[Closed] Infected with http://url.adtrgt.com/

I saw another post similar to this and saw that it was fixed. So I greatly look forward to getting this fixed. I greatly appreciate everyone in advance.

Here is the log file:

–
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:20, on 2008-12-30
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Kaos Inc\System Utilities\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\astsrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Microsoft SQL Server\MSSQL$SURADOCRMOFFLINE\Binn\sqlservr.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Kaos Inc\QK\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HLSW\hlsw.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\ACT\act.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {a58ef46e-0289-4eca-b0c0-6767866c58dd} - C:\WINDOWS\system32\tijoravi.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: {9e0ace73-bfbb-62a8-cc34-ceee8de0015b} - {b5100ed8-eeec-43cc-8a26-bbfb37eca0e9} - C:\WINDOWS\system32\mhwpkx.dll
O2 - BHO: (no name) - {BFAA2F19-4E4E-4094-8309-106D51452EDC} - C:\WINDOWS\system32\hgGyyvUN.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [\\TIMBROWN\EPSON Stylus Photo R220 Series shared] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P48 "\\TIMBROWN\EPSON Stylus Photo R220 Series shared" /O20 "\\timbrown\timbepson" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [\\PENNY\EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P38 "\\PENNY\EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [\\GORDONSLIVER\EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P45 "\\GORDONSLIVER\EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [masiyajufi] Rundll32.exe "C:\WINDOWS\system32\lenidure.dll",s
O4 - HKLM\..\Run: [c497680c] rundll32.exe "C:\WINDOWS\system32\yidehuyu.dll",b
O4 - HKLM\..\Run: [\\RICH\EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P37 "\\RICH\EPSON Stylus Photo R300 Series" /O6 "USB002" /M "Stylus Photo R300"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\Kaos Inc\QK\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [masiyajufi] Rundll32.exe "C:\WINDOWS\system32\lenidure.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [masiyajufi] Rundll32.exe "C:\WINDOWS\system32\lenidure.dll",s (User 'NETWORK SERVICE')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.7.109.cab
O16 - DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} (NSHelp Class) - http://tank/connectcomputer/nshelp.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Gemvision.local
O17 - HKLM\Software\..\Telephony: DomainName = Gemvision.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Gemvision.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Gemvision.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = Gemvision.local
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: gemsafe - C:\WINDOWS\
O20 - Winlogon Notify: urqNEtUk - C:\WINDOWS\SYSTEM32\urqNEtUk.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Kaos Inc\System Utilities\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\SYSTEM32\astsrv.exe
O23 - Service: ASTSRV - Nalpeiron Ltd. - c:\Windows\System32\AstSrv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.30\bin\mysqld.exe
O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/djohnson/LOCALS~1/Temp/msohtmlclip1/01/clip_image001.jpg

–
End of file - 14528 bytes

Here is my combofix log file:

ComboFix 08-12-29.02 - djohnson 2008-12-30 16:55:49.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.545 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\Kaos Inc\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\install.exe
c:\windows\system32\dazisitu.dll
c:\windows\system32\ejurimey.ini
c:\windows\system32\evihomah.ini
c:\windows\system32\guywwqtk.ini
c:\windows\system32\hgGyyvUN.dll
c:\windows\system32\hwqfvckp.dll
c:\windows\system32\lenidure.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\mhwpkx.dll
c:\windows\system32\mitapuwi.dll
c:\windows\system32\mlJcAQhh.dll
c:\windows\system32\NUvyyGgh.ini
c:\windows\system32\NUvyyGgh.ini2
c:\windows\system32\rsfoexxg.dll
c:\windows\system32\TDSSixgp.dll
c:\windows\system32\TDSSrtpe.dat
c:\windows\system32\tijoravi.dll
c:\windows\system32\tkjvdt.dll
c:\windows\system32\urqNEtUk.dll
c:\windows\system32\uyuhediy.ini
c:\windows\system32\wpv041229907443.cpx
c:\windows\system32\wpv921229907443.cpx
c:\windows\system32\yemiruje.dll
c:\windows\system32\yidehuyu.dll
c:\windows\system32\zezafoto.dll
c:\windows\wiaserviv.log

—– BITS: Possible infected sites —–

hxxp://childhe.com
.
((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-30 )))))))))))))))))))))))))))))))
.

