[Resolved] url.adtrgt.com Pop ups

Hi there, I've been reading through this forum and seems a few of us have been having this same problem. I have tried
some solutions given on this forum and others but no progress.

I keep getting Pop ups from hxxp://url.adtrgt.com. I use Fire Fox but it pops up in IE. Sometimes when I firefox
the loading is slow and I get a few pop ups as well.

I have scan my PC with Adaware, SpyHunter3, Spysweeper, Spybot, Malawarebye's & Kaspersky Most of them find something
but it seems not to remove most of them.

I have used Combofix and HJThis here are the results…. (I still get these pop ups after doing this)

btw I also have another issue….When I reboot and get back into windows I get this error message

Error Loading C:\windows\system32\perofile.dll could not be found

I believe I must of deleted it using HJThis. Any help with this is appreciated.

HJThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:24 PM, on 12/9/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {99410249-2538-44fc-a6dc-962f3772ea9f} - C:\WINDOWS\system32\lebobofu.dll (file missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

–
End of file - 5666 bytes

ComboFix
ComboFix 08-12-07.04 - Linette 2008-12-09 21:01:26.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1661 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Linette\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp
c:\temp\assault.bat
c:\temp\Assault2.exe
c:\temp\Fonts.exe
c:\temp\Fonts\MyriadPro-BlackSemiExt.otf
c:\temp\Fonts\MyriadPro-BoldSemiExt.otf
c:\temp\Fonts\MyriadPro-LightSemiExt.otf
c:\temp\Fonts\MyriadPro-SemiboldSemiExt.otf
c:\temp\Fonts\MyriadPro-SemiExt.otf
c:\temp\pqdvd.elf
c:\temp\pqdvd.elog
c:\windows\system32\lebobofu.dll
c:\windows\system32\pevuliri.dll
c:\windows\system32\zafufovi.dll
c:\windows\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2008-11-10 to 2008-12-10 )))))))))))))))))))))))))))))))
.

2008-12-07 00:17 . 2008-12-07 00:17 d——– c:\program files\PogoDeluxe
2008-12-06 20:31 . 2008-12-06 20:31 d——– c:\program files\Enigma Software Group
2008-12-06 19:57 . 2008-12-06 19:57 d——– c:\program files\Lavasoft
2008-12-06 19:57 . 2008-12-06 19:58 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-06 19:49 . 2008-12-06 19:49 d——– c:\program files\Trend Micro
2008-12-06 16:59 . 2008-12-06 16:59 d——– c:\documents and settings\Linette\Application Data\Malwarebytes
2008-12-06 16:58 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-06 16:57 . 2008-12-06 16:59 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-06 16:57 . 2008-12-06 16:57 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-06 16:57 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-06 16:51 . 2008-12-09 21:05 932 ——— c:\windows\system32\drivers\core.cache.dsk
2008-12-06 15:22 . 2008-03-03 18:32 d——– c:\documents and settings\Administrator\Application Data\InstallShield
2008-12-06 15:22 . 2008-03-03 18:43 d–h—– c:\documents and settings\Administrator\Application Data\GTek
2008-12-06 15:21 . 2008-12-06 15:22 d——– c:\documents and settings\Administrator
2008-12-06 13:05 . 2008-12-06 19:28 d——– c:\windows\system32\C
2008-12-06 13:05 . 2008-12-06 13:05 86,272 ——— c:\windows\system32\drivers\ohci13944.sys
2008-12-03 18:46 . 2008-11-21 15:37 274,432 –a—— c:\windows\system32\TubeFinder.exe
2008-12-03 17:06 . 2008-12-03 17:06 d——– c:\program files\Sector 69
2008-11-27 21:16 . 2008-11-27 21:16 d——– c:\program files\MSXML 4.0
2008-11-27 16:30 . 2008-10-24 06:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-27 16:29 . 2008-09-04 12:15 1,106,944 ——— c:\windows\system32\dllcache\msxml3.dll
2008-11-27 16:29 . 2008-10-15 11:34 337,408 ——— c:\windows\system32\dllcache\netapi32.dll
2008-11-21 16:46 . 2008-11-21 16:46 1,044,480 –a–c— c:\windows\system32\libdivx.dll
2008-11-21 16:46 . 2008-11-21 16:46 200,704 –a–c— c:\windows\system32\ssldivx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-10 02:05 197,156 –sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-10 02:05 14,640,672 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-10 02:05 119,540 –sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-10 02:05 1,263,648 –sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-10 01:20 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-10 01:11 ——— d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-09 01:37 ——— d—–w c:\program files\Corel
2008-12-09 01:37 ——— d—–w c:\documents and settings\Linette\Application Data\Corel
2008-12-07 07:31 ——— d—–w c:\documents and settings\Linette\Application Data\Move Networks
2008-12-07 00:56 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-07 00:37 2,024 —-a-w c:\program files\sbbtqqg.txt
2008-12-06 22:59 ——— d—–w c:\documents and settings\Linette\Application Data\U3
2008-12-06 18:04 ——— d—–w c:\program files\DivX
2008-12-03 23:48 ——— d—–w c:\program files\Free FLV Converter
2008-11-29 00:03 ——— d—–w c:\documents and settings\Linette\Application Data\LimeWire
2008-11-09 02:45 ——— d—–w c:\documents and settings\Linette\Application Data\JoyBits
2008-10-27 21:49 660 —-a-w c:\documents and settings\Linette\Application Data\wklnhst.dat
2008-10-27 21:46 ——— d—–w c:\documents and settings\Linette\Application Data\Template
2008-10-27 21:44 ——— d—–w c:\program files\Microsoft Works
2008-10-24 21:51 ——— d—–w c:\documents and settings\Linette\Application Data\Dragon Altar Games
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-21 20:13 ——— d—–w c:\program files\Network Stumbler
2008-10-20 09:18 ——— d—–w c:\documents and settings\All Users\Application Data\JollyBear
2008-10-20 09:15 ——— d—–w c:\program files\LeeGTs Games
2008-10-20 02:35 ——— d—–w c:\program files\Shockwave.com
2008-10-20 02:34 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-18 07:46 ——— d—–w c:\documents and settings\Linette\Application Data\GameHouse
2008-10-16 03:14 ——— d—–w c:\documents and settings\Linette\Application Data\FloodLightGames
2008-10-16 03:14 ——— d—–w c:\documents and settings\All Users\Application Data\FloodLightGames
2008-10-16 02:55 ——— d—–w c:\documents and settings\Linette\Application Data\AJ SQUARE INC
2008-10-11 02:06 ——— d—–w c:\documents and settings\Linette\Application Data\Flood Light Games
2008-10-11 02:06 ——— d—–w c:\documents and settings\All Users\Application Data\Flood Light Games
2008-08-16 03:01 24 -c–a-w c:\documents and settings\Linette\jagex_runescape_preferences.dat
2008-04-09 16:58 47,360 -c–a-w c:\documents and settings\Linette\Application Data\pcouffin.sys
2008-04-06 04:15 88 –sh–r c:\windows\system32\39A17EFCCB.sys
.

