Spyware / Malware / Virus Removal

[Resolved] Hello

9 min read

Looking for the outcome? Ask AI

Astone Topic Starter

Post #1November 17, 2008, 4:31 AM UTC

Hello WTT, as stated above this is my first attempt at posting my HJT log…well second actually, my first one wasn't posted because I had the wrong version of HJT, whoops! My main problem is that I believe that I am running to many process and it is dramatically slowing down my computer. My process tree is usually in the mid to high 60's in process running…I don't know about you guys, but that seems like overkill to me. I am using a Dell Inspiron 8600, OP is Windows XP Service pack 3…I think. I know that she is an older laptop, but she has treated me well, and I figured that I could do the same for her. So anywho, I would really appreciate any feedback on the Log, I of course will not go messing with anything until I hear back from you guys.

Thanks in advance,

Here is my log…its kind of a long one.

——————————————————————————————————————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:15 PM, on 11/16/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\SYSTEM32\acs.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\BacsTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\NETGEAR\WPN511\Utility\WPN511.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~2\NSCSRVCE.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2563EBC8-0E24-2ADD-2E87-25879CF0E89C} - (no file)
O2 - BHO: (no name) - {2563EBC8-0E27-59DF-2E80-2587E282E89E} - (no file)
O2 - BHO: (no name) - {2563EBCD-0E51-2FDE-2E82-2687EAF0E898} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {598C9C18-AB7A-4C37-90E0-96A704AB60CA} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {B8224214-ADAA-AC24-D14E-8E4D81A073C0} - (no file)
O3 - Toolbar: SuperBar - {761B6D7D-3776-4E1D-A16C-3839A05A58D0} - (no file)
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AS00_WPN511] C:\Program Files\NETGEAR\WPN511\Utility\WPN511.exe -hide
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: NETGEAR WPN311 Wireless Assistant.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: &Search - ?p=ZUxdm300YYUS
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D30829F-03CD-18DB-46B2-63DC65B69C4C} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {5657F6FD-7CDC-7968-3F76-36AF5E5A7942} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {5AE1F9DF-B68F-240D-B563-20451E4E6F03} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd…ows-i586-jc.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/180solutio…/bridge-c15.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O16 - DPF: {B5DD9A64-5C4B-4A48-BE56-97C1A8F85708} - http://204.177.92.198/quickdl/livevideo/fastvideoplayer.cab
O18 - Protocol: bw+0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\SYSTEM32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 26947 bytes

Tomk

Post #2November 17, 2008, 5:22 AM UTC

Hi Astone,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Astone

Post #3November 17, 2008, 5:45 AM UTC last edited November 17, 2008, 6:13 AM UTC

Thank you very much for the quick reply, I will do so now.

Ok, here are the results from the Combofix program.

——————————————————————————————————————–

ComboFix 08-11-16.04 - Adam Stone 2008-11-16 23:53:59.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1077 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\375013
c:\windows\system32\drivers\fad.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SVCPROC

((((((((((((((((((((((((( Files Created from 2008-10-17 to 2008-11-17 )))))))))))))))))))))))))))))))
.

2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\documents and settings\Adam Stone\Application Data\Malwarebytes
2008-11-16 23:16 . 2008-10-22 16:10 38,496 –a—— c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-11-16 23:16 . 2008-10-22 16:10 15,504 –a—— c:\windows\SYSTEM32\DRIVERS\mbam.sys
2008-11-16 22:20 . 2008-11-16 22:20 d——– c:\program files\Trend Micro
2008-11-12 23:12 . 2008-11-12 23:12 d——– c:\program files\ATI Technologies
2008-11-12 21:40 . 2008-11-12 21:40 d——– c:\program files\Microsoft Silverlight
2008-11-12 21:40 . 2008-11-12 21:40 d——– c:\documents and settings\Adam Stone\Application Data\Windows Desktop Search
2008-11-12 21:39 . 2008-11-12 21:39 d——– c:\windows\SYSTEM32\GroupPolicy
2008-11-12 21:39 . 2008-11-12 21:39 d——– c:\program files\Windows Desktop Search
2008-11-12 21:38 . 2008-03-07 11:02 192,000 ——— c:\windows\SYSTEM32\DLLCACHE\offfilt.dll
2008-11-12 21:38 . 2008-03-07 11:02 98,304 ——— c:\windows\SYSTEM32\DLLCACHE\nlhtml.dll
2008-11-12 21:38 . 2008-03-07 11:02 29,696 ——— c:\windows\SYSTEM32\DLLCACHE\mimefilt.dll
2008-11-12 21:37 . 2008-11-12 21:37 d——– c:\program files\Windows Media Connect 2
2008-11-12 21:35 . 2008-11-12 21:36 d——– c:\windows\SYSTEM32\DRIVERS\UMDF
2008-11-12 20:01 . 2008-11-12 20:01 d——– c:\windows\OPTIONS
2008-11-12 20:01 . 2006-04-10 18:41 200,704 –a—— c:\windows\SYSTEM32\WG1v2Lib.dll
2008-11-12 20:01 . 2006-03-27 17:53 167,808 –a—— c:\windows\SYSTEM32\DRIVERS\wg111v2.sys
2008-11-12 20:01 . 2003-11-18 09:27 155,648 –a—— c:\windows\SYSTEM32\IpLib.dll
2008-11-12 20:01 . 2005-12-29 00:16 114,688 -ra—— c:\windows\SYSTEM32\EnumDev111.dll
2008-11-12 20:01 . 2005-04-01 11:43 66,048 –a—— c:\windows\SYSTEM32\DRIVERS\EAPPkt.sys
2008-11-12 20:01 . 2002-10-02 08:57 13,532 –a—— c:\windows\SYSTEM32\DRIVERS\SjyPkt.sys
2008-11-12 04:34 . 2008-09-04 11:15 1,106,944 ——— c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-11-12 04:34 . 2008-10-24 05:21 455,296 ——— c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-10-24 00:05 . 2008-10-15 10:34 337,408 ——— c:\windows\SYSTEM32\DLLCACHE\netapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 05:16 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-11-14 21:00 ——— d—–w c:\program files\Norton Security Scan
2008-11-13 05:14 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-13 05:04 80,090 —-a-w c:\documents and settings\Adam Stone\Application Data\SMBIOSSP.exe
2008-11-13 02:01 ——— d—–w c:\program files\NETGEAR
2008-11-12 02:18 ——— d—–w c:\program files\World of Warcraft
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 03:11 ——— d—–w c:\program files\K-litePro
2008-10-21 01:24 34,042 —-a-w c:\documents and settings\Adam Stone\Application Data\wklnhst.dat
2008-10-16 20:13 202,776 —-a-w c:\windows\SYSTEM32\wuweb.dll
2008-10-16 20:13 202,776 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll
2008-10-16 20:13 1,809,944 —-a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 20:13 1,809,944 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
2008-10-16 20:12 561,688 —-a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 20:12 561,688 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll
2008-10-16 20:12 323,608 —-a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 20:12 323,608 —-a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
2008-10-16 20:09 92,696 —-a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll
2008-10-16 20:09 92,696 —-a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 20:09 51,224 —-a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 20:09 51,224 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
2008-10-16 20:09 43,544 —-a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 20:08 34,328 —-a-w c:\windows\SYSTEM32\wups.dll
2008-10-16 20:08 34,328 —-a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll
2008-10-16 20:06 268,648 —-a-w c:\windows\SYSTEM32\mucltui.dll
2008-10-16 20:06 208,744 —-a-w c:\windows\SYSTEM32\muweb.dll
2008-10-16 00:29 ——— d–h–w c:\documents and settings\Adam Stone\Application Data\Move Networks
2008-10-16 00:27 ——— d—–w c:\program files\Google
2008-10-15 03:00 ——— d—–w c:\program files\Valve
2008-10-15 02:42 ——— d—–w c:\program files\Bonjour
2008-10-15 01:29 ——— d—–w c:\documents and settings\All Users\Application Data\Blizzard
2008-10-03 17:41 6,066,176 —-a-w c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
2008-09-30 22:43 1,286,152 —-a-w c:\windows\SYSTEM32\msxml4.dll
2008-09-30 03:15 ——— d—–w c:\documents and settings\Adam Stone\Application Data\Apple Computer
2008-09-27 18:33 ——— d—–w c:\program files\Java
2008-09-27 18:32 ——— d—–w c:\program files\Common Files\Java
2008-09-15 12:12 1,846,400 —-a-w c:\windows\SYSTEM32\win32k.sys
2008-09-15 12:12 1,846,400 ——w c:\windows\SYSTEM32\DLLCACHE\win32k.sys
2008-09-10 01:14 1,307,648 —-a-w c:\windows\SYSTEM32\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\SYSTEM32\DLLCACHE\msxml6.dll
2008-09-08 10:41 333,824 ——w c:\windows\SYSTEM32\DLLCACHE\srv.sys
2008-09-04 17:15 1,106,944 —-a-w c:\windows\SYSTEM32\msxml3.dll
2008-08-27 08:24 3,593,216 —-a-w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
2008-08-25 08:38 13,824 —-a-w c:\windows\SYSTEM32\DLLCACHE\ieudinit.exe
2008-08-25 08:37 70,656 —-a-w c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-08-23 05:56 635,848 —-a-w c:\windows\SYSTEM32\DLLCACHE\iexplore.exe
2008-08-23 05:54 161,792 —-a-w c:\windows\SYSTEM32\DLLCACHE\ieakui.dll
2006-12-27 20:39 58,824 —-a-w c:\documents and settings\Adam Stone\Application Data\GDIPFONTCACHEV1.DAT
2005-01-27 23:51 400,288 -c–a-w c:\windows\INF\WPN311\WPN311.sys
2005-01-27 16:59 35,232 -c–a-w c:\windows\INF\WPN311\ME_INST.EXE
2005-01-27 16:59 26,112 -c–a-w c:\windows\INF\WPN311\install.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-02-02 155648]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 53096]
"AS00_WPN511"="c:\program files\NETGEAR\WPN511\Utility\WPN511.exe" [2005-02-02 483328]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-10 289064]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"bacstray"="BacsTray.exe" [2003-05-14 c:\windows\SYSTEM32\BacsTray.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WPN311 Wireless Assistant.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2005-02-21 4517888]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2008-11-12 745472]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 11:41 294912 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2004-01-13 14:17 110592 c:\windows\SYSTEM32\LgNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Adam Stone^Start Menu^Programs^Startup^MemTurbo.lnk]
path=c:\documents and settings\Adam Stone\Start Menu\Programs\Startup\MemTurbo.lnk
backup=c:\windows\pss\MemTurbo.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-13 18:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-01-28 10:43 2097488 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
–a—— 2008-02-29 15:03 1481968 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=2 (0x2)
"GoogleDesktopManager-093007-112848"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [2008-11-12 66048]
R3 AWINDIS5;AWINDIS5 Protocol Driver;\??\c:\windows\system32\AWINDIS5.SYS [2004-09-10 16194]
S3 ATIXPGAA;ATIXPGAA;\??\c:\dell\drivers\R74793\ATIXPGAA.SYS [2008-02-06 11648]
S3 NETGEAR_WPN511_SERVICE;NETGEAR WPN511 Wireless Adapter Service;c:\windows\system32\DRIVERS\wpn511.sys [2006-03-14 395840]
S3 oflpydin;oflpydin;\??\c:\docume~1\ADAMST~1\LOCALS~1\Temp\oflpydin.sys []
S3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);c:\windows\system32\DRIVERS\CamDrL20.sys [2005-02-15 245760]
S3 PRISM_ICB;NETGEAR WG511 Wireless LAN Driver;c:\windows\system32\DRIVERS\WG511ICB.sys [2004-09-10 50560]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2008-11-12 167808]
S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2008-11-12 13532]
S3 ZSMC302;VIMICRO USB PC Camera;c:\windows\system32\Drivers\usbVM31b.sys [2005-03-19 90568]
S4 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e9e55d0-8ce1-11d9-8afe-00038a000015}]
\Shell\AutoRun\command - e:\safeguard\Windows\SafeGuard20.exe

