IBM\Client Access\cwbinarp.exe"
Intel® Graphics Media Accelerator Driver–>RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV;_2776 PCI\VEN_8086&DEV;_2772
IrfanView (remove only)–>C:\Program Files\IrfanView\iv_uninstall.exe
iTunes–>MsiExec.exe /I{41B9E2CF-0B3F-442A-B5B3-592A4A355634}
Java DB 10.3.1.4–>MsiExec.exe /X{CD49361E-3FE6-457E-90A1-9C59E29B5D02}
Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java™ 6 Update 6–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java™ SE Development Kit 6 Update 6–>MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160060}
Kodak EasyShare software–>C:\Documents and Settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_a0005_c3628\Setup.exe /APR-REMOVE
KSU–>MsiExec.exe /I{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}
LastChaos–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0AF3FEAE-B651-4421-97EF-4808A588B4E5}\Setup.exe" -l0x9
Malwarebytes' Anti-Malware–>"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Maplet–>C:\Program Files\Maplet\uninstall.exe
Master of Orion II–>C:\WINDOWS\uninst.exe -f"C:\Program Files\Microprose\Orion2\DeIsL1.isu"
Microsoft .NET Framework 1.1 Hotfix (KB928366)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Age of Empires II–>"C:\Program Files\Microsoft Games\Age of Empires II\UNINSTAL.EXE" /runtemp /uninstall
Microsoft Age of Empires–>C:\Program Files\Microsoft Games\Age of Empires\Uninstal.exe /uninstall
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Standard Edition 2003–>MsiExec.exe /I{90120409-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight–>MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
MilkShape 3D 1.8.2–>"C:\Program Files\MilkShape 3D 1.8.2\uninstall.exe"
mIRC–>C:\Program Files\mIRC\uninstall.exe _?=C:\Program Files\mIRC
MobileMe Control Panel–>MsiExec.exe /I{6DA9102E-199F-43A0-A36B-6EF48081A658}
Mozilla Firefox (3.0.3)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML4 Parser–>MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}
Notifier–>MsiExec.exe /I{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}
OfotoXMI–>MsiExec.exe /I{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}
OTtBP–>MsiExec.exe /I{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}
OTtBPSDK–>MsiExec.exe /I{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}
PE Explorer 1.99 R2–>"C:\Program Files\PE Explorer\unins000.exe"
Pen Tablet–>C:\Program Files\Tablet\Pen\Remove.exe /u
PhoTags Express –>C:\PROGRA~1\PHOTAG~1\Setup.exe /remove
Portal–>"C:\Program Files\Steam\steam.exe" steam://uninstall/400
quick3D Viewer [shareware]–>"C:\Program Files\quick3D Viewer\un-quick3D Viewer [shareware].exe"
QuickTime–>MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
RealWorld Cursor Editor–>MsiExec.exe /I{4B2DEF0C-51B4-4250-A082-7C3CD4FB2828}
RSDemon 2–>"C:\Program Files\RSDemon\uninstall.exe"
Ruff-Rose V773.2–>"C:\Program Files\Ruff-Rose\unins000.exe"
Samsung SCX-4x16 Series (TWAIN)–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0D2EDE81-878F-400D-A5C3-3EC445F47750}\Setup.exe" -l0x9
Security Update for Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)–>C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
SFR–>MsiExec.exe /I{DB02F716-6275-42E9-B8D2-83BA2BF5100B}
SHASTA–>MsiExec.exe /I{605A4E39-613C-4A12-B56F-DEFBE6757237}
SKIN0001–>MsiExec.exe /I{FDF9943A-3D5C-46B3-9679-586BD237DDEE}
SKINXSDK–>MsiExec.exe /I{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}
SmarThru–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1CE06390-46D0-11D6-8578-006008CA5356}\setup.exe" -l0x9 uninstall -l0009
Sothink SWF Decompiler–>"C:\Program Files\SourceTec\Sothink SWF Decompiler\unins000.exe"
SoundMAX–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\SETUP.exe" -l0x9 -removeonly
Source SDK–>"C:\Program Files\Steam\steam.exe" steam://uninstall/211
Space Empires III–>C:\PROGRA~1\MALFAD~1\SPACEE~1\UNWISE.EXE C:\PROGRA~1\MALFAD~1\SPACEE~1\INSTALL.LOG
Steam–>MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Tattoo–>"C:\Program Files\Tattoo\uninstall.exe"
Team Fortress 2–>"C:\Program Files\Steam\steam.exe" steam://uninstall/440
TeamSpeak 2 RC2–>"C:\Program Files\Teamspeak2_RC2\unins000.exe"
Uninstall Dual Mode Camera–>"C:\Program Files\JL2005C\unins000.exe"
Update for Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)–>"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
v1.20–>"c:\Lazarus\unins000.exe"
VDMSound–>C:\Program Files\VDMSound\uninst.exe
Ventrilo Client–>MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Virtools 3D Life Player–>C:\Program Files\Virtools\3D Life Player\WebplayerConfig.exe -u
VPRINTOL–>MsiExec.exe /I{999D43F4-9709-4887-9B1A-83EBB15A8370}
VTFEdit 1.2.5–>"C:\Program Files\VTFEdit\unins000.exe"
Warrior Kings–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\Microids\Warrior Kings\UnInstall\setup.exe"
Windows Genuine Advantage v1.3.0254.0–>MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
Windows Live installer–>MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger–>MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant–>MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Media Connect–>msiexec.exe /I {F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}
Windows Media Connect–>MsiExec.exe /I{F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}
Windows Media Format Runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Service Pack 3–>"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver–>C:\Program Files\WinRAR\uninstall.exe
WIRELESS–>MsiExec.exe /I{F9593CFB-D836-49BC-BFF1-0E669A411D9F}