((((((((((((((((((((((((((((( snapshot@2008-12-09_19.51.47.46 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-09 23:44:56 60,572 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-10 01:50:07 60,572 —-a-w c:\windows\system32\perfc009.dat
- 2008-12-09 23:44:56 397,550 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-10 01:50:07 397,550 —-a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{99410249-2538-44fc-a6dc-962f3772ea9f}]
c:\windows\system32\lebobofu.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2008-12-03 399504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-29 8491008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
backup=c:\windows\pss\Dell Network Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a–c— 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
–a–c— 2007-08-01 13:17 222592 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
–a—— 2007-10-09 18:17 2183168 c:\windows\system32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
–a–c— 2004-02-19 08:23 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellAutomatedPCTuneUp]
–a—— 2007-10-11 10:49 465136 c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
–a–c— 2007-05-24 08:03 17920 c:\dell\E-Center\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a–c— 2004-07-27 17:50 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a–c— 2004-07-27 17:50 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KADxMain]
–a–c— 2006-11-02 15:05 282624 c:\windows\system32\KADxMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2008-01-29 16:14 8491008 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a–c— 2008-01-29 16:14 81920 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a–c— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
–a–c— 2006-08-17 10:00 1116920 c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
–a—— 2008-01-04 19:56 5367664 c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2008-02-22 04:25 144784 c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
–a–c— 2007-06-03 15:20 851968 c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
–a–c— 2008-01-29 16:14 86016 c:\windows\system32\nvhotkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a–c— 2008-01-29 16:14 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
–a–c— 2007-06-06 16:28 405504 c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinDefend"=2 (0x2)
"gusvc"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"="RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
"Broadcom Wireless Manager UI"=c:\windows\system32\WLTRAY.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Documents and Settings\\Linette\\My Documents\\Games\\Strategy Games\\Age Of Empires 1 Gold EditionPortable\\Empires.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\patriots.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"11716:TCP"= 11716:TCP:BitComet 11716 TCP
"11716:UDP"= 11716:UDP:BitComet 11716 UDP

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R1 ohci13944;ohci13944;c:\windows\system32\drivers\ohci13944.sys [2008-12-06 86272]
R2 datunidr;DellAutomatedPCTuneUp UniDriver;c:\windows\system32\DRIVERS\datunidr.sys [2007-08-23 5376]
R2 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-12-06 170640]
R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2008-03-14 598856]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592]
R3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys [2008-12-06 15504]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [2008-03-13 40832]
S4 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d25072f8-ecb2-11dc-acd7-001e4cc19240}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-12-09 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 15:17]

2008-12-09 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]

2008-08-03 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe [2007-08-16 08:03]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-zepefuruda - c:\windows\system32\perofile.dll


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://google.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FireFox -: Profile - c:\documents and settings\Linette\Application Data\Mozilla\Firefox\Profiles\mvjx1i4e.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - google.com
FF -: plugin - c:\documents and settings\Linette\Application Data\Mozilla\Firefox\Profiles\mvjx1i4e.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF -: plugin - c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-09 21:06:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1252)
c:\windows\system32\klogon.dll
c:\windows\system32\WRLogonNTF.dll
c:\windows\System32\BCMLogon.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 2008-12-09 21:10:17 - machine was rebooted [Linette]
ComboFix-quarantined-files.txt 2008-12-10 02:10:14
ComboFix2.txt 2008-12-10 01:07:33
ComboFix3.txt 2008-12-10 00:52:35

Pre-Run: 137,082,052,608 bytes free
Post-Run: 137,053,872,128 bytes free

269 — E O F — 2008-11-28 02:20:09

Thanks in advance!

Hey there,
Sorry for the delay. I did what you said and here are the logs. I still get pop-ups from IE

Combofix Log
ComboFix 08-12-15.03 - Linette 2008-12-15 20:18:34.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1552 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\C
c:\windows\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2008-11-16 to 2008-12-16 )))))))))))))))))))))))))))))))
.

2008-12-15 16:04 . 2008-12-15 17:25 d——– c:\documents and settings\Linette\Application Data\BloodTies
2008-12-14 16:54 . 2008-12-14 20:30 d——– c:\documents and settings\Linette\Application Data\Ubisoft
2008-12-14 16:38 . 2008-12-14 16:38 d——– c:\program files\Ubisoft
2008-12-12 03:01 . 2008-12-13 03:08 1,393 –a—— c:\windows\imsins.BAK
2008-12-12 00:18 . 2008-10-03 05:02 247,326 ——— c:\windows\system32\dllcache\strmdll.dll
2008-12-10 19:23 . 2008-12-10 19:23 d——– c:\program files\Drug Lord 2
2008-12-07 00:17 . 2008-12-07 00:17 d——– c:\program files\PogoDeluxe
2008-12-06 20:31 . 2008-12-06 20:31 d——– c:\program files\Enigma Software Group
2008-12-06 19:57 . 2008-12-06 19:57 d——– c:\program files\Lavasoft
2008-12-06 19:57 . 2008-12-06 19:58 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-06 19:49 . 2008-12-06 19:49 d——– c:\program files\Trend Micro
2008-12-06 16:59 . 2008-12-06 16:59 d——– c:\documents and settings\Linette\Application Data\Malwarebytes
2008-12-06 16:58 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-06 16:57 . 2008-12-06 16:59 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-06 16:57 . 2008-12-06 16:57 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-06 16:57 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-06 16:51 . 2008-12-15 20:22 932 ——— c:\windows\system32\drivers\core.cache.dsk
2008-12-06 15:22 . 2008-03-03 18:32 d——– c:\documents and settings\Administrator\Application Data\InstallShield
2008-12-06 15:22 . 2008-03-03 18:43 d–h—– c:\documents and settings\Administrator\Application Data\GTek
2008-12-06 15:21 . 2008-12-06 15:22 d——– c:\documents and settings\Administrator
2008-12-06 13:05 . 2008-12-06 13:05 86,272 ——— c:\windows\system32\drivers\ohci13944.sys
2008-12-03 18:46 . 2008-11-21 15:37 274,432 –a—— c:\windows\system32\TubeFinder.exe
2008-12-03 17:06 . 2008-12-03 17:06 d——– c:\program files\Sector 69
2008-11-27 21:16 . 2008-11-27 21:16 d——– c:\program files\MSXML 4.0
2008-11-27 16:30 . 2008-10-24 06:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-27 16:29 . 2008-09-04 12:15 1,106,944 ——— c:\windows\system32\dllcache\msxml3.dll
2008-11-27 16:29 . 2008-10-15 11:34 337,408 ——— c:\windows\system32\dllcache\netapi32.dll
2008-11-21 16:46 . 2008-11-21 16:46 1,044,480 –a–c— c:\windows\system32\libdivx.dll
2008-11-21 16:46 . 2008-11-21 16:46 200,704 –a–c— c:\windows\system32\ssldivx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-16 01:22 197,156 –sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-16 01:22 14,640,672 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-16 01:22 119,540 –sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-16 01:22 1,263,648 –sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-15 21:02 ——— d—–w c:\program files\LeeGTs Games
2008-12-15 20:35 ——— d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-14 21:47 ——— d—–w c:\program files\Trivial Pursuit Silver Screen Edition
2008-12-10 23:35 ——— d—–w c:\documents and settings\Linette\Application Data\LimeWire
2008-12-10 01:20 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-09 01:37 ——— d—–w c:\program files\Corel
2008-12-09 01:37 ——— d—–w c:\documents and settings\Linette\Application Data\Corel
2008-12-07 07:31 ——— d—–w c:\documents and settings\Linette\Application Data\Move Networks
2008-12-07 00:56 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-07 00:37 2,024 —-a-w c:\program files\sbbtqqg.txt
2008-12-06 22:59 ——— d—–w c:\documents and settings\Linette\Application Data\U3
2008-12-06 18:04 ——— d—–w c:\program files\DivX
2008-12-03 23:48 ——— d—–w c:\program files\Free FLV Converter
2008-11-09 02:45 ——— d—–w c:\documents and settings\Linette\Application Data\JoyBits
2008-10-27 21:49 660 —-a-w c:\documents and settings\Linette\Application Data\wklnhst.dat
2008-10-27 21:46 ——— d—–w c:\documents and settings\Linette\Application Data\Template
2008-10-27 21:44 ——— d—–w c:\program files\Microsoft Works
2008-10-24 21:51 ——— d—–w c:\documents and settings\Linette\Application Data\Dragon Altar Games
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 09:18 ——— d—–w c:\documents and settings\All Users\Application Data\JollyBear
2008-10-20 02:35 ——— d—–w c:\program files\Shockwave.com
2008-10-20 02:34 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-18 07:46 ——— d—–w c:\documents and settings\Linette\Application Data\GameHouse
2008-10-16 03:14 ——— d—–w c:\documents and settings\Linette\Application Data\FloodLightGames
2008-10-16 03:14 ——— d—–w c:\documents and settings\All Users\Application Data\FloodLightGames
2008-10-16 02:55 ——— d—–w c:\documents and settings\Linette\Application Data\AJ SQUARE INC
2008-08-16 03:01 24 -c–a-w c:\documents and settings\Linette\jagex_runescape_preferences.dat
2008-04-09 16:58 47,360 -c–a-w c:\documents and settings\Linette\Application Data\pcouffin.sys
2008-04-06 04:15 88 –sh–r c:\windows\system32\39A17EFCCB.sys
.