2008-12-30 16:15 . 2008-12-30 16:15 d——– c:\program files\Trend Micro
2008-12-29 10:04 . 2008-12-29 10:04 d——– c:\program files\Microsoft Visual Studio 8
2008-12-27 19:59 . 2008-12-27 20:13 d——– c:\program files\Spybot - Search & Destroy
2008-12-27 12:29 . 2008-12-27 12:29 1,094,368 –a—— c:\windows\system32\rn.tmp
2008-12-27 12:20 . 2008-12-27 12:20 45,056 –a—— c:\windows\system32\efcBsPhI.dll
2008-12-26 01:41 . 2008-12-26 01:42 d——– C:\wamp
2008-12-25 15:19 . 2008-12-25 15:19 d——– c:\program files\GoldWave
2008-12-24 00:42 . 2008-12-24 00:42 d——– c:\windows\system32\Adobe
2008-12-23 15:16 . 2008-12-23 15:16 131,072 –a—— c:\windows\system32\SpoonUninstall.exe
2008-12-22 06:12 . 2008-12-22 06:12 d——– c:\program files\MySQL
2008-12-21 00:49 . 2008-12-21 00:49 d——– C:\Garmin
2008-12-21 00:07 . 2008-12-21 00:07 d——– c:\documents and settings\djohnson\Application Data\Windows Search
2008-12-19 18:00 . 2008-12-19 18:00 d—s—- c:\program files\HLSW
2008-12-19 18:00 . 2008-12-29 18:36 d——– c:\documents and settings\djohnson\Application Data\HLSW
2008-12-17 08:55 . 2008-12-17 08:55 d——– c:\windows\system32\GroupPolicy
2008-12-17 08:55 . 2008-12-23 19:11 d——– c:\program files\Windows Desktop Search
2008-12-16 13:00 . 2008-12-16 13:00 d——– c:\documents and settings\LocalService\Application Data\iolo
2008-12-16 11:02 . 2008-12-16 11:02 406 –a—— c:\windows\system32\ioloBootDefrag.cfg
2008-12-15 11:30 . 2008-12-15 11:30 268 –ah—– C:\sqmdata09.sqm
2008-12-15 11:30 . 2008-12-15 11:30 244 –ah—– C:\sqmnoopt09.sqm
2008-12-05 14:01 . 2008-12-05 14:32 d——– c:\documents and settings\djohnson\Application Data\Notepad++
2008-12-05 13:26 . 2008-12-06 00:41 d-a—— c:\documents and settings\All Users\Application Data\TEMP
2008-12-05 13:25 . 2008-12-06 03:02 d——– C:\Fraps
2008-12-04 17:35 . 2008-12-04 17:35 d——– c:\documents and settings\All Users\Application Data\CyberLink
2008-12-01 17:36 . 2008-12-01 17:36 d——– c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-11-28 00:53 . 2008-11-28 00:53 d——– c:\documents and settings\djohnson\Application Data\Palo Alto Software
2008-11-28 00:51 . 2008-11-28 00:51 d——– c:\program files\Common Files\Palo Alto Software
2008-11-28 00:51 . 2008-11-28 00:51 d——– c:\program files\Common Files\Intuit
2008-11-28 00:51 . 2008-11-28 00:51 d——– c:\documents and settings\All Users\Application Data\Palo Alto Software
2008-11-28 00:48 . 2008-11-28 00:48 d——– c:\documents and settings\All Users\Application Data\PAS
2008-11-25 16:51 . 2008-12-06 17:15 d——– c:\windows\Lhsp
2008-11-24 11:39 . 2008-11-24 11:39 d——– c:\program files\Ventrilo
2008-11-24 11:39 . 2008-11-24 11:39 262 –a—— c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2008-11-12 22:23 . 2008-09-04 11:15 1,106,944 ——— c:\windows\system32\dllcache\msxml3.dll
2008-11-12 22:23 . 2008-10-24 05:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 09:03 . 2008-11-12 09:03 244 –ah—– C:\sqmnoopt08.sqm
2008-11-12 09:03 . 2008-11-12 09:03 232 –ah—– C:\sqmdata08.sqm
2008-11-09 17:40 . 2008-11-09 17:40 d——– c:\program files\DVD Shrink
2008-11-09 17:40 . 2008-11-09 17:40 d——– c:\documents and settings\All Users\Application Data\DVD Shrink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-30 23:01 ——— d—–w c:\program files\Symantec AntiVirus
2008-12-30 21:25 ——— d—–w c:\program files\Steam
2008-12-29 16:05 ——— d—–w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-28 21:11 ——— d—–w c:\program files\Kaos Inc
2008-12-28 21:08 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-28 21:08 ——— d—–w c:\program files\Dell
2008-12-28 21:07 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2008-12-28 21:05 ——— d—–w c:\program files\Norton Ghost
2008-12-28 21:05 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-12-28 06:28 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-28 02:29 ——— d—–w c:\documents and settings\djohnson\Application Data\uTorrent
2008-12-27 04:48 ——— d—–w c:\documents and settings\djohnson\Application Data\U3
2008-12-24 18:33 ——— d—–w c:\program files\Common Files\Adobe
2008-12-23 21:57 ——— d—–w c:\documents and settings\All Users\Application Data\iolo
2008-12-21 06:04 ——— d—–w c:\documents and settings\djohnson\Application Data\.purple
2008-12-20 02:37 ——— d—–w c:\program files\Matrix60
2008-12-19 05:24 ——— d—–w c:\documents and settings\djohnson\Application Data\Skype
2008-12-19 02:09 ——— d—–w c:\documents and settings\djohnson\Application Data\skypePM
2008-12-16 20:00 ——— d—–w c:\documents and settings\djohnson\Application Data\iolo
2008-12-16 19:08 ——— d—–w c:\documents and settings\Doug Johnson.D6D4W4H1\Application Data\uTorrent
2008-12-05 22:09 960 —-a-w c:\windows\system32\drivers\sthdae.log
2008-11-29 21:02 136,720 —-a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-24 17:40 ——— d—–w c:\documents and settings\djohnson\Application Data\Ventrilo
2008-11-24 17:39 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-11-11 23:20 ——— d—–w c:\program files\Microsoft Silverlight
2008-11-06 15:53 ——— d—–w c:\documents and settings\All Users\Application Data\FLEXnet
2008-11-03 02:10 ——— d—–w c:\documents and settings\djohnson\Application Data\gtk-2.0
2008-11-01 01:47 ——— d—–w c:\documents and settings\All Users\Application Data\Adobe Systems
2008-11-01 01:43 ——— d—–w c:\program files\Common Files\Adobe Systems Shared
2008-10-31 19:09 ——— d—–w c:\documents and settings\All Users\Application Data\Fallout3