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-11-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2008-11-15 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Adam Stone.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2007-05-23 11:13]

2008-11-14 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2007-09-18 22:42]

2008-11-17 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDetect.exe []

2008-11-17 c:\windows\Tasks\User_Feed_Synchronization-{1AF5A3AC-A0D7-4B76-8E1E-D27471543F0E}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.
- - - - ORPHANS REMOVED - - - -

BHO-{2563EBC8-0E24-2ADD-2E87-25879CF0E89C} - (no file)
BHO-{2563EBC8-0E27-59DF-2E80-2587E282E89E} - (no file)
BHO-{2563EBCD-0E51-2FDE-2E82-2687EAF0E898} - (no file)
BHO-{598C9C18-AB7A-4C37-90E0-96A704AB60CA} - (no file)
BHO-{B8224214-ADAA-AC24-D14E-8E4D81A073C0} - (no file)
Toolbar-{761B6D7D-3776-4E1D-A16C-3839A05A58D0} - (no file)
WebBrowser-{761B6D7D-3776-4E1D-A16C-3839A05A58D0} - (no file)
HKCU-Run-Performance Center - c:\program files\Ascentive\Performance Center\APCMain.exe

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com/?.home=ytie
mSearch Bar = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;*.local
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: &Search - ?p=ZUxdm300YYUS
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html -
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O16 -: {1D30829F-03CD-18DB-46B2-63DC65B69C4C} - hxxp://66.230.175.129/1/gdnUS1384.exe

O16 -: {5657F6FD-7CDC-7968-3F76-36AF5E5A7942} - hxxp://66.230.175.129/1/gdnUS1384.exe

O16 -: {5AE1F9DF-B68F-240D-B563-20451E4E6F03} - hxxp://66.230.175.129/1/gdnUS1384.exe

O16 -: {B5DD9A64-5C4B-4A48-BE56-97C1A8F85708} - hxxp://204.177.92.198/quickdl/livevideo/fastvideoplayer.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 23:59:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\S24EvMon.exe
c:\windows\SYSTEM32\acs.exe
c:\program files\Common Files\Symantec Shared\CCSETMGR.EXE
c:\program files\Common Files\Symantec Shared\CCEVTMGR.EXE
c:\program files\Common Files\Symantec Shared\CCPROXY.EXE
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\SYSTEM32\ZCfgSvc.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\1XConfig.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
c:\windows\SYSTEM32\HPZipm12.exe
c:\windows\SYSTEM32\RegSrvc.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\SYSTEM32\searchindexer.exe
c:\program files\Common Files\Symantec Shared\Security Center\symwsc.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\COMMON~1\SYMANT~1\SECURI~2\NSCSRVCE.EXE
c:\program files\Symantec\LiveUpdate\AUPDATE.EXE
c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2008-11-17 0:09:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-17 06:08:55

Pre-Run: 17,478,451,200 bytes free
Post-Run: 17,386,418,176 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

290 — E O F — 2008-11-13 09:02:06

Tomk

Post #4November 17, 2008, 2:32 PM UTC

Astone,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e9e55d0-8ce1-11d9-8afe-00038a000015}]

Driver::
oflpydin

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Please also provide a new HijackThis log.

Astone

Post #5November 18, 2008, 3:03 AM UTC

Hello again, sorry it took me so long to reply, long day at work. Alright down to brass tax, the first few times I tried to drop the CFScript into the Combofix, it would boot normaly but then I would get two messages, the first would come up in a seperate window and would read

"Parasites found!!

The following files were trying to attach to combofix,
They shall be disabled…

Module inormation for 'CF25870.exe'(628)
Module Base Size Path
C:\Windows\System32\CF25870.exe

The next, well its not really a pop up but it would read in the Combofix program as follows,

'.CFEXE;.COM; EXE; .BAT; .COD; .VBS; .JS; .JSE; .WSF; .WSH' is not recgonized as an internal or external command, operable program or batch file.