((((((((((((((((((((((((((((( snapshot@2008-12-09_19.51.47.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-23 10:17:49 62,976 —-a-w c:\windows\$hf_mig$\KB955839\SP3QFE\tzchange.exe
+ 2007-11-30 12:39:22 17,272 —-a-w c:\windows\$hf_mig$\KB955839\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w c:\windows\$hf_mig$\KB955839\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w c:\windows\$hf_mig$\KB955839\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 —-a-w c:\windows\$hf_mig$\KB955839\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w c:\windows\$hf_mig$\KB955839\update\updspapi.dll
+ 2004-07-09 09:26:38 11,392 —-a-w c:\windows\Driver Cache\i386\bdasup.sys
+ 2004-07-09 09:26:38 16,384 —-a-w c:\windows\Driver Cache\i386\ccdecode.sys
+ 2002-12-12 05:14:32 130,304 —-a-w c:\windows\Driver Cache\i386\ks.sys
+ 2002-12-12 05:14:32 4,096 —-a-w c:\windows\Driver Cache\i386\ksuser.dll
+ 2004-07-09 09:26:38 15,104 —-a-w c:\windows\Driver Cache\i386\mpe.sys
+ 2004-07-09 09:26:38 52,096 —-a-w c:\windows\Driver Cache\i386\msdv.sys
+ 2002-12-12 05:14:32 7,424 —-a-w c:\windows\Driver Cache\i386\mskssrv.sys
+ 2002-12-12 05:14:32 5,248 —-a-w c:\windows\Driver Cache\i386\mspclock.sys
+ 2001-08-23 10:00:00 4,608 —-a-w c:\windows\Driver Cache\i386\mspqm.sys
+ 2002-12-12 05:14:32 5,504 —-a-w c:\windows\Driver Cache\i386\mstee.sys
+ 2004-07-09 09:26:38 16,896 —-a-w c:\windows\Driver Cache\i386\msyuv.dll
+ 2004-07-09 09:26:38 83,968 —-a-w c:\windows\Driver Cache\i386\nabtsfec.sys
+ 2004-07-09 09:26:38 10,112 —-a-w c:\windows\Driver Cache\i386\ndisip.sys
+ 2002-08-29 08:41:00 31,744 —-a-w c:\windows\Driver Cache\i386\pid.dll
+ 2004-07-09 09:26:40 354,816 —-a-w c:\windows\Driver Cache\i386\psisdecd.dll
+ 2004-07-09 09:26:40 10,880 —-a-w c:\windows\Driver Cache\i386\slip.sys
+ 2004-07-09 09:27:28 48,512 —-a-w c:\windows\Driver Cache\i386\stream.sys
+ 2004-07-09 09:26:40 14,976 —-a-w c:\windows\Driver Cache\i386\streamip.sys
+ 2002-12-12 05:14:32 4,096 —-a-w c:\windows\Driver Cache\i386\swenum.sys
+ 2004-07-09 09:26:40 18,688 —-a-w c:\windows\Driver Cache\i386\wstcodec.sys
+ 2008-08-26 07:24:28 124,928 -c—-w c:\windows\ie7updates\KB958215-IE7\advpack.dll
+ 2008-08-26 07:24:28 347,136 -c—-w c:\windows\ie7updates\KB958215-IE7\dxtmsft.dll
+ 2008-08-26 07:24:28 214,528 -c—-w c:\windows\ie7updates\KB958215-IE7\dxtrans.dll
+ 2008-08-26 07:24:28 133,120 -c—-w c:\windows\ie7updates\KB958215-IE7\extmgr.dll
+ 2008-08-26 07:24:28 63,488 -c—-w c:\windows\ie7updates\KB958215-IE7\icardie.dll
+ 2008-08-25 08:37:59 70,656 -c—-w c:\windows\ie7updates\KB958215-IE7\ie4uinit.exe
+ 2008-08-26 07:24:28 153,088 -c—-w c:\windows\ie7updates\KB958215-IE7\ieakeng.dll
+ 2008-08-26 07:24:28 230,400 -c—-w c:\windows\ie7updates\KB958215-IE7\ieaksie.dll
+ 2008-08-23 05:54:51 161,792 -c—-w c:\windows\ie7updates\KB958215-IE7\ieakui.dll
+ 2008-08-26 07:24:28 383,488 -c—-w c:\windows\ie7updates\KB958215-IE7\ieapfltr.dll
+ 2008-08-26 07:24:29 384,512 -c—-w c:\windows\ie7updates\KB958215-IE7\iedkcs32.dll
+ 2008-10-03 17:41:15 6,066,176 -c—-w c:\windows\ie7updates\KB958215-IE7\ieframe.dll
+ 2008-08-26 07:24:29 44,544 -c—-w c:\windows\ie7updates\KB958215-IE7\iernonce.dll
+ 2008-08-26 07:24:29 267,776 -c—-w c:\windows\ie7updates\KB958215-IE7\iertutil.dll
+ 2008-08-25 08:38:00 13,824 -c—-w c:\windows\ie7updates\KB958215-IE7\ieudinit.exe
+ 2008-08-23 05:56:15 635,848 -c—-w c:\windows\ie7updates\KB958215-IE7\iexplore.exe
+ 2008-08-26 07:24:30 27,648 -c—-w c:\windows\ie7updates\KB958215-IE7\jsproxy.dll
+ 2008-08-26 07:24:30 459,264 -c—-w c:\windows\ie7updates\KB958215-IE7\msfeeds.dll
+ 2008-08-26 07:24:30 52,224 -c—-w c:\windows\ie7updates\KB958215-IE7\msfeedsbs.dll
+ 2008-08-27 08:24:32 3,593,216 -c—-w c:\windows\ie7updates\KB958215-IE7\mshtml.dll
+ 2008-08-26 07:24:30 477,696 -c—-w c:\windows\ie7updates\KB958215-IE7\mshtmled.dll
+ 2008-08-26 07:24:30 193,024 -c—-w c:\windows\ie7updates\KB958215-IE7\msrating.dll
+ 2008-08-26 07:24:30 671,232 -c—-w c:\windows\ie7updates\KB958215-IE7\mstime.dll
+ 2008-08-26 07:24:30 102,912 -c—-w c:\windows\ie7updates\KB958215-IE7\occache.dll
+ 2008-08-26 07:24:30 44,544 -c—-w c:\windows\ie7updates\KB958215-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c—-w c:\windows\ie7updates\KB958215-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w c:\windows\ie7updates\KB958215-IE7\spuninst\updspapi.dll
+ 2008-08-26 07:24:30 105,984 -c—-w c:\windows\ie7updates\KB958215-IE7\url.dll
+ 2008-08-26 07:24:31 1,159,680 -c—-w c:\windows\ie7updates\KB958215-IE7\urlmon.dll
+ 2008-08-26 07:24:31 233,472 -c—-w c:\windows\ie7updates\KB958215-IE7\webcheck.dll
+ 2008-08-26 07:24:31 826,368 -c—-w c:\windows\ie7updates\KB958215-IE7\wininet.dll
+ 2008-12-15 21:03:30 22,486 —-a-r c:\windows\Installer\{158B5D3E-CB7D-4B57-8BF9-BC3B1E138B87}\controlPanelIcon.exe
- 2008-11-28 02:18:15 593,920 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-12-13 08:10:13 593,920 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-11-28 02:18:15 12,288 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-12-13 08:10:13 12,288 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-11-28 02:18:15 86,016 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2008-12-13 08:10:13 86,016 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-11-28 02:18:15 135,168 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-12-13 08:10:13 135,168 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-11-28 02:18:15 11,264 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-12-13 08:10:13 11,264 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-11-28 02:18:15 27,136 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-12-13 08:10:14 27,136 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-11-28 02:18:15 4,096 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-12-13 08:10:14 4,096 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-11-28 02:18:15 794,624 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-12-13 08:10:14 794,624 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-11-28 02:18:15 249,856 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-12-13 08:10:13 249,856 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-11-28 02:18:15 61,440 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2008-12-13 08:10:13 61,440 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-11-28 02:18:15 23,040 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-12-13 08:10:14 23,040 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-11-28 02:18:15 286,720 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-12-13 08:10:13 286,720 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-11-28 02:18:14 409,600 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-12-13 08:10:12 409,600 —-a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-11-28 02:18:34 38,240 —-a-r c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2008-12-13 08:11:32 38,240 —-a-r c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2002-12-12 05:14:32 64,512 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\amstream.dll
+ 2004-07-09 09:27:28 1,201,152 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\d3d8.dll
+ 2002-12-12 05:14:32 8,192 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\d3d8thk.dll
+ 2003-05-30 14:00:02 797,184 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\d3dim700.dll
+ 2004-07-09 09:27:28 292,864 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\ddraw.dll