2008-10-31 18:41 ——— d—–w c:\program files\MSBuild
2008-10-31 18:39 ——— d—–w c:\program files\Reference Assemblies
2008-10-31 02:13 ——— d—–w c:\documents and settings\djohnson\Application Data\mIRC
2008-10-23 17:41 22,328 —-a-w c:\documents and settings\djohnson\Application Data\PnkBstrK.sys
2008-09-07 18:51 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090720080908\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\Kaos Inc\QK\RocketDock\RocketDock.exe" [2007-09-02 495616]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-26 1024000]
"\\TIMBROWN\EPSON Stylus Photo R220 Series shared"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE" [2005-03-09 98304]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-06-02 2220032]
"\\PENNY\EPSON Stylus Photo R300 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" [2003-06-04 99840]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-12-05 405504]
"\\GORDONSLIVER\EPSON Stylus Photo R220 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE" [2005-03-09 98304]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-06 8466432]
"\\RICH\EPSON Stylus Photo R300 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" [2003-06-04 99840]
"nwiz"="nwiz.exe" [2007-08-06 c:\windows\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2007-08-06 c:\windows\system32\nvmctray.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Icatch(VI) SnapDetect.lnk]
backup=c:\windows\pss\Icatch(VI) SnapDetect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Palo Alto Software Update Manager 9.0.lnk]
backup=c:\windows\pss\Palo Alto Software Update Manager 9.0.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Surado CRM Always-In-Sync .lnk]
backup=c:\windows\pss\Surado CRM Always-In-Sync .lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^djohnson^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\djohnson\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iolo Personal Firewall
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecoverFromReboot
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-06-12 01:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
–a—— 2002-09-10 20:26 368706 c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-04-13 18:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
–a—— 2008-08-13 23:08 29744 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a—— 2006-10-26 23:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 12:39 1289000 c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
–a—— 2007-12-13 18:10 1688872 c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-01-19 11:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
–a–c— 2007-12-03 13:21 2213160 c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a–c— 2007-03-01 13:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
——— 2008-02-26 09:57 128296 c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecureUpgrade]
–a–c— 2007-09-14 09:53 218424 c:\program files\Wave Systems Corp\SecureUpgrade.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra—— 2008-09-29 16:57 21755688 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WavXMgr]
–a–c— 2007-09-10 08:55 92160 c:\program files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
–a–c— 2007-08-06 15:27 67584 c:\windows\system32\nvhotkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2007-08-06 15:28 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Kaos Inc\\Internet Utilities\\Utorrent\\uTorrent.exe"=
"c:\\Program Files\\Kaos Inc\\Games\\NWN2\\nwn2main.exe"=
"c:\\Program Files\\Kaos Inc\\Games\\NWN2\\nwn2main_amdxp.exe"=
"c:\\Program Files\\Kaos Inc\\Games\\NWN2\\nwupdate.exe"=
"c:\\Program Files\\Kaos Inc\\Games\\NWN2\\nwn2server.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Kaos Inc\\Internet Utilities\\CuteFTP 8 Professional\\ftpte.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Kaos Inc\\Games\\Bionic Commando Rearmed\\bcr.exe"=
"c:\\Program Files\\Kaos Inc\\Games\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"c:\\Program Files\\Kaos Inc\\Games\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 LinksysUpdater;Linksys Updater;"c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "c:\program files\Linksys\Linksys Updater\conf\wrapper.conf" [2008-01-15 204800]
R2 MSSQL$SURADOCRMOFFLINE;MSSQL$SURADOCRMOFFLINE;c:\program files\Microsoft SQL Server\MSSQL$SURADOCRMOFFLINE\Binn\sqlservr.exe -sSURADOCRMOFFLINE []
R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe /Processid:{8277F0D9-812F-470B-BFC1-A6D96FBA774A} [2004-08-11 5120]
R2 Wave UCSPlus;Wave UCSPlus;c:\windows\system32\dllhost.exe /Processid:{BDFEFE06-0F3F-44F4-984D-3BF2A1CA8D75} [2004-08-11 5120]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-12 99376]
S2 ASTSRV;ASTSRV;c:\windows\System32\AstSrv.exe [2008-08-27 57344]
S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-09-26 33752]
S3 SavRoam;SAVRoam;"c:\program files\Symantec AntiVirus\SavRoam.exe" [2006-06-15 115952]
S3 SQLAgent$SURADOCRMOFFLINE;SQLAgent$SURADOCRMOFFLINE;c:\program files\Microsoft SQL Server\MSSQL$SURADOCRMOFFLINE\Binn\sqlagent.EXE -i SURADOCRMOFFLINE []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\Autorun.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2008-12-30 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe []

2008-12-25 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe []

2008-12-30 c:\windows\Tasks\zdgsywya.job
- c:\windows\system32\rundll32.exe [2008-04-13 18:12]
.
- - - - ORPHANS REMOVED - - - -

BHO-{a58ef46e-0289-4eca-b0c0-6767866c58dd} - c:\windows\system32\tijoravi.dll
BHO-{b5100ed8-eeec-43cc-8a26-bbfb37eca0e9} - c:\windows\system32\mhwpkx.dll
BHO-{BFAA2F19-4E4E-4094-8309-106D51452EDC} - c:\windows\system32\hgGyyvUN.dll
Notify-gemsafe - (no file)
MSConfigStartUp-Acrobat Assistant 8 - c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
MSConfigStartUp-c497680c - c:\windows\system32\ujdhettl.dll
MSConfigStartUp-Norton Ghost 14 - c:\program files\Norton Ghost\Agent\VProTray.exe
MSConfigStartUp-Run - c:\documents and settings\djohnson\Application Data\Adobe\Manager.exe


.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
IE: Append to existing PDF - c:\program files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Kaos Inc\Multimedia Utilities\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\djohnson\Application Data\Mozilla\Firefox\Profiles\j1ylc7cx.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - component: c:\documents and settings\djohnson\Application Data\Mozilla\Firefox\Profiles\j1ylc7cx.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\nppdf32.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\npptkver.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\npqtplugin.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
FF - plugin: c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npptkver.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-30 17:03:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(848)
c:\program files\Bonjour\mdnsNSP.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Kaos Inc\System Utilities\Ad-Aware\aawservice.exe
c:\windows\system32\scardsvr.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\Crypserv.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
c:\program files\Microsoft SQL Server\MSSQL$SURADOCRMOFFLINE\Binn\sqlservr.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\java.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\dllhost.exe
c:\program files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\msdtc.exe
.
**************************************************************************
.
Completion time: 2008-12-30 17:08:23 - machine was rebooted [djohnson]
ComboFix-quarantined-files.txt 2008-12-30 23:08:20

Pre-Run: 43,768,864,768 bytes free
Post-Run: 43,975,069,696 bytes free

353 — E O F — 2008-12-15 15:36:18