======Environment variables======

"AVENGINE"=C:\PROGRA~1\CA\SHARED~1\SCANEN~1
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"INOCULAN"=C:\PROGRA~1\CA\ETRUST~1
"NUMBER_OF_PROCESSORS"=2
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;;C:\PROGRA~1\CA\SHARED~1\SCANEN~1;C:\PROGRA~1\CA\ETRUST~1;C:\PROGRA~1\IBM\CLIENT~1;C:\PROGRA~1\IBM\CLIENT~1\Shared;C:\PROGRA~1\IBM\CLIENT~1\Emulator;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\Common Files\Autodesk Shared\;C:\Program Files\Autodesk\backburner\;C:\Program Files\VDMSound;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Java\jdk1.6.0_06\bin
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 4, GenuineIntel
"PROCESSOR_LEVEL"=15
"PROCESSOR_REVISION"=0604
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"sourcesdk"=c:\program files\steam\steamapps\makofan\sourcesdk
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"VDMSPath"=C:\Program Files\VDMSound
"VProject"=c:\program files\steam\steamapps\makofan\half-life 2\hl2
"windir"=%SystemRoot%

—————–EOF—————–
Post #26
1) Copy and paste the following into Notepad (Start > All Programs > Accessories > Notepad):

cho off
cd C:\WINDOWS\Tasks
attrib -r -s -h At*.job
del At*.job

Save it to your Desktop with the following filename, including quotation marks: "delete.bat"

Simply double click delete.bat to run it and then delete it.

2) Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked

3) Run the PC for a day or two and then post another HJT log and let me know how the PC is behaving. I want to know whether there are any other symptoms besides the AV warnings. Also, how long have they been happening and what software you installed immediately prior to them first happening.