+ 2002-12-12 05:14:32 24,064 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\ddrawex.dll
+ 2003-05-30 14:00:02 132,608 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\devenum.dll
+ 2002-12-12 05:14:32 27,136 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmband.dll
+ 2002-12-12 05:14:32 58,368 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmcompos.dll
+ 2004-07-09 09:27:28 181,248 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmime.dll
+ 2002-12-12 05:14:32 33,280 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmloader.dll
+ 2002-12-12 05:14:32 76,800 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmscript.dll
+ 2002-12-12 05:14:32 98,816 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmstyle.dll
+ 2002-12-12 05:14:32 100,864 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmsynth.dll
+ 2004-07-09 09:27:28 122,880 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmusic.dll
+ 2002-12-12 05:14:32 28,160 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dplaysvr.exe
+ 2004-07-09 09:27:28 230,400 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dplayx.dll
+ 2002-12-12 05:14:32 77,824 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpmodemx.dll
+ 2002-12-12 05:14:32 3,072 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnaddr.dll
+ 2002-12-12 05:14:32 723,968 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnet.dll
+ 2003-03-24 14:00:02 32,768 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnhpast.dll
+ 2003-03-24 14:00:02 68,096 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnhupnp.dll
+ 2002-12-12 05:14:32 3,072 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnlobby.dll
+ 2002-12-12 05:14:32 16,896 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnsvr.exe
+ 2002-12-12 05:14:32 19,968 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpvacm.dll
+ 2002-12-12 05:14:32 381,952 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpvoice.dll
+ 2002-12-12 05:14:32 80,896 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpvsetup.exe
+ 2002-12-12 05:14:32 112,128 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpvvox.dll
+ 2004-07-09 09:27:28 79,360 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpwsockx.dll
+ 2002-12-12 05:14:32 186,880 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dsdmo.dll
+ 2002-12-12 05:14:32 491,520 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dsdmoprp.dll
+ 2004-07-09 09:27:28 381,952 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dsound.dll
+ 2002-12-12 05:14:32 1,294,336 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dsound3d.dll
+ 2002-12-12 05:14:32 18,432 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dswave.dll
+ 2002-12-12 05:14:32 602,624 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dx7vb.dll
+ 2003-05-30 14:00:02 1,189,888 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dx8vb.dll
+ 2004-07-09 09:27:28 974,848 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dxdiag.exe
+ 2002-12-12 05:14:32 46,592 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dxdllreg.exe
+ 2002-12-12 05:14:32 18,944 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\encapi.dll
+ 2002-12-12 05:14:32 130,304 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\ks.sys
+ 2002-12-12 05:14:32 4,096 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\ksuser.dll
+ 2002-12-12 05:14:32 34,304 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mciqtz32.dll
+ 2002-12-12 05:14:32 13,312 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\msdmo.dll
+ 2002-12-12 05:14:32 7,424 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mskssrv.sys
+ 2002-12-12 05:14:32 5,248 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mspclock.sys
+ 2001-08-23 10:00:00 4,608 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mspqm.sys
+ 2002-12-12 05:14:32 5,504 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mstee.sys
+ 2002-12-12 05:14:32 324,096 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mswebdvd.dll
+ 2002-12-12 05:14:32 173,056 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qasf.dll
+ 2002-12-12 05:14:32 257,024 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qcap.dll
+ 2004-07-09 09:27:28 316,928 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qdv.dll
+ 2004-07-09 09:27:28 470,528 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qdvd.dll
+ 2002-12-12 05:14:32 1,798,144 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qedit.dll
+ 2002-12-12 05:14:32 733,184 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qedwipes.dll
+ 2003-05-30 14:00:02 1,962,496 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\quartz.dll
+ 2004-07-09 09:27:28 48,512 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\stream.sys
+ 2002-12-12 05:14:32 4,096 —-a-w c:\windows\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\swenum.sys
+ 2004-07-09 09:26:38 11,392 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\bdasup.sys
+ 2004-07-09 09:26:38 16,384 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\ccdecode.sys
+ 2004-07-09 09:26:38 15,104 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\mpe.sys
+ 2004-07-09 09:26:38 1,230,336 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\msvidctl.dll
+ 2004-07-09 09:26:38 16,896 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\msyuv.dll
+ 2004-07-09 09:26:38 83,968 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\nabtsfec.sys
+ 2004-07-09 09:26:38 10,112 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\ndisip.sys
+ 2004-07-09 09:26:40 354,816 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\psisdecd.dll
+ 2004-07-09 09:26:40 10,880 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\slip.sys
+ 2004-07-09 09:26:40 14,976 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\streamip.sys
+ 2004-07-09 09:26:40 18,688 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\wstcodec.sys
+ 2004-07-09 09:26:40 47,104 —-a-w c:\windows\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\wstdecod.dll
- 2008-08-26 07:24:28 124,928 —-a-w c:\windows\system32\advpack.dll
+ 2008-10-16 20:38:34 124,928 —-a-w c:\windows\system32\advpack.dll
- 2008-08-26 07:24:28 124,928 ——w c:\windows\system32\dllcache\advpack.dll
+ 2008-10-16 20:38:34 124,928 ——w c:\windows\system32\dllcache\advpack.dll
+ 2004-07-09 09:26:38 11,392 —-a-w c:\windows\system32\dllcache\bdasup.sys
+ 2004-07-09 09:26:38 16,384 —-a-w c:\windows\system32\dllcache\ccdecode.sys
+ 2004-07-09 09:27:28 1,201,152 —-a-w c:\windows\system32\dllcache\d3d8.dll
+ 2002-12-12 05:14:32 8,192 —-a-w c:\windows\system32\dllcache\d3d8thk.dll
+ 2001-08-23 10:00:00 436,224 —-a-w c:\windows\system32\dllcache\d3dim.dll
+ 2003-05-30 14:00:02 797,184 —-a-w c:\windows\system32\dllcache\d3dim700.dll
+ 2001-08-23 10:00:00 34,816 —-a-w c:\windows\system32\dllcache\d3dpmesh.dll
+ 2001-08-23 10:00:00 590,336 —-a-w c:\windows\system32\dllcache\d3dramp.dll
+ 2001-08-23 10:00:00 350,208 —-a-w c:\windows\system32\dllcache\d3drm.dll
+ 2001-08-23 10:00:00 47,616 —-a-w c:\windows\system32\dllcache\d3dxof.dll
+ 2004-07-09 09:27:28 292,864 —-a-w c:\windows\system32\dllcache\ddraw.dll
+ 2002-12-12 05:14:32 24,064 —-a-w c:\windows\system32\dllcache\ddrawex.dll
+ 2003-05-30 14:00:02 132,608 —-a-w c:\windows\system32\dllcache\devenum.dll
+ 2001-08-23 10:00:00 467,968 —-a-w c:\windows\system32\dllcache\diactfrm.dll
+ 2001-08-23 10:00:00 44,032 —-a-w c:\windows\system32\dllcache\dimap.dll
+ 2002-08-29 08:40:00 648,704 —-a-w c:\windows\system32\dllcache\dinput.dll
+ 2002-08-29 08:40:00 667,648 —-a-w c:\windows\system32\dllcache\dinput8.dll
+ 2002-12-12 05:14:32 33,280 —-a-w c:\windows\system32\dllcache\dmloader.dll
+ 2004-07-09 09:27:28 122,880 —-a-w c:\windows\system32\dllcache\dmusic.dll
+ 2002-12-12 05:14:32 28,160 —-a-w c:\windows\system32\dllcache\dplaysvr.exe
+ 2004-07-09 09:27:28 381,952 —-a-w c:\windows\system32\dllcache\dsound.dll
+ 2001-08-23 10:00:00 10,496 —-a-w c:\windows\system32\dllcache\dxapi.sys
- 2008-08-26 07:24:28 347,136 ——w c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-10-16 20:38:34 347,136 ——w c:\windows\system32\dllcache\dxtmsft.dll
- 2008-08-26 07:24:28 214,528 ——w c:\windows\system32\dllcache\dxtrans.dll
+ 2008-10-16 20:38:34 214,528 ——w c:\windows\system32\dllcache\dxtrans.dll
- 2008-08-26 07:24:28 133,120 ——w c:\windows\system32\dllcache\extmgr.dll
+ 2008-10-16 20:38:35 133,120 ——w c:\windows\system32\dllcache\extmgr.dll
+ 2001-08-23 10:00:00 223,232 —-a-w c:\windows\system32\dllcache\gcdef.dll
+ 2008-10-23 12:36:14 286,720 ——w c:\windows\system32\dllcache\gdi32.dll
- 2008-08-26 07:24:28 63,488 ——w c:\windows\system32\dllcache\icardie.dll
+ 2008-10-16 20:38:35 63,488 ——w c:\windows\system32\dllcache\icardie.dll
- 2008-08-25 08:37:59 70,656 ——w c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-10-16 13:11:09 70,656 ——w c:\windows\system32\dllcache\ie4uinit.exe
- 2008-08-26 07:24:28 153,088 ——w c:\windows\system32\dllcache\ieakeng.dll
+ 2008-10-16 20:38:35 153,088 ——w c:\windows\system32\dllcache\ieakeng.dll
- 2008-08-26 07:24:28 230,400 ——w c:\windows\system32\dllcache\ieaksie.dll
+ 2008-10-16 20:38:35 230,400 ——w c:\windows\system32\dllcache\ieaksie.dll
- 2008-08-23 05:54:51 161,792 ——w c:\windows\system32\dllcache\ieakui.dll
+ 2008-10-15 07:04:53 161,792 ——w c:\windows\system32\dllcache\ieakui.dll
- 2008-08-26 07:24:28 383,488 ——w c:\windows\system32\dllcache\ieapfltr.dll
+ 2008-10-16 20:38:35 383,488 ——w c:\windows\system32\dllcache\ieapfltr.dll
- 2008-08-26 07:24:29 384,512 ——w c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-10-16 20:38:35 384,512 ——w c:\windows\system32\dllcache\iedkcs32.dll
- 2008-10-03 17:41:15 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
+ 2008-10-16 20:38:37 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
- 2008-08-26 07:24:29 44,544 ——w c:\windows\system32\dllcache\iernonce.dll
+ 2008-10-16 20:38:37 44,544 ——w c:\windows\system32\dllcache\iernonce.dll
- 2008-08-26 07:24:29 267,776 ——w c:\windows\system32\dllcache\iertutil.dll
+ 2008-10-16 20:38:37 267,776 ——w c:\windows\system32\dllcache\iertutil.dll
- 2008-08-25 08:38:00 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe
+ 2008-10-16 13:11:09 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe
- 2008-08-23 05:56:15 635,848 ——w c:\windows\system32\dllcache\iexplore.exe
+ 2008-10-15 07:06:26 633,632 ——w c:\windows\system32\dllcache\iexplore.exe
- 2008-08-26 07:24:30 27,648 ——w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-10-16 20:38:37 27,648 ——w c:\windows\system32\dllcache\jsproxy.dll
- 2006-10-19 00:03:58 100,864 —-a-w c:\windows\system32\dllcache\logagent.exe
+ 2008-06-18 06:09:22 100,864 —-a-w c:\windows\system32\dllcache\logagent.exe
+ 2002-12-12 05:14:32 34,304 —-a-w c:\windows\system32\dllcache\mciqtz32.dll
+ 2004-07-09 09:26:38 15,104 —-a-w c:\windows\system32\dllcache\mpe.sys
+ 2002-12-12 05:14:32 13,312 —-a-w c:\windows\system32\dllcache\msdmo.dll
+ 2004-07-09 09:26:38 52,096 —-a-w c:\windows\system32\dllcache\msdv.sys
- 2008-08-26 07:24:30 459,264 ——w c:\windows\system32\dllcache\msfeeds.dll
+ 2008-10-16 20:38:37 459,264 ——w c:\windows\system32\dllcache\msfeeds.dll
- 2008-08-26 07:24:30 52,224 ——w c:\windows\system32\dllcache\msfeedsbs.dll
+ 2008-10-16 20:38:37 52,224 ——w c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-08-27 08:24:32 3,593,216 ——w c:\windows\system32\dllcache\mshtml.dll
+ 2008-10-17 07:08:40 3,593,216 ——w c:\windows\system32\dllcache\mshtml.dll
- 2008-08-26 07:24:30 477,696 ——w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-10-16 20:38:38 477,696 ——w c:\windows\system32\dllcache\mshtmled.dll
- 2008-08-26 07:24:30 193,024 ——w c:\windows\system32\dllcache\msrating.dll
+ 2008-10-16 20:38:38 193,024 ——w c:\windows\system32\dllcache\msrating.dll
+ 2002-12-12 05:14:32 5,504 —-a-w c:\windows\system32\dllcache\mstee.sys
- 2008-08-26 07:24:30 671,232 ——w c:\windows\system32\dllcache\mstime.dll
+ 2008-10-16 20:38:39 671,232 ——w c:\windows\system32\dllcache\mstime.dll
+ 2004-07-09 09:26:38 1,230,336 —-a-w c:\windows\system32\dllcache\msvidctl.dll
+ 2004-07-09 09:26:38 83,968 —-a-w c:\windows\system32\dllcache\nabtsfec.sys
+ 2004-07-09 09:26:38 10,112 —-a-w c:\windows\system32\dllcache\ndisip.sys
- 2008-08-26 07:24:30 102,912 ——w c:\windows\system32\dllcache\occache.dll
+ 2008-10-16 20:38:39 102,912 ——w c:\windows\system32\dllcache\occache.dll
- 2008-08-26 07:24:30 44,544 ——w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-10-16 20:38:39 44,544 ——w c:\windows\system32\dllcache\pngfilt.dll
+ 2004-07-09 09:26:40 354,816 —-a-w c:\windows\system32\dllcache\psisdecd.dll
+ 2002-12-12 05:14:32 173,056 —-a-w c:\windows\system32\dllcache\qasf.dll
+ 2004-07-09 09:27:28 316,928 —-a-w c:\windows\system32\dllcache\qdv.dll
+ 2004-07-09 09:27:28 470,528 —-a-w c:\windows\system32\dllcache\qdvd.dll
+ 2002-12-12 05:14:32 1,798,144 —-a-w c:\windows\system32\dllcache\qedit.dll
+ 2004-07-09 09:26:40 10,880 —-a-w c:\windows\system32\dllcache\slip.sys
+ 2004-07-09 09:26:40 14,976 —-a-w c:\windows\system32\dllcache\streamip.sys
- 2008-08-26 07:24:30 105,984 ——w c:\windows\system32\dllcache\url.dll
+ 2008-10-16 20:38:39 105,984 ——w c:\windows\system32\dllcache\url.dll
- 2008-08-26 07:24:31 1,159,680 ——w c:\windows\system32\dllcache\urlmon.dll
+ 2008-10-16 20:38:39 1,160,192 ——w c:\windows\system32\dllcache\urlmon.dll
- 2008-08-26 07:24:31 233,472 ——w c:\windows\system32\dllcache\webcheck.dll
+ 2008-10-16 20:38:39 233,472 ——w c:\windows\system32\dllcache\webcheck.dll
- 2008-08-26 07:24:31 826,368 ——w c:\windows\system32\dllcache\wininet.dll
+ 2008-10-16 20:38:40 826,368 ——w c:\windows\system32\dllcache\wininet.dll
+ 2008-06-18 10:03:08 938,496 ——w c:\windows\system32\dllcache\WMNetmgr.dll
+ 2008-06-18 10:03:14 2,458,112 ——w c:\windows\system32\dllcache\WMVCore.dll
+ 2004-07-09 09:26:40 18,688 —-a-w c:\windows\system32\dllcache\wstcodec.sys
+ 2004-07-09 09:26:38 11,392 —-a-w c:\windows\system32\drivers\bdasup.sys
+ 2004-07-09 09:26:38 16,384 —-a-w c:\windows\system32\drivers\ccdecode.sys
+ 2004-07-09 09:26:38 15,104 —-a-w c:\windows\system32\drivers\mpe.sys
+ 2004-07-09 09:26:38 52,096 —-a-w c:\windows\system32\drivers\msdv.sys
+ 2002-12-12 05:14:32 5,504 —-a-w c:\windows\system32\drivers\mstee.sys
+ 2004-07-09 09:26:38 83,968 —-a-w c:\windows\system32\drivers\nabtsfec.sys
+ 2004-07-09 09:26:38 10,112 —-a-w c:\windows\system32\drivers\ndisip.sys
+ 2004-07-09 09:26:40 10,880 —-a-w c:\windows\system32\drivers\slip.sys
+ 2004-07-09 09:26:40 14,976 —-a-w c:\windows\system32\drivers\streamip.sys
+ 2004-07-09 09:26:40 18,688 —-a-w c:\windows\system32\drivers\wstcodec.sys
+ 2002-12-12 05:14:32 46,592 —-a-w c:\windows\system32\dxdllreg.exe
- 2008-08-26 07:24:28 347,136 ——w c:\windows\system32\dxtmsft.dll
+ 2008-10-16 20:38:34 347,136 ——w c:\windows\system32\dxtmsft.dll
- 2008-08-26 07:24:28 214,528 ——w c:\windows\system32\dxtrans.dll
+ 2008-10-16 20:38:34 214,528 ——w c:\windows\system32\dxtrans.dll
- 2008-08-26 07:24:28 133,120 ——w c:\windows\system32\extmgr.dll
+ 2008-10-16 20:38:35 133,120 ——w c:\windows\system32\extmgr.dll
- 2008-04-14 00:11:54 285,184 —-a-w c:\windows\system32\gdi32.dll
+ 2008-10-23 12:36:14 286,720 —-a-w c:\windows\system32\gdi32.dll
- 2008-08-26 07:24:28 63,488 —-a-w c:\windows\system32\icardie.dll
+ 2008-10-16 20:38:35 63,488 —-a-w c:\windows\system32\icardie.dll
- 2008-08-25 08:37:59 70,656 ——w c:\windows\system32\ie4uinit.exe
+ 2008-10-16 13:11:09 70,656 ——w c:\windows\system32\ie4uinit.exe
- 2008-08-26 07:24:28 153,088 ——w c:\windows\system32\ieakeng.dll
+ 2008-10-16 20:38:35 153,088 ——w c:\windows\system32\ieakeng.dll
- 2008-08-26 07:24:28 230,400 ——w c:\windows\system32\ieaksie.dll
+ 2008-10-16 20:38:35 230,400 ——w c:\windows\system32\ieaksie.dll
- 2008-08-23 05:54:51 161,792 ——w c:\windows\system32\ieakui.dll
+ 2008-10-15 07:04:53 161,792 ——w c:\windows\system32\ieakui.dll
- 2008-08-26 07:24:28 383,488 —-a-w c:\windows\system32\ieapfltr.dll
+ 2008-10-16 20:38:35 383,488 —-a-w c:\windows\system32\ieapfltr.dll
- 2008-08-26 07:24:29 384,512 ——w c:\windows\system32\iedkcs32.dll
+ 2008-10-16 20:38:35 384,512 ——w c:\windows\system32\iedkcs32.dll
- 2008-10-03 17:41:15 6,066,176 —-a-w c:\windows\system32\ieframe.dll
+ 2008-10-16 20:38:37 6,066,176 —-a-w c:\windows\system32\ieframe.dll
- 2008-08-26 07:24:29 44,544 ——w c:\windows\system32\iernonce.dll
+ 2008-10-16 20:38:37 44,544 ——w c:\windows\system32\iernonce.dll
- 2008-08-26 07:24:29 267,776 —-a-w c:\windows\system32\iertutil.dll
+ 2008-10-16 20:38:37 267,776 —-a-w c:\windows\system32\iertutil.dll
- 2008-08-25 08:38:00 13,824 —-a-w c:\windows\system32\ieudinit.exe
+ 2008-10-16 13:11:09 13,824 —-a-w c:\windows\system32\ieudinit.exe
- 2008-08-26 07:24:30 27,648 —-a-w c:\windows\system32\jsproxy.dll
+ 2008-10-16 20:38:37 27,648 —-a-w c:\windows\system32\jsproxy.dll
- 2006-10-19 00:03:58 100,864 -c–a-w c:\windows\system32\logagent.exe
+ 2008-06-18 06:09:22 100,864 —-a-w c:\windows\system32\logagent.exe
+ 2008-12-09 20:24:38 17,593,280 —-a-w c:\windows\system32\MRT.exe
- 2008-08-26 07:24:30 459,264 —-a-w c:\windows\system32\msfeeds.dll
+ 2008-10-16 20:38:37 459,264 —-a-w c:\windows\system32\msfeeds.dll
- 2008-08-26 07:24:30 52,224 —-a-w c:\windows\system32\msfeedsbs.dll
+ 2008-10-16 20:38:37 52,224 —-a-w c:\windows\system32\msfeedsbs.dll
- 2008-08-27 08:24:32 3,593,216 —-a-w c:\windows\system32\mshtml.dll
+ 2008-10-17 07:08:40 3,593,216 —-a-w c:\windows\system32\mshtml.dll
- 2008-08-26 07:24:30 477,696 —-a-w c:\windows\system32\mshtmled.dll
+ 2008-10-16 20:38:38 477,696 —-a-w c:\windows\system32\mshtmled.dll
- 2008-08-26 07:24:30 193,024 ——w c:\windows\system32\msrating.dll
+ 2008-10-16 20:38:38 193,024 ——w c:\windows\system32\msrating.dll
- 2008-08-26 07:24:30 671,232 ——w c:\windows\system32\mstime.dll
+ 2008-10-16 20:38:39 671,232 ——w c:\windows\system32\mstime.dll
- 2008-12-09 13:38:24 83,477 —-a-w c:\windows\system32\nvModes.dat
+ 2008-12-15 22:25:37 83,477 —-a-w c:\windows\system32\nvModes.dat
- 2008-08-26 07:24:30 102,912 ——w c:\windows\system32\occache.dll
+ 2008-10-16 20:38:39 102,912 ——w c:\windows\system32\occache.dll
- 2008-12-09 23:44:56 60,572 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-15 20:39:52 60,572 —-a-w c:\windows\system32\perfc009.dat
- 2008-12-09 23:44:56 397,550 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-15 20:39:52 397,550 —-a-w c:\windows\system32\perfh009.dat
- 2008-08-26 07:24:30 44,544 —-a-w c:\windows\system32\pngfilt.dll
+ 2008-10-16 20:38:39 44,544 —-a-w c:\windows\system32\pngfilt.dll
+ 2004-07-09 09:26:40 354,816 —-a-w c:\windows\system32\psisdecd.dll
- 2008-07-08 13:02:01 17,272 ——w c:\windows\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ——w c:\windows\system32\spmsg.dll
- 2008-04-14 00:12:07 246,814 —-a-w c:\windows\system32\strmdll.dll
+ 2008-10-03 10:02:42 247,326 —-a-w c:\windows\system32\strmdll.dll
- 2008-04-14 00:12:38 60,416 -c—-w c:\windows\system32\tzchange.exe
+ 2008-10-23 10:06:59 62,976 ——w c:\windows\system32\tzchange.exe
- 2008-08-26 07:24:30 105,984 —-a-w c:\windows\system32\url.dll
+ 2008-10-16 20:38:39 105,984 —-a-w c:\windows\system32\url.dll
- 2008-08-26 07:24:31 1,159,680 —-a-w c:\windows\system32\urlmon.dll
+ 2008-10-16 20:38:39 1,160,192 —-a-w c:\windows\system32\urlmon.dll
- 2008-08-26 07:24:31 233,472 —-a-w c:\windows\system32\webcheck.dll
+ 2008-10-16 20:38:39 233,472 —-a-w c:\windows\system32\webcheck.dll
- 2008-08-26 07:24:31 826,368 —-a-w c:\windows\system32\wininet.dll
+ 2008-10-16 20:38:40 826,368 —-a-w c:\windows\system32\wininet.dll
- 2006-10-19 01:47:20 937,984 —-a-w c:\windows\system32\WMNetMgr.dll
+ 2008-06-18 10:03:08 938,496 —-a-w c:\windows\system32\WMNetmgr.dll
- 2006-10-19 01:47:22 2,450,944 —-a-w c:\windows\system32\wmvcore.dll
+ 2008-06-18 10:03:14 2,458,112 —-a-w c:\windows\system32\WMVCore.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2008-12-03 399504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-29 8491008]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
backup=c:\windows\pss\Dell Network Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a–c— 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
–a–c— 2007-08-01 13:17 222592 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
–a—— 2007-10-09 18:17 2183168 c:\windows\system32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
–a–c— 2004-02-19 08:23 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellAutomatedPCTuneUp]
–a—— 2007-10-11 10:49 465136 c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
–a–c— 2007-05-24 08:03 17920 c:\dell\E-Center\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a–c— 2004-07-27 17:50 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a–c— 2004-07-27 17:50 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KADxMain]
–a–c— 2006-11-02 15:05 282624 c:\windows\system32\KADxMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2008-01-29 16:14 8491008 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a–c— 2008-01-29 16:14 81920 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a–c— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
–a–c— 2006-08-17 10:00 1116920 c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
–a—— 2008-01-04 19:56 5367664 c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2008-02-22 04:25 144784 c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
–a–c— 2007-06-03 15:20 851968 c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
–a–c— 2008-01-29 16:14 86016 c:\windows\system32\nvhotkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a–c— 2008-01-29 16:14 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
–a–c— 2007-06-06 16:28 405504 c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinDefend"=2 (0x2)
"gusvc"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"="RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
"Broadcom Wireless Manager UI"=c:\windows\system32\WLTRAY.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Documents and Settings\\Linette\\My Documents\\Games\\Strategy Games\\Age Of Empires 1 Gold EditionPortable\\Empires.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\patriots.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"11716:TCP"= 11716:TCP:BitComet 11716 TCP
"11716:UDP"= 11716:UDP:BitComet 11716 UDP

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R1 ohci13944;ohci13944;c:\windows\system32\drivers\ohci13944.sys [2008-12-06 86272]
R2 datunidr;DellAutomatedPCTuneUp UniDriver;c:\windows\system32\DRIVERS\datunidr.sys [2007-08-23 5376]
R2 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-12-06 170640]
R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2008-03-14 598856]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592]
R3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys [2008-12-06 15504]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [2008-03-13 40832]
S4 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d25072f8-ecb2-11dc-acd7-001e4cc19240}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-12-15 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 15:17]

2008-12-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]

2008-08-03 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe [2007-08-16 08:03]
.
- - - - ORPHANS REMOVED - - - -

BHO-{99410249-2538-44fc-a6dc-962f3772ea9f} - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://google.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Linette\Application Data\Mozilla\Firefox\Profiles\mvjx1i4e.default\
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
FF - user.js: network.http.max-connections-per-server - 8
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\Linette\Application Data\Mozilla\Firefox\Profiles\mvjx1i4e.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-15 20:23:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1260)
c:\windows\system32\klogon.dll
c:\windows\system32\WRLogonNTF.dll
c:\windows\System32\BCMLogon.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-12-15 20:29:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-16 01:29:08
ComboFix2.txt 2008-12-10 02:10:18
ComboFix3.txt 2008-12-10 01:07:33
ComboFix4.txt 2008-12-10 00:52:35

Pre-Run: 135,102,083,072 bytes free
Post-Run: 135,125,053,440 bytes free

610 — E O F — 2008-12-13 08:11:34


HJThis Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:33:06 PM, on 12/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

–
End of file - 5824 bytes


What's Next? & thanks for being patient, Was unable to access the internet for a few days.

OMG!!! I think you did it! I was browsing for like 10 minutes and NO POP UPS!!! I really appreciate your help!
I'm very computer literate but I made the mistake of surfing the net w/o my Kaspersky on. I didn't realize it was turned off….
But I know better next time to check before I surf! Thanks again!!!

These are the new logs…..Is there anything else I need to do??



Combofix Log

ComboFix 08-12-15.03 - Linette 2008-12-16 19:28:19.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1599 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Linette\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\system32\drivers\core.cache.dsk
c:\windows\system32\drivers\ohci13944.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\core.cache.dsk
c:\windows\system32\drivers\ohci13944.sys
c:\windows\system32\h@tkeysh@@k.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_OHCI13944
——-\Service_ohci13944


((((((((((((((((((((((((( Files Created from 2008-11-17 to 2008-12-17 )))))))))))))))))))))))))))))))
.

2008-12-16 09:29 . 2008-12-16 09:29 d——– c:\program files\Drug Wars
2008-12-15 16:04 . 2008-12-15 17:25 d——– c:\documents and settings\Linette\Application Data\BloodTies
2008-12-14 16:54 . 2008-12-14 20:30 d——– c:\documents and settings\Linette\Application Data\Ubisoft
2008-12-14 16:38 . 2008-12-14 16:38 d——– c:\program files\Ubisoft
2008-12-12 03:01 . 2008-12-13 03:08 1,393 –a—— c:\windows\imsins.BAK
2008-12-12 00:18 . 2008-10-03 05:02 247,326 ——— c:\windows\system32\dllcache\strmdll.dll
2008-12-10 19:23 . 2008-12-10 19:23 d——– c:\program files\Drug Lord 2
2008-12-07 00:17 . 2008-12-07 00:17 d——– c:\program files\PogoDeluxe
2008-12-06 20:31 . 2008-12-06 20:31 d——– c:\program files\Enigma Software Group
2008-12-06 19:57 . 2008-12-06 19:57 d——– c:\program files\Lavasoft
2008-12-06 19:57 . 2008-12-06 19:58 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-06 19:49 . 2008-12-06 19:49 d——– c:\program files\Trend Micro
2008-12-06 16:59 . 2008-12-06 16:59 d——– c:\documents and settings\Linette\Application Data\Malwarebytes
2008-12-06 16:58 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-06 16:57 . 2008-12-06 16:59 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-06 16:57 . 2008-12-06 16:57 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-06 16:57 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-06 15:22 . 2008-03-03 18:32 d——– c:\documents and settings\Administrator\Application Data\InstallShield
2008-12-06 15:22 . 2008-03-03 18:43 d–h—– c:\documents and settings\Administrator\Application Data\GTek
2008-12-06 15:21 . 2008-12-06 15:22 d——– c:\documents and settings\Administrator
2008-12-03 18:46 . 2008-11-21 15:37 274,432 –a—— c:\windows\system32\TubeFinder.exe
2008-12-03 17:06 . 2008-12-03 17:06 d——– c:\program files\Sector 69
2008-11-27 21:16 . 2008-11-27 21:16 d——– c:\program files\MSXML 4.0
2008-11-27 16:30 . 2008-10-24 06:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-27 16:29 . 2008-09-04 12:15 1,106,944 ——— c:\windows\system32\dllcache\msxml3.dll
2008-11-27 16:29 . 2008-10-15 11:34 337,408 ——— c:\windows\system32\dllcache\netapi32.dll
2008-11-21 16:46 . 2008-11-21 16:46 1,044,480 –a–c— c:\windows\system32\libdivx.dll
2008-11-21 16:46 . 2008-11-21 16:46 200,704 –a–c— c:\windows\system32\ssldivx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-17 00:32 197,156 –sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-17 00:32 14,640,672 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-17 00:32 119,540 –sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-17 00:32 1,263,648 –sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-17 00:18 ——— d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-15 21:02 ——— d—–w c:\program files\LeeGTs Games
2008-12-14 21:47 ——— d—–w c:\program files\Trivial Pursuit Silver Screen Edition
2008-12-10 23:35 ——— d—–w c:\documents and settings\Linette\Application Data\LimeWire
2008-12-10 01:20 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-09 01:37 ——— d—–w c:\program files\Corel
2008-12-09 01:37 ——— d—–w c:\documents and settings\Linette\Application Data\Corel
2008-12-07 07:31 ——— d—–w c:\documents and settings\Linette\Application Data\Move Networks
2008-12-07 00:56 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-07 00:37 2,024 —-a-w c:\program files\sbbtqqg.txt
2008-12-06 22:59 ——— d—–w c:\documents and settings\Linette\Application Data\U3
2008-12-06 18:04 ——— d—–w c:\program files\DivX
2008-12-03 23:48 ——— d—–w c:\program files\Free FLV Converter
2008-11-09 02:45 ——— d—–w c:\documents and settings\Linette\Application Data\JoyBits
2008-10-27 21:49 660 —-a-w c:\documents and settings\Linette\Application Data\wklnhst.dat
2008-10-27 21:46 ——— d—–w c:\documents and settings\Linette\Application Data\Template
2008-10-27 21:44 ——— d—–w c:\program files\Microsoft Works
2008-10-24 21:51 ——— d—–w c:\documents and settings\Linette\Application Data\Dragon Altar Games
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 09:18 ——— d—–w c:\documents and settings\All Users\Application Data\JollyBear
2008-10-20 02:35 ——— d—–w c:\program files\Shockwave.com
2008-10-20 02:34 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-18 07:46 ——— d—–w c:\documents and settings\Linette\Application Data\GameHouse
2008-08-16 03:01 24 -c–a-w c:\documents and settings\Linette\jagex_runescape_preferences.dat
2008-04-09 16:58 47,360 -c–a-w c:\documents and settings\Linette\Application Data\pcouffin.sys
2008-04-06 04:15 88 –sh–r c:\windows\system32\39A17EFCCB.sys
.

((((((((((((((((((((((((((((( snapshot_2008-12-15_20.28.20.14 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-15 22:25:37 83,477 —-a-w c:\windows\system32\nvModes.dat
+ 2008-12-16 13:01:16 83,477 —-a-w c:\windows\system32\nvModes.dat
- 2008-12-15 20:39:52 60,572 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-17 00:22:03 60,572 —-a-w c:\windows\system32\perfc009.dat
- 2008-12-15 20:39:52 397,550 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-17 00:22:03 397,550 —-a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2008-12-03 399504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-29 8491008]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
backup=c:\windows\pss\Dell Network Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a–c— 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
–a–c— 2007-08-01 13:17 222592 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
–a—— 2007-10-09 18:17 2183168 c:\windows\system32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
–a–c— 2004-02-19 08:23 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellAutomatedPCTuneUp]
–a—— 2007-10-11 10:49 465136 c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
–a–c— 2007-05-24 08:03 17920 c:\dell\E-Center\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a–c— 2004-07-27 17:50 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a–c— 2004-07-27 17:50 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KADxMain]
–a–c— 2006-11-02 15:05 282624 c:\windows\system32\KADxMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2008-01-29 16:14 8491008 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a–c— 2008-01-29 16:14 81920 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a–c— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
–a–c— 2006-08-17 10:00 1116920 c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
–a—— 2008-01-04 19:56 5367664 c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2008-02-22 04:25 144784 c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
–a–c— 2007-06-03 15:20 851968 c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
–a–c— 2008-01-29 16:14 86016 c:\windows\system32\nvhotkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a–c— 2008-01-29 16:14 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
–a–c— 2007-06-06 16:28 405504 c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinDefend"=2 (0x2)
"gusvc"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"="RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
"Broadcom Wireless Manager UI"=c:\windows\system32\WLTRAY.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Documents and Settings\\Linette\\My Documents\\Games\\Strategy Games\\Age Of Empires 1 Gold EditionPortable\\Empires.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\patriots.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"11716:TCP"= 11716:TCP:BitComet 11716 TCP
"11716:UDP"= 11716:UDP:BitComet 11716 UDP

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R2 datunidr;DellAutomatedPCTuneUp UniDriver;c:\windows\system32\DRIVERS\datunidr.sys [2007-08-23 5376]
R2 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-12-06 170640]
R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2008-03-14 598856]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592]
R3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys [2008-12-06 15504]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [2008-03-13 40832]
S4 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d25072f8-ecb2-11dc-acd7-001e4cc19240}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-12-16 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 15:17]

2008-12-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]

2008-08-03 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe [2007-08-16 08:03]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://google.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Linette\Application Data\Mozilla\Firefox\Profiles\mvjx1i4e.default\
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
FF - user.js: network.http.max-connections-per-server - 8
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\Linette\Application Data\Mozilla\Firefox\Profiles\mvjx1i4e.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 19:33:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1260)
c:\windows\system32\klogon.dll
c:\windows\system32\WRLogonNTF.dll
c:\windows\System32\BCMLogon.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 2008-12-16 19:38:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-17 00:38:27
ComboFix2.txt 2008-12-16 01:29:13
ComboFix3.txt 2008-12-10 02:10:18
ComboFix4.txt 2008-12-10 01:07:33
ComboFix5.txt 2008-12-17 00:27:37

Pre-Run: 135,078,649,856 bytes free
Post-Run: 135,049,367,552 bytes free

272 — E O F — 2008-12-13 08:11:34


HJThis Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:44:02 PM, on 12/16/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

–
End of file - 5857 bytes