After a few tries at that, I went into the properties tab of the CFScript that I saved and changed the name of it in there to CFScript.txt since it did not show on my desktop as such, after that it seemed to work….seemed that is, I'm not sure If by me altering it I messed anything up or not, but here is the log that it gave me.

————————————————————————————————————————————-

ComboFix 08-11-16.05 - Adam Stone 2008-11-17 20:36:37.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1453 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Adam Stone\Desktop\CFScript.txt.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_OFLPYDIN
——-\Service_oflpydin

((((((((((((((((((((((((( Files Created from 2008-10-18 to 2008-11-18 )))))))))))))))))))))))))))))))
.

2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\documents and settings\Adam Stone\Application Data\Malwarebytes
2008-11-16 23:16 . 2008-10-22 16:10 38,496 –a—— c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-11-16 23:16 . 2008-10-22 16:10 15,504 –a—— c:\windows\SYSTEM32\DRIVERS\mbam.sys
2008-11-16 22:20 . 2008-11-16 22:20 d——– c:\program files\Trend Micro
2008-11-12 23:12 . 2008-11-12 23:12 d——– c:\program files\ATI Technologies
2008-11-12 21:40 . 2008-11-12 21:40 d——– c:\program files\Microsoft Silverlight
2008-11-12 21:40 . 2008-11-12 21:40 d——– c:\documents and settings\Adam Stone\Application Data\Windows Desktop Search
2008-11-12 21:39 . 2008-11-12 21:39 d——– c:\windows\SYSTEM32\GroupPolicy
2008-11-12 21:39 . 2008-11-12 21:39 d——– c:\program files\Windows Desktop Search
2008-11-12 21:38 . 2008-03-07 11:02 192,000 ——— c:\windows\SYSTEM32\DLLCACHE\offfilt.dll
2008-11-12 21:38 . 2008-03-07 11:02 98,304 ——— c:\windows\SYSTEM32\DLLCACHE\nlhtml.dll
2008-11-12 21:38 . 2008-03-07 11:02 29,696 ——— c:\windows\SYSTEM32\DLLCACHE\mimefilt.dll
2008-11-12 21:37 . 2008-11-12 21:37 d——– c:\program files\Windows Media Connect 2
2008-11-12 21:35 . 2008-11-12 21:36 d——– c:\windows\SYSTEM32\DRIVERS\UMDF
2008-11-12 20:01 . 2008-11-12 20:01 d——– c:\windows\OPTIONS
2008-11-12 20:01 . 2006-04-10 18:41 200,704 –a—— c:\windows\SYSTEM32\WG1v2Lib.dll
2008-11-12 20:01 . 2006-03-27 17:53 167,808 –a—— c:\windows\SYSTEM32\DRIVERS\wg111v2.sys
2008-11-12 20:01 . 2003-11-18 09:27 155,648 –a—— c:\windows\SYSTEM32\IpLib.dll
2008-11-12 20:01 . 2005-12-29 00:16 114,688 -ra—— c:\windows\SYSTEM32\EnumDev111.dll
2008-11-12 20:01 . 2005-04-01 11:43 66,048 –a—— c:\windows\SYSTEM32\DRIVERS\EAPPkt.sys
2008-11-12 20:01 . 2002-10-02 08:57 13,532 –a—— c:\windows\SYSTEM32\DRIVERS\SjyPkt.sys
2008-11-12 04:34 . 2008-09-04 11:15 1,106,944 ——— c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-11-12 04:34 . 2008-10-24 05:21 455,296 ——— c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-10-24 00:05 . 2008-10-15 10:34 337,408 ——— c:\windows\SYSTEM32\DLLCACHE\netapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 05:16 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-11-14 21:00 ——— d—–w c:\program files\Norton Security Scan
2008-11-13 05:14 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-13 05:04 80,090 —-a-w c:\documents and settings\Adam Stone\Application Data\SMBIOSSP.exe
2008-11-13 02:01 ——— d—–w c:\program files\NETGEAR
2008-11-12 02:18 ——— d—–w c:\program files\World of Warcraft
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 03:11 ——— d—–w c:\program files\K-litePro
2008-10-21 01:24 34,042 —-a-w c:\documents and settings\Adam Stone\Application Data\wklnhst.dat
2008-10-16 00:29 ——— d–h–w c:\documents and settings\Adam Stone\Application Data\Move Networks
2008-10-16 00:27 ——— d—–w c:\program files\Google
2008-10-15 03:00 ——— d—–w c:\program files\Valve
2008-10-15 02:42 ——— d—–w c:\program files\Bonjour
2008-10-15 01:29 ——— d—–w c:\documents and settings\All Users\Application Data\Blizzard
2008-09-30 03:15 ——— d—–w c:\documents and settings\Adam Stone\Application Data\Apple Computer
2008-09-27 18:33 ——— d—–w c:\program files\Java
2008-09-27 18:32 ——— d—–w c:\program files\Common Files\Java
2006-12-27 20:39 58,824 —-a-w c:\documents and settings\Adam Stone\Application Data\GDIPFONTCACHEV1.DAT
2005-01-27 23:51 400,288 -c–a-w c:\windows\INF\WPN311\WPN311.sys
2005-01-27 16:59 35,232 -c–a-w c:\windows\INF\WPN311\ME_INST.EXE
2005-01-27 16:59 26,112 -c–a-w c:\windows\INF\WPN311\install.exe
.

((((((((((((((((((((((((((((( snapshot@2008-11-17_ 0.08.14.99 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-11-02 00:31:34 315,904 —-a-w c:\windows\INF\unregmp2.exe
+ 2007-06-27 04:10:26 317,440 —-a-w c:\windows\INF\unregmp2.exe
- 2006-11-02 00:31:34 315,904 —-a-w c:\windows\SYSTEM32\DLLCACHE\unregmp2.exe
+ 2007-06-27 04:10:26 317,440 —-a-w c:\windows\SYSTEM32\DLLCACHE\unregmp2.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-02-02 155648]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 53096]
"AS00_WPN511"="c:\program files\NETGEAR\WPN511\Utility\WPN511.exe" [2005-02-02 483328]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-10 289064]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"bacstray"="BacsTray.exe" [2003-05-14 c:\windows\SYSTEM32\BacsTray.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WPN311 Wireless Assistant.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2005-02-21 4517888]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2008-11-12 745472]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 11:41 294912 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2004-01-13 14:17 110592 c:\windows\SYSTEM32\LgNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Adam Stone^Start Menu^Programs^Startup^MemTurbo.lnk]
path=c:\documents and settings\Adam Stone\Start Menu\Programs\Startup\MemTurbo.lnk
backup=c:\windows\pss\MemTurbo.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-13 18:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-01-28 10:43 2097488 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
–a—— 2008-02-29 15:03 1481968 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=2 (0x2)
"GoogleDesktopManager-093007-112848"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [2008-11-12 66048]
R3 AWINDIS5;AWINDIS5 Protocol Driver;\??\c:\windows\system32\AWINDIS5.SYS [2004-09-10 16194]
S3 ATIXPGAA;ATIXPGAA;\??\c:\dell\drivers\R74793\ATIXPGAA.SYS [2008-02-06 11648]
S3 NETGEAR_WPN511_SERVICE;NETGEAR WPN511 Wireless Adapter Service;c:\windows\system32\DRIVERS\wpn511.sys [2006-03-14 395840]
S3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);c:\windows\system32\DRIVERS\CamDrL20.sys [2005-02-15 245760]
S3 PRISM_ICB;NETGEAR WG511 Wireless LAN Driver;c:\windows\system32\DRIVERS\WG511ICB.sys [2004-09-10 50560]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2008-11-12 167808]
S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2008-11-12 13532]
S3 ZSMC302;VIMICRO USB PC Camera;c:\windows\system32\Drivers\usbVM31b.sys [2005-03-19 90568]
S4 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" []

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-11-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2008-11-15 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Adam Stone.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2007-05-23 11:13]

2008-11-14 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2007-09-18 22:42]

2008-11-18 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDetect.exe []

2008-11-17 c:\windows\Tasks\User_Feed_Synchronization-{1AF5A3AC-A0D7-4B76-8E1E-D27471543F0E}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-17 20:44:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\S24EvMon.exe
c:\windows\SYSTEM32\acs.exe
c:\program files\Common Files\Symantec Shared\CCSETMGR.EXE
c:\program files\Common Files\Symantec Shared\CCEVTMGR.EXE
c:\program files\Common Files\Symantec Shared\CCPROXY.EXE
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
c:\windows\SYSTEM32\HPZipm12.exe
c:\windows\SYSTEM32\RegSrvc.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\SYSTEM32\searchindexer.exe
c:\program files\Common Files\Symantec Shared\Security Center\symwsc.exe
c:\windows\SYSTEM32\ZCfgSvc.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\1XConfig.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Symantec\LiveUpdate\AUPDATE.EXE
c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\progra~1\COMMON~1\SYMANT~1\SECURI~2\NSCSRVCE.EXE
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2008-11-17 20:53:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-18 02:53:45
ComboFix2.txt 2008-11-17 06:09:06

Pre-Run: 17,327,304,704 bytes free
Post-Run: 17,314,336,768 bytes free

224 — E O F — 2008-11-17 09:01:11

Tomk

Post #6November 18, 2008, 4:01 AM UTC

Astone,

Let's get a little different look.

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

I also need to see a new HijackThis log.

Astone

Post #7November 18, 2008, 4:25 AM UTC

Alright, first is the LopSD report,

——————–\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel® Pentium® M processor 1.60GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A09
USER : Adam Stone ( Administrator )
BOOT : Normal boot
Antivirus : Norton Internet Security 2006 2006 (Not Activated)
Firewall : Norton Internet Security 2006 2006 (Not Activated)
C:\ (Local Disk) - NTFS - Total:52 Go (Free:16 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Mon 11/17/2008|22:21 )

——————–\\ Listing folders in APPLIC~1

[10/01/2006|09:09] C:\DOCUME~1\ADAMST~1\APPLIC~1\ acccore
[04/02/2007|09:35] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Adobe
[02/27/2005|08:39] C:\DOCUME~1\ADAMST~1\APPLIC~1\ alta
[09/07/2006|05:56] C:\DOCUME~1\ADAMST~1\APPLIC~1\ AOL
[09/29/2008|09:15] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Apple Computer
[09/04/2004|12:22] C:\DOCUME~1\ADAMST~1\APPLIC~1\ CyberLink
[12/23/2006|03:33] C:\DOCUME~1\ADAMST~1\APPLIC~1\ DivX
[01/27/2008|07:17] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Google
[04/17/2007|07:31] C:\DOCUME~1\ADAMST~1\APPLIC~1\ GTek
[10/20/2004|09:49] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Help
[08/25/2004|07:11] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Identities
[10/23/2007|06:11] C:\DOCUME~1\ADAMST~1\APPLIC~1\ ieSpell
[05/18/2008|10:33] C:\DOCUME~1\ADAMST~1\APPLIC~1\ InstallShield
[10/19/2004|09:28] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Jasc
[09/07/2006|05:41] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Jasc Software Inc
[09/22/2004|07:19] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Leadertech
[11/07/2004|03:30] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Macromedia
[11/16/2008|11:16] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Malwarebytes
[02/10/2007|04:35] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Microsoft
[03/05/2008|01:59] C:\DOCUME~1\ADAMST~1\APPLIC~1\ mIRC
[10/15/2008|06:29] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Move Networks
[07/26/2005|12:25] C:\DOCUME~1\ADAMST~1\APPLIC~1\ MSN6
[09/22/2004|07:19] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Sonic
[08/25/2004|07:52] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Sun
[03/27/2008|12:45] C:\DOCUME~1\ADAMST~1\APPLIC~1\ SUPERAntiSpyware.com
[11/05/2005|02:31] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Symantec
[11/05/2005|03:49] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Systweak
[10/11/2006|11:53] C:\DOCUME~1\ADAMST~1\APPLIC~1\ teamspeak2
[04/11/2006|11:03] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Ventrilo
[02/08/2007|12:15] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Viewpoint
[11/12/2008|09:40] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Windows Desktop Search
[02/19/2008|06:55] C:\DOCUME~1\ADAMST~1\APPLIC~1\ WinRAR
[05/10/2007|08:58] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Yahoo!
[05/25/2005|11:38] C:\DOCUME~1\ADAMST~1\APPLIC~1\ Yahoo! Messenger
[01/15/2005|03:00] C:\DOCUME~1\ADAMST~1\APPLIC~1\ You've Got Pictures Screensaver

[04/10/2008|11:44] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft
[08/25/2004|08:01] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Sonic

[03/10/2008|12:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[02/10/2007|02:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe Systems
[10/01/2006|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[10/01/2006|09:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL Downloads
[10/16/2007|03:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[09/28/2006|02:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[10/14/2008|07:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Blizzard
[08/25/2004|07:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CyberLink
[02/27/2008|11:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Dell
[02/10/2007|05:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ FLEXnet
[10/15/2008|06:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[05/26/2005|07:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GTek
[10/03/2006|06:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ HP
[01/19/2005|08:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[09/03/2005|02:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[11/16/2008|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[11/12/2008|09:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[05/10/2007|08:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft Help
[03/21/2005|10:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MSN6
[01/15/2005|02:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks
[08/25/2004|08:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[08/25/2004|07:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SBSI
[03/26/2008|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[03/27/2008|12:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SUPERAntiSpyware.com
[01/30/2008|06:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SupportSoft
[08/10/2007|06:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec
[01/14/2005|08:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Trymedia
[02/08/2007|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[10/02/2005|02:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[05/10/2007|08:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ yahoo!

[08/25/2004|07:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[08/25/2004|08:09] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Jasc Software Inc
[12/01/2007|01:02] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[08/25/2004|08:01] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Sonic
[08/25/2004|07:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Sun
[08/25/2004|08:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Symantec

[03/26/2008|08:08] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Google
[03/26/2008|08:09] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Macromedia
[11/12/2008|09:48] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft

[02/11/2005|03:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft

[09/03/2004|10:49] C:\DOCUME~1\Owner\APPLIC~1\ Symantec

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[11/14/2008 03:32 PM][–a——] C:\WINDOWS\tasks\Norton Security Scan.job
[11/17/2008 12:03 AM][–ah—–] C:\WINDOWS\tasks\User_Feed_Synchronization-{1AF5A3AC-A0D7-4B76-8E1E-D27471543F0E}.job
[11/13/2008 08:33 AM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[11/17/2008 10:21 PM][–a——] C:\WINDOWS\tasks\Symantec NetDetect.job
[11/15/2008 01:33 AM][–a——] C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Adam Stone.job
[11/17/2008 08:42 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/29/2002 04:00 AM][-r-h—–] C:\WINDOWS\tasks\DESKTOP.INI

——————–\\ Listing Folders in C:\Program Files

[08/25/2004|08:01] C:\Program Files\ ABBYY FineReader 5.0 Sprint
[08/25/2004|08:01] C:\Program Files\ ABBYY FineReader 6.0
[03/10/2008|12:48] C:\Program Files\ Adobe
[12/05/2006|04:36] C:\Program Files\ Advanced System Optimizer
[10/01/2006|09:09] C:\Program Files\ AOD
[01/13/2005|07:39] C:\Program Files\ Apoint
[07/13/2008|02:51] C:\Program Files\ Apple Software Update
[11/12/2008|11:12] C:\Program Files\ ATI Technologies
[09/07/2006|05:51] C:\Program Files\ BestPopUpKiller
[10/14/2008|08:42] C:\Program Files\ Bonjour
[08/25/2004|07:55] C:\Program Files\ Broadcom Advanced Control Suite
[11/17/2008|08:39] C:\Program Files\ Common Files
[08/25/2004|07:11] C:\Program Files\ ComPlus Applications
[08/25/2004|07:59] C:\Program Files\ CyberLink
[02/06/2008|08:45] C:\Program Files\ Dell
[09/07/2006|05:54] C:\Program Files\ Dell Computer
[08/25/2004|08:00] C:\Program Files\ Dell Computer Corporation
[09/21/2004|09:26] C:\Program Files\ Dell J740
[01/30/2008|06:58] C:\Program Files\ Dell Support Center
[04/17/2007|06:15] C:\Program Files\ DellSupport
[03/28/2006|01:32] C:\Program Files\ DeskMates
[04/08/2007|10:53] C:\Program Files\ DivX
[03/26/2008|06:07] C:\Program Files\ Enigma Software Group
[10/15/2008|06:27] C:\Program Files\ Google
[10/03/2006|06:48] C:\Program Files\ Hewlett-Packard
[11/16/2008|10:08] C:\Program Files\ Hijackthis
[10/03/2006|06:52] C:\Program Files\ HP
[10/23/2007|06:11] C:\Program Files\ ieSpell
[11/12/2008|11:14] C:\Program Files\ InstallShield Installation Information
[07/21/2008|09:56] C:\Program Files\ Intel
[09/07/2006|05:57] C:\Program Files\ InterActual
[03/06/2005|06:39] C:\Program Files\ InterMute
[10/15/2008|02:03] C:\Program Files\ Internet Explorer
[07/14/2008|08:29] C:\Program Files\ iPod
[07/14/2008|08:29] C:\Program Files\ iTunes
[09/07/2006|05:41] C:\Program Files\ Jasc Software Inc
[09/27/2008|12:33] C:\Program Files\ Java
[10/22/2008|09:11] C:\Program Files\ K-litePro
[09/02/2005|08:56] C:\Program Files\ Kodak
[08/15/2005|03:15] C:\Program Files\ Logitech
[11/16/2008|11:16] C:\Program Files\ Malwarebytes' Anti-Malware
[08/18/2006|09:03] C:\Program Files\ Maxis
[11/05/2005|03:42] C:\Program Files\ MemTurbo30
[10/07/2008|07:35] C:\Program Files\ Messenger
[08/25/2004|08:04] C:\Program Files\ Microsoft ActiveSync
[05/10/2007|02:03] C:\Program Files\ Microsoft CAPICOM 2.1.0.2
[08/25/2004|08:06] C:\Program Files\ Microsoft Encarta
[08/25/2004|07:11] C:\Program Files\ microsoft frontpage
[05/10/2007|08:53] C:\Program Files\ Microsoft Office
[09/07/2006|05:48] C:\Program Files\ Microsoft Picture It! 9
[11/12/2008|09:40] C:\Program Files\ Microsoft Silverlight
[05/10/2007|08:53] C:\Program Files\ Microsoft Works
[08/25/2004|08:03] C:\Program Files\ Microsoft Works Suite 2004
[01/13/2005|07:39] C:\Program Files\ Modem Helper
[10/07/2008|07:28] C:\Program Files\ Movie Maker
[10/07/2008|07:28] C:\Program Files\ msn
[08/25/2004|07:11] C:\Program Files\ MSN Gaming Zone
[11/16/2006|03:05] C:\Program Files\ MSXML 4.0
[09/07/2006|04:46] C:\Program Files\ MUSICMATCH
[11/12/2008|08:01] C:\Program Files\ NETGEAR
[10/07/2008|07:24] C:\Program Files\ NetMeeting
[11/02/2007|06:22] C:\Program Files\ Norton Internet Security
[11/14/2008|03:00] C:\Program Files\ Norton Security Scan
[08/25/2004|07:11] C:\Program Files\ Online Services
[10/07/2008|07:24] C:\Program Files\ Outlook Express
[03/12/2005|11:17] C:\Program Files\ Pure Networks
[07/14/2008|08:27] C:\Program Files\ QuickTime
[08/25/2004|08:02] C:\Program Files\ Real
[08/25/2004|07:57] C:\Program Files\ Sonic
[06/17/2005|01:50] C:\Program Files\ Sony
[03/26/2008|08:27] C:\Program Files\ Spybot - Search & Destroy
[01/12/2005|04:59] C:\Program Files\ Steam
[01/22/2005|12:51] C:\Program Files\ Strategy First
[03/27/2008|12:45] C:\Program Files\ SUPERAntiSpyware
[06/10/2008|07:56] C:\Program Files\ Symantec
[11/16/2008|10:20] C:\Program Files\ Trend Micro
[03/22/2006|06:56] C:\Program Files\ Ubi Soft
[11/11/2006|01:00] C:\Program Files\ Uninstall Information
[10/14/2008|09:00] C:\Program Files\ Valve
[11/20/2007|07:22] C:\Program Files\ Ventrilo
[08/25/2004|08:03] C:\Program Files\ Viewpoint
[03/19/2005|01:14] C:\Program Files\ Vimicro
[11/24/2004|11:52] C:\Program Files\ Windows AdControl
[11/12/2008|09:39] C:\Program Files\ Windows Desktop Search
[11/12/2008|09:37] C:\Program Files\ Windows Media Connect 2
[11/12/2008|09:37] C:\Program Files\ Windows Media Player
[10/07/2008|07:24] C:\Program Files\ Windows NT
[10/09/2004|11:37] C:\Program Files\ WindowsUpdate
[02/19/2008|06:43] C:\Program Files\ WinRAR
[11/11/2008|08:18] C:\Program Files\ World of Warcraft
[08/25/2004|07:11] C:\Program Files\ XEROX

——————–\\ Listing Folders in C:\Program Files\Common Files

[03/10/2008|12:49] C:\Program Files\Common Files\ Adobe
[02/09/2007|07:07] C:\Program Files\Common Files\ Adobe Systems Shared
[08/09/2007|05:42] C:\Program Files\Common Files\ AOL
[01/15/2005|02:59] C:\Program Files\Common Files\ AolCoach
[10/01/2006|09:08] C:\Program Files\Common Files\ aolshare
[10/16/2007|03:21] C:\Program Files\Common Files\ Apple
[08/09/2007|03:08] C:\Program Files\Common Files\ Blizzard Entertainment
[08/25/2004|08:04] C:\Program Files\Common Files\ Designer
[10/03/2006|06:47] C:\Program Files\Common Files\ Hewlett-Packard
[10/03/2006|06:51] C:\Program Files\Common Files\ HP
[03/19/2005|01:14] C:\Program Files\Common Files\ InstallShield
[09/27/2008|12:32] C:\Program Files\Common Files\ Java
[05/10/2007|08:53] C:\Program Files\Common Files\ Microsoft Shared
[08/25/2004|07:11] C:\Program Files\Common Files\ MSSoap
[06/08/2005|10:03] C:\Program Files\Common Files\ NSV
[08/25/2004|08:02] C:\Program Files\Common Files\ Nullsoft
[08/25/2004|07:11] C:\Program Files\Common Files\ ODBC
[08/25/2004|08:02] C:\Program Files\Common Files\ Real
[09/07/2006|05:53] C:\Program Files\Common Files\ Scanner
[08/25/2004|07:11] C:\Program Files\Common Files\ Services
[08/25/2004|07:58] C:\Program Files\Common Files\ Sonic
[08/25/2004|07:11] C:\Program Files\Common Files\ SpeechEngines
[01/30/2008|06:58] C:\Program Files\Common Files\ supportsoft
[09/07/2004|09:54] C:\Program Files\Common Files\ SWF Studio
[11/17/2008|08:54] C:\Program Files\Common Files\ Symantec Shared
[10/07/2008|07:24] C:\Program Files\Common Files\ System
[03/27/2008|12:44] C:\Program Files\Common Files\ Wise Installation Wizard

——————–\\ Process

( 66 Processes )

iexplore.exe ~ [PID:2140]

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

C:\DOCUME~1\ADAMST~1\Cookies\adam_stone@advertising[2].txt

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-17 22:22:36
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

No other infections found !

[F:3][D:0]-> C:\DOCUME~1\ADAMST~1\LOCALS~1\Temp
[F:51][D:0]-> C:\DOCUME~1\ADAMST~1\Cookies
[F:311][D:4]-> C:\DOCUME~1\ADAMST~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Mon 11/17/2008|22:16 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - Mon 11/17/2008|22:23 - Option : [1]

——————–\\ Scan completed at 22:23:56

————————————————————————————————————————————————————-

Next will be the Latest HJT report

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:19:02 PM, on 11/17/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\SYSTEM32\acs.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\NETGEAR\WPN511\Utility\WPN511.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~2\NSCSRVCE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AS00_WPN511] C:\Program Files\NETGEAR\WPN511\Utility\WPN511.exe -hide
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: NETGEAR WPN311 Wireless Assistant.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: &Search - ?p=ZUxdm300YYUS
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D30829F-03CD-18DB-46B2-63DC65B69C4C} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {5657F6FD-7CDC-7968-3F76-36AF5E5A7942} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {5AE1F9DF-B68F-240D-B563-20451E4E6F03} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd…ows-i586-jc.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O16 - DPF: {B5DD9A64-5C4B-4A48-BE56-97C1A8F85708} - http://204.177.92.198/quickdl/livevideo/fastvideoplayer.cab
O18 - Protocol: bw+0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\SYSTEM32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 26108 bytes

Tomk

Post #8November 18, 2008, 4:42 AM UTC

Astone,

Disable your protection programs as we did before.

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O16 - DPF: {1D30829F-03CD-18DB-46B2-63DC65B69C4C} - http://66.230.175.129/1/gdnUS1384.exe
  O16 - DPF: {5657F6FD-7CDC-7968-3F76-36AF5E5A7942} - http://66.230.175.129/1/gdnUS1384.exe
  O16 - DPF: {5AE1F9DF-B68F-240D-B563-20451E4E6F03} - http://66.230.175.129/1/gdnUS1384.exe
  O16 - DPF: {B5DD9A64-5C4B-4A48-BE56-97C1A8F85708} - http://204.177.92.198/quickdl/livevideo/fastvideoplayer.cab
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

Next

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

In your next reply please provide:

Kaspersky report
New HijackThis log taken after everything else completed

Astone

Post #9November 18, 2008, 10:53 PM UTC

Sorry it took so long for the reply again, I had some problems running the Kaspersky program, but I finaly got it to work.

First I will post the new Hyjackthis log,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:49:59 PM, on 11/18/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\SYSTEM32\acs.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\NETGEAR\WPN511\Utility\WPN511.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~2\NSCSRVCE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AS00_WPN511] C:\Program Files\NETGEAR\WPN511\Utility\WPN511.exe -hide
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: NETGEAR WPN311 Wireless Assistant.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: &Search - ?p=ZUxdm300YYUS
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd…ows-i586-jc.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O18 - Protocol: bw+0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {1230BA98-13DF-4B13-BA3F-7A7A84722145} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\SYSTEM32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 25072 bytes

—————————————————————————————————————-

And here is the Kaspersky report

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, November 18, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, November 18, 2008 02:52:13
Records in database: 1390618
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 112812
Threat name: 77
Infected objects: 196
Suspicious objects: 0
Duration of the scan: 02:01:56

File name / Threat name / Threats count
C:\Documents and Settings\Adam Stone\Application Data\Sun\Java\Deployment\cache\6.0\43\76aa56eb-5805b6c0 Infected: Trojan-Downloader.Java.OpenStream.c 1
C:\Documents and Settings\All Users\Application Data\AOL Downloads\lpaolcom_setupSTUS\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0020236C Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\004F77D5.class Infected: Trojan.Java.ClassLoader.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\004F77D5.zip Infected: Trojan.Java.ClassLoader.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\004F77D5.zip Infected: Exploit.Java.ByteVerify 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\004F77D5.zip Infected: Trojan.Java.ClassLoader.Dummy.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\004F77D5.zip Infected: Trojan-Downloader.Java.OpenConnection.v 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\00967C78 Infected: not-a-virus:AdWare.Win32.PurityScan.w 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\013C630F Infected: Trojan-Downloader.Win32.Dyfuca.de 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\02F50C66 Infected: Trojan-Downloader.Win32.Intexp.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\03543EF7 Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04146457 Infected: not-a-virus:Porn-Downloader.Win32.TibSystems 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04170E54 Infected: not-a-virus:AdWare.Win32.MediaTickets.e 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04210C49 Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04243645 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04276042 Infected: not-a-virus:AdWare.Win32.GigatechSuperBar 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\042A0A3E Infected: not-a-virus:AdWare.Win32.ImiBar.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04BA379E Infected: not-a-virus:AdWare.Win32.WinAD 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04E4596F Infected: not-a-virus:AdWare.Win32.PurityScan.aa 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04FF08C1.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0665280C Infected: Trojan-Dropper.Win32.Delf.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\075979C6.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09296A96.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09B742B5 Infected: not-a-virus:Porn-Downloader.Win32.TibSystems 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09BA6CB2 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09BE16AE Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09C140AB Infected: not-a-virus:AdWare.Win32.PowerScan.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09C46AA7 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0A3A0D3A.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0CCD1F0E Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0E864865 Infected: not-a-virus:AdWare.Win32.BetterInternet.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0FE86E7A.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\108E3326 Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10915D22 Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F00686.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F261FC.class Infected: Trojan.Java.ClassLoader.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\111968C4.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\112E6F94.EXE Infected: not-a-virus:AdWare.Win32.PurityScan.ao 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\12150848.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\136B70E6.zip Infected: Trojan.Java.Femad 4
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\136B70E6.zip Infected: Trojan.Win32.LowZones.cp 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\13923CAB.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\141E7C1E.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\145B0B00 Infected: Trojan-Downloader.Win32.Dyfuca.cr 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\17421A69.exe Infected: Trojan-Downloader.Win32.Zlob.tz 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\184A7D08 Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\185D5B0D Infected: not-a-virus:AdWare.Win32.BiSpy.o 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\187C76CD Infected: Trojan.Win32.StartPage.ix 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\18EE2941 Infected: not-a-virus:AdWare.Win32.Connector 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\19537772 Infected: Trojan-Downloader.Win32.Agent.ab 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1A770659.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B8034B3.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1C36242C.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1C85587C Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1CC70AF8.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E6E33A1 Infected: not-a-virus:AdWare.Win32.WinAD.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E783197 Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E7E0590 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E855988 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E880385 Infected: not-a-virus:AdWare.Win32.WinAD.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\203950B8.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\206A4682.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21BC3731.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\240D32CB Infected: not-a-virus:AdWare.Win32.BargainBuddy.j 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\243C5EE6.EXE Infected: not-a-virus:AdWare.Win32.PurityScan.ao 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\268A4389.zip Infected: Trojan.Java.Femad 4
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\268A4389.zip Infected: Trojan.Win32.LowZones.cp 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2815147A Infected: not-a-virus:AdWare.Win32.SideFind 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28D63D70.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29845A56.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2C6150C9.EXE Infected: not-a-virus:AdWare.Win32.PurityScan.ao 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2DC73E9D.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2E73054A.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2F18011D.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2F9D6ECA Infected: not-a-virus:AdWare.Win32.BiSpy.t 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\30003A64.htm Infected: Trojan-Downloader.JS.Agent.bi 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\308E6187.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\30DE00EF Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\31D11CC2 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\31E13E06.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\33A55079 Infected: Trojan-Dropper.Win32.Delf.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\351B6B27.class Infected: Trojan.Java.Femad 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\351F1524.class Infected: Trojan.Java.Femad 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\35BC17B7 Infected: not-a-virus:AdWare.Win32.BetterInternet.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3628047C.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36C36E28.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38444600 Infected: Trojan-Downloader.Win32.IstBar.rt 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38C75FFE Infected: Trojan-Downloader.Win32.IstBar.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\399C150C.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3A19669C Infected: not-a-virus:AdWare.Win32.BiSpy.f 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3A7D34CD Infected: Trojan-Downloader.Win32.IstBar.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3B5A68F3.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3BE22B4C Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3C341A5D.zip Infected: Exploit.Java.ByteVerify 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3C341A5D.zip Infected: Trojan-Downloader.Java.OpenConnection.aa 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3CF0530E.exe Infected: Trojan-Downloader.Win32.Small.ayl 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3E2A4551 Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3E996F52.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\41393897 Infected: Trojan-Downloader.Win32.Intexp.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\420761F9 Infected: Trojan-Downloader.Win32.Intexp.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\420A0BF6 Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\44221D3A.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\448E06C4.tmp Infected: not-a-virus:AdWare.Win32.180Solutions.i 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\449130C0.EXE Infected: not-a-virus:AdWare.Win32.PurityScan.ao 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\48BE6A65 Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49B909E2 Infected: Trojan-Downloader.Win32.Stubby.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49BA0150 Infected: Trojan-Downloader.Win32.Stubby.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49BC33DE Infected: Trojan-Downloader.Win32.Intexp.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49BF5DDB Infected: not-a-virus:AdWare.Win32.BetterInternet.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49C307D7 Infected: not-a-virus:AdWare.Win32.ImiBar.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B0152DA.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B036411.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B2C3E7E Infected: Trojan-Clicker.Win32.Delf.r 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4F69576E.htm Infected: Trojan-Downloader.HTML.Agent.aq 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\511C3E5F.exe Infected: Trojan-Downloader.Win32.Zlob.ayr 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\51F864FF Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\529904F7.exe Infected: Trojan-Downloader.Win32.Zlob.gv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\543A1187 Infected: Trojan-Downloader.Win32.Small.ayl 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\554A3D4E Infected: not-a-virus:Porn-Dialer.Win32.Kotu.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\55CD0031 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\58AB6E27 Infected: Trojan-Downloader.Win32.IstBar.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\58B14220 Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\58B81619 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\58BB4015 Infected: not-a-virus:AdWare.Win32.BiSpy.o 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59073AB0.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\590916A3.class Infected: Trojan.Java.Femad 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59167DB1.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\596968E7.htm Infected: Trojan.JS.StartPage.u 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D160016.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5E4454CC Infected: Trojan-Downloader.Win32.Intexp.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\624D367B Infected: not-a-virus:AdWare.Win32.PowerScan.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\63B22356.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\66AC4391 Infected: not-a-virus:AdWare.Win32.PurityScan.v 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\676F4600 Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6846427E.dll Infected: not-a-virus:AdWare.Win32.Comet.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\698347EE Infected: not-a-virus:AdWare.Win32.BargainBuddy.n 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69CB5920.dll Infected: Trojan-Downloader.Win32.Zlob.ayr 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69CE031C.dll Infected: Trojan-Downloader.Win32.Zlob.ayr 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69D510CA Infected: Trojan.Win32.Dialer.eg 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69E8161F Infected: Trojan-Downloader.Win32.Dyfuca.co 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6AAF6032.tmp Infected: Trojan-Downloader.Win32.Zlob.iy 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6B4D0C9E Infected: Trojan-Downloader.Win32.Dyfuca.de 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6CD12B53 Infected: Trojan.Win32.LowZones.bu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\708A1A37.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71ED0824 Infected: Trojan.Java.ClassLoader.Dummy.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\722E134F Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\737A049D Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73C6049F Infected: Trojan.Win32.Zapchast.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73D7568D Infected: not-a-virus:AdWare.Win32.DlMax.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73DA008A Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74892883 Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74C147C2 Infected: Trojan-Downloader.Win32.Stubby.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\754D7A6B.zip Infected: Trojan.Java.Femad 4
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\754D7A6B.zip Infected: Trojan.Win32.LowZones.cu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\76AF4496.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\77593A21.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\77843DBF.exe Infected: Backdoor.Win32.Robobot.ab 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\77C521C5 Infected: Trojan-Downloader.Win32.IstBar.dh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78EF369B Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78F60A94 Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78F93491 Infected: Trojan-Downloader.Win32.Stubby.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79142474 Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7AA30F30 Infected: not-a-virus:AdWare.Win32.DlMax.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7AA6392C Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7AF460B6 Infected: not-a-virus:AdWare.Win32.BiSpy.o 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B34431E.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B513CFE.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.b 1

Tomk

Post #10November 19, 2008, 12:55 AM UTC

Astone,

Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]

Under Temporary Internet Files, click the Settings… button
click the Delete Files button.
There are three options in the window to clear the cache - Leave all 3 Checked
- Downloaded Applets
  Downloaded Applications
  Other Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
C:\Documents and Settings\Adam Stone\Application Data\Sun\Java\Deployment\cache\6.0\43\76aa56eb-5805b6c0
C:\Documents and Settings\All Users\Application Data\AOL Downloads\lpaolcom_setupSTUS\comps\toolbar\toolbr.exe

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

You need to delete all of the files in your Norton Quarantine folder.

Now, how are things running?

Astone

Post #11November 19, 2008, 2:05 AM UTC

Here is the new report generated by Combo fix.

ComboFix 08-11-16.05 - Adam Stone 2008-11-18 19:43:44.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1369 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Adam Stone\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\documents and settings\Adam Stone\Application Data\Sun\Java\Deployment\cache\6.0\43\76aa56eb-5805b6c0
c:\documents and settings\All Users\Application Data\AOL Downloads\lpaolcom_setupSTUS\comps\toolbar\toolbr.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\AOL Downloads\lpaolcom_setupSTUS\comps\toolbar\toolbr.exe

.
((((((((((((((((((((((((( Files Created from 2008-10-19 to 2008-11-19 )))))))))))))))))))))))))))))))
.

2008-11-17 22:13 . 2008-11-17 22:23 d——– C:\Lop SD
2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-16 23:16 . 2008-11-16 23:16 d——– c:\documents and settings\Adam Stone\Application Data\Malwarebytes
2008-11-16 23:16 . 2008-10-22 16:10 38,496 –a—— c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-11-16 23:16 . 2008-10-22 16:10 15,504 –a—— c:\windows\SYSTEM32\DRIVERS\mbam.sys
2008-11-16 22:20 . 2008-11-16 22:20 d——– c:\program files\Trend Micro
2008-11-12 23:12 . 2008-11-12 23:12 d——– c:\program files\ATI Technologies
2008-11-12 21:40 . 2008-11-12 21:40 d——– c:\program files\Microsoft Silverlight
2008-11-12 21:40 . 2008-11-12 21:40 d——– c:\documents and settings\Adam Stone\Application Data\Windows Desktop Search
2008-11-12 21:39 . 2008-11-12 21:39 d——– c:\windows\SYSTEM32\GroupPolicy
2008-11-12 21:39 . 2008-11-12 21:39 d——– c:\program files\Windows Desktop Search
2008-11-12 21:38 . 2008-03-07 11:02 192,000 ——— c:\windows\SYSTEM32\DLLCACHE\offfilt.dll
2008-11-12 21:38 . 2008-03-07 11:02 98,304 ——— c:\windows\SYSTEM32\DLLCACHE\nlhtml.dll
2008-11-12 21:38 . 2008-03-07 11:02 29,696 ——— c:\windows\SYSTEM32\DLLCACHE\mimefilt.dll
2008-11-12 21:37 . 2008-11-12 21:37 d——– c:\program files\Windows Media Connect 2
2008-11-12 21:35 . 2008-11-12 21:36 d——– c:\windows\SYSTEM32\DRIVERS\UMDF
2008-11-12 20:01 . 2008-11-12 20:01 d——– c:\windows\OPTIONS
2008-11-12 20:01 . 2006-04-10 18:41 200,704 –a—— c:\windows\SYSTEM32\WG1v2Lib.dll
2008-11-12 20:01 . 2006-03-27 17:53 167,808 –a—— c:\windows\SYSTEM32\DRIVERS\wg111v2.sys
2008-11-12 20:01 . 2003-11-18 09:27 155,648 –a—— c:\windows\SYSTEM32\IpLib.dll
2008-11-12 20:01 . 2005-12-29 00:16 114,688 -ra—— c:\windows\SYSTEM32\EnumDev111.dll
2008-11-12 20:01 . 2005-04-01 11:43 66,048 –a—— c:\windows\SYSTEM32\DRIVERS\EAPPkt.sys
2008-11-12 20:01 . 2002-10-02 08:57 13,532 –a—— c:\windows\SYSTEM32\DRIVERS\SjyPkt.sys
2008-11-12 04:34 . 2008-09-04 11:15 1,106,944 ——— c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-11-12 04:34 . 2008-10-24 05:21 455,296 ——— c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-10-24 00:05 . 2008-10-15 10:34 337,408 ——— c:\windows\SYSTEM32\DLLCACHE\netapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-18 02:54 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-11-14 21:00 ——— d—–w c:\program files\Norton Security Scan
2008-11-13 05:14 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-13 05:04 80,090 —-a-w c:\documents and settings\Adam Stone\Application Data\SMBIOSSP.exe
2008-11-13 02:01 ——— d—–w c:\program files\NETGEAR
2008-11-12 02:18 ——— d—–w c:\program files\World of Warcraft
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 03:11 ——— d—–w c:\program files\K-litePro
2008-10-21 01:24 34,042 —-a-w c:\documents and settings\Adam Stone\Application Data\wklnhst.dat
2008-10-16 00:29 ——— d–h–w c:\documents and settings\Adam Stone\Application Data\Move Networks
2008-10-16 00:27 ——— d—–w c:\program files\Google
2008-10-15 03:00 ——— d—–w c:\program files\Valve
2008-10-15 02:42 ——— d—–w c:\program files\Bonjour
2008-10-15 01:29 ——— d—–w c:\documents and settings\All Users\Application Data\Blizzard
2008-09-30 03:15 ——— d—–w c:\documents and settings\Adam Stone\Application Data\Apple Computer
2008-09-27 18:33 ——— d—–w c:\program files\Java
2008-09-27 18:32 ——— d—–w c:\program files\Common Files\Java
2006-12-27 20:39 58,824 —-a-w c:\documents and settings\Adam Stone\Application Data\GDIPFONTCACHEV1.DAT
2005-01-27 23:51 400,288 -c–a-w c:\windows\INF\WPN311\WPN311.sys
2005-01-27 16:59 35,232 -c–a-w c:\windows\INF\WPN311\ME_INST.EXE
2005-01-27 16:59 26,112 -c–a-w c:\windows\INF\WPN311\install.exe
.

((((((((((((((((((((((((((((( snapshot@2008-11-17_ 0.08.14.99 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-11-02 00:31:34 315,904 —-a-w c:\windows\INF\unregmp2.exe
+ 2007-06-27 04:10:26 317,440 —-a-w c:\windows\INF\unregmp2.exe
- 2006-11-02 00:31:34 315,904 —-a-w c:\windows\SYSTEM32\DLLCACHE\unregmp2.exe
+ 2007-06-27 04:10:26 317,440 —-a-w c:\windows\SYSTEM32\DLLCACHE\unregmp2.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-02-02 155648]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 53096]
"AS00_WPN511"="c:\program files\NETGEAR\WPN511\Utility\WPN511.exe" [2005-02-02 483328]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-10 289064]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"bacstray"="BacsTray.exe" [2003-05-14 c:\windows\SYSTEM32\BacsTray.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
NETGEAR WPN311 Wireless Assistant.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2005-02-21 4517888]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2008-11-12 745472]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 11:41 294912 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2004-01-13 14:17 110592 c:\windows\SYSTEM32\LgNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Adam Stone^Start Menu^Programs^Startup^MemTurbo.lnk]
path=c:\documents and settings\Adam Stone\Start Menu\Programs\Startup\MemTurbo.lnk
backup=c:\windows\pss\MemTurbo.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-13 18:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-01-28 10:43 2097488 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
–a—— 2008-02-29 15:03 1481968 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=2 (0x2)
"GoogleDesktopManager-093007-112848"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [2008-11-12 66048]
R3 AWINDIS5;AWINDIS5 Protocol Driver;\??\c:\windows\system32\AWINDIS5.SYS [2004-09-10 16194]
S3 ATIXPGAA;ATIXPGAA;\??\c:\dell\drivers\R74793\ATIXPGAA.SYS [2008-02-06 11648]
S3 NETGEAR_WPN511_SERVICE;NETGEAR WPN511 Wireless Adapter Service;c:\windows\system32\DRIVERS\wpn511.sys [2006-03-14 395840]
S3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);c:\windows\system32\DRIVERS\CamDrL20.sys [2005-02-15 245760]
S3 PRISM_ICB;NETGEAR WG511 Wireless LAN Driver;c:\windows\system32\DRIVERS\WG511ICB.sys [2004-09-10 50560]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2008-11-12 167808]
S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2008-11-12 13532]
S3 ZSMC302;VIMICRO USB PC Camera;c:\windows\system32\Drivers\usbVM31b.sys [2005-03-19 90568]
S4 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" []

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-11-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2008-11-15 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Adam Stone.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2007-05-23 11:13]

2008-11-14 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2007-09-18 22:42]

2008-11-19 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDetect.exe []

2008-11-18 c:\windows\Tasks\User_Feed_Synchronization-{1AF5A3AC-A0D7-4B76-8E1E-D27471543F0E}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-18 19:52:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\S24EvMon.exe
c:\windows\SYSTEM32\acs.exe
c:\program files\Common Files\Symantec Shared\CCSETMGR.EXE
c:\program files\Common Files\Symantec Shared\CCEVTMGR.EXE
c:\program files\Common Files\Symantec Shared\CCPROXY.EXE
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
c:\windows\SYSTEM32\HPZipm12.exe
c:\windows\SYSTEM32\RegSrvc.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Common Files\Symantec Shared\Security Center\symwsc.exe
c:\windows\SYSTEM32\searchindexer.exe
c:\windows\SYSTEM32\ZCfgSvc.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\1XConfig.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\Symantec\LiveUpdate\AUPDATE.EXE
c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\progra~1\COMMON~1\SYMANT~1\SECURI~2\NSCSRVCE.EXE
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2008-11-18 20:01:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-19 02:01:01
ComboFix2.txt 2008-11-18 02:53:53
ComboFix3.txt 2008-11-17 06:09:06

Pre-Run: 17,276,268,544 bytes free
Post-Run: 17,303,195,648 bytes free

226 — E O F — 2008-11-17 09:01:11

Everything seems to be running smooth. I still have a (seemingly) high number of processes running in my Talk manager, but the CPU usage seems to be a lot lower.

Tomk

Post #12November 19, 2008, 2:19 AM UTC

Astone,

Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

Please re-enable any security that was disabled.
Please delete any other tools we ran except for Malwarebytes. Keep it, and run it once in awhile (after updating it).

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:

From your desktop, right-click on My Computer,
click on Properties
Select the Automatic Updates tab
Click on Automatic
Click on Apply button
Click on OK to exit.

If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

I would further suggest that you also read this tutorial on slow running computers.

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Astone

Post #13November 19, 2008, 2:54 AM UTC

Yes I have read the above (or will finish reading in the near future) and I fully understand its content. Thank you again for your help and understanding, I think that this webiste is awesome and you guys are awesome for doing this for us. Thanks again!!

Tomk

Post #14November 19, 2008, 3:02 AM UTC

Astone, You are very welcome. Glad to help. Good Luck and Be Well.

Tomk

Post #15November 19, 2008, 3:11 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Hello

✨ Ask AI

Ask AI