The Win32/Adclicker.IV was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\F1XIS3A8.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/Cheqtal.U was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\T8NQE7JW.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\BW5E1861.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\O4A74RV7.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\EOU7PNTA.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\4S66KOHG.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 23, 2008 5:13PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\IIQY3F5L.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 23, 2008 9:14PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\V8A2S412.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 23, 2008 11:15PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\G3GAUX6B.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 24, 2008 3:27PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\QBYTOCQ3.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 24, 2008 5:27PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\A7SLWW5I.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 24, 2008 7:27PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\7D50M2IG.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 24, 2008 9:43PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\4A5I0VYH.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/VMalum.DTAQ was detected in C:\TEMP\2OW4T3SK.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: Cure failed, file restored.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\01CREX78.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/VMalum.DTAQ was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\01CREX78.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: Cure failed, file restored.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\BQ2D7KX8.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\70NJM7T1.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/VMalum.DTAQ was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\70NJM7T1.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: Cure failed, file restored.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\KHOR37N7.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 28, 2008 8:15PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\Y7C7N537.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

The Win32/VMalum.DTAQ was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\X58OIV0P.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: Cure failed, file restored.

The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\2LK5S20O.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 29, 2008 3:43PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\84IU2V0H.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

SEPT. 29, 2008 5:43PM
The Win32/Vxidl!generic was detected in C:\DOCUME~1\JHITCH~1\LOCALS~1\TEMP\6WK4J03N.EXE.
Machine: CRABTREE-20857B, User: CRABTREE-20857B\jhitchens.
File Status: File was cured; system cure performed.

All the detections are in the same folder and all have the same eight alphanumeric character name structure which suggests to me that they are related. Given that they are identified as four different nasties, i'm starting to suspect that your AV is just detecting a legitimate file as malicious and there isn't an infection on your machine.

I can't see anything in your logs to indicate any active malware and none of the scanners that i've had you run have picked up anything. The only one that is showing anything is your resident AV and that isn't identifying any other files that could be creating and dropping the files it is spotting.
Post #27
I have had no problems since the last fix. Thank you very much for your time, patie3nce, and energy - I learned a lot

Here is a final HJT log

Logfile of HijackThis v1.99.1
Scan saved at 4:18:40 PM, on 10/4/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [Client Access PC5250 Sound] "C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.crabtree-evelyn.ca
O15 - Trusted Zone: http://www.kaspersky.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1128965542125
O16 - DPF: {79D6214F-CFCE-480F-9901-27950E78F1E6} (WebCacheCleaner Class) - https://ssl-vpn.crabtree-evelyn.com/MLWebCacheCleaner.cab
O16 - DPF: {A6A216EB-4F7C-11D5-8438-0000B456BA3D} (Matn5250 Control) - https://ssl-vpn.crabtree-evelyn.com/cgi-bin….1/matn5250.cab
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - http://www.yoyogames.com/downloads/activex/YoYo.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ctree.net
O17 - HKLM\Software\..\Telephony: DomainName = ctree.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ctree.net
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe
Post #28
In that case, I think we'll call this a success. The log looks OK to me and no symptoms is always welcome.

1) Your copy of Adobe Reader is out of date - you can get the latest version here

2) Your log doesn't appear to show a third-party software firewall installed - if you have one, and i've missed it, please ignore this.
If you are relying the firewall that comes with Service Pack 2, then you need to install one. While the SP2 firewall is better than nothing, it doesn't monitor outgoing traffic, so anything malicious on your computer can 'phone home' at will.
If you are using a wireless router that comes with a NAT hardware firewall, this also doesn't monitor outgoing connections.

There are a few free firewalls available.
Comodo Firewall Pro, available here.
PC Tools Firewall Plus, available here.
Online Armor Free, available here.

It is important to note that you should only have one firewall installed at a time, but you can download them all to your Desktop and install each in turn to see which one you prefer.

Understanding and Using Firewalls: http://www.bleepingcomputer.com/tutorials/tutorial60.html

3) I want you to run your PC as normal for a few days and when you are happy that everything is fine, do the following:

Go to Start > Run, enter the following into the textbox and click OK: combofix /u
This will uninstall Combofix and do a little housework besides.

Create a new Restore Point - this will give a clean one should you need it in the future.
A tutorial for System Restore is available here.

The reason for waiting is that if removing the malware has caused a problem, which it occasionally does, you can put your PC back to how it was before the fix. This will re-install the malware, but an infected PC is better than an expensive paperweight!

Some bedtime reading: This is a very good tutorial about keeping your computer safe and secure on the internet.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI