[Resolved] vundo virus

Hi all.

I have this virus I'm pretty sure is that vundo thing thats going around. I have the common problems of avg not updating, sites being blocked, weird shortcuts on my desktop etc.

I'm posting hjt log. I really hope you can help

thanks
just sara


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:34:45 PM, on 12/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\RAMASST.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgwb.dat
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: {f882593f-bec9-2059-c9c4-44764f6b1a28} - {82a1b6f4-6744-4c9c-9502-9cebf395288f} - C:\WINDOWS\system32\qxoqam.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Toshiba Hotkey Utility] "c:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang en
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Yahoo;! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps; - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS; - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F999E094-05CA-4E6B-8F50-E9BE54BD3D7E}: NameServer = 65.24.7.3,65.24.7.6
O18 - Filter hijack: text/html - {36e54f57-f691-4ed9-8c5d-eff9447e46e0} - C:\WINDOWS\system32\msiebbar.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL qxoqam.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsubleepa Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

–
End of file - 9843 bytes




SDFix: Version 1.240
Run by [removed] on Mon 12/29/2008 at 02:39 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\itez._sy - Deleted
C:\WINDOWS\system32\afykytu._sy - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-29 14:52:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

disk error: C:\WINDOWS\system32\config\system, 0
scanning hidden registry entries …

disk error: C:\WINDOWS\system32\config\software, 0
disk error: C:\Documents and Settings\bryant caldwell\ntuser.dat, 0
scanning hidden files …

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"="C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrade Engine"
"C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"="C:\\TOSHIBA\\IVP\\ISM\\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Application Loader"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe:*:Enabled:AOLTsMon"
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe:*:Enabled:AOLTopSpeed"
"C:\\Program Files\\Common Files\\AOL\\1161249244\\EE\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1161249244\\EE\\AOLServiceHost.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"="C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"="C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe:*:Enabled:AOL"
"C:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe"="C:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Engine"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\BearFlix\\bearflix.exe"="C:\\Program Files\\BearFlix\\bearflix.exe:*:Enabled:BearFlix"
"C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Enabled:Morpheus"
"C:\\Program Files\\Lionhead Studios Ltd\\Black & White\\runblack.exe"="C:\\Program Files\\Lionhead Studios Ltd\\Black & White\\runblack.exe:*:Enabled:lh"
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD:*:Enabled:Age of Empires II"
"C:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe"="C:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe:*:Enabled:Age of Mythology - The Titans Expansion"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe:*:Disabled:Java™ Platform SE binary"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 10 Apr 2006 54,872 A..H. — "C:\Program Files\America Online 9.0\AOLphx.exe"
Mon 10 Apr 2006 31,832 A..H. — "C:\Program Files\America Online 9.0\rbm.exe"
Wed 22 Oct 2008 949,072 A.SHR — "C:\Program Files\File Scanner Library (Spybot - Search & Destroy)\advcheck.dll"
Wed 22 Oct 2008 962,896 A.SHR — "C:\Program Files\Misc. Support Library (Spybot - Search & Destroy)\Tools.dll"
Wed 28 Jun 2006 4,900,464 A..H. — "C:\Program Files\Picasa2\setup.exe"
Mon 15 Sep 2008 1,562,960 A.SHR — "C:\Program Files\SDHelper (Spybot - Search & Destroy)\SDHelper.dll"
Tue 16 Sep 2008 1,833,296 A.SHR — "C:\Program Files\TeaTimer (Spybot - Search & Destroy)\TeaTimer.exe"
Wed 16 Apr 2008 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!

Thanxs for the reply

this is what i have. i tried to disable my antivirus but the computer rebooted and they were back on again. I hope it did not effect the log

just sara



ComboFix 09-01-05.02 - bryant caldwell 2009-01-05 17:10:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.446.129 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\bryant caldwell\Application Data\inst.exe
c:\documents and settings\bryant caldwell\Cookies\waxub.dat
c:\documents and settings\bryant caldwell\Local Settings\Temporary Internet Files\avipyryhi.inf
c:\documents and settings\bryant caldwell\Local Settings\Temporary Internet Files\esaxynesa.inf
c:\documents and settings\bryant caldwell\Local Settings\Temporary Internet Files\evedozexe.inf
c:\documents and settings\bryant caldwell\Local Settings\Temporary Internet Files\pajev.reg
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\drivers\senekadfnmtlrn.sys
c:\windows\system32\lJaXPHXq.dll
c:\windows\system32\obxvigqk.dll
c:\windows\system32\qxoqam.dll
c:\windows\system32\seneka.dat
c:\windows\system32\senekadf.dat
c:\windows\system32\senekakltpynbe.dll
c:\windows\system32\senekalog.dat
c:\windows\system32\senekatmcuomhr.dll
c:\windows\system32\senekaygwyqqyd.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_SENEKA


((((((((((((((((((((((((( Files Created from 2008-12-06 to 2009-01-06 )))))))))))))))))))))))))))))))
.

2008-12-29 16:09 . 2009-01-04 16:11 d——– c:\windows\system32\drivers\Avg
2008-12-29 16:09 . 2008-12-29 16:09 d——– c:\program files\AVG
2008-12-29 16:09 . 2008-12-29 16:09 d——– c:\documents and settings\All Users\Application Data\avg8
2008-12-29 16:09 . 2008-12-29 16:09 97,928 –a—— c:\windows\system32\drivers\avgldx86.sys
2008-12-29 16:09 . 2008-12-29 16:09 76,040 –a—— c:\windows\system32\drivers\avgtdix.sys
2008-12-29 16:09 . 2008-12-29 16:09 10,520 –a—— c:\windows\system32\avgrsstx.dll
2008-12-29 14:30 . 2008-12-29 14:30 d——– c:\windows\ERUNT
2008-12-29 13:43 . 2008-12-30 12:45 d——– c:\program files\SUPERAntiSpyware
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\program files\Common Files\Wise Installation Wizard
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\documents and settings\bryant caldwell\Application Data\SUPERAntiSpyware.com
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-28 20:42 . 2008-12-28 20:42 d——– c:\windows\system32\config\systemprofile\Application Data\s_4610_fHx8fHx8fDEyNDMxNjIyMzh8_
2008-12-28 20:42 . 2008-12-28 20:43 d——– c:\windows\system32\config\systemprofile\Application Data\Rapid Antivirus
2008-12-21 17:56 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2008-12-21 17:56 . 2008-10-16 14:06 208,744 –a—— c:\windows\system32\muweb.dll
2008-12-21 17:56 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2008-12-20 20:55 . 2008-12-20 20:55 d——– c:\program files\Microsoft Silverlight
2008-12-11 22:16 . 2008-12-11 22:17 1,393 –a—— c:\windows\imsins.BAK

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-29 05:03 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2008-12-28 02:36 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Template
2008-12-22 05:19 ——— d—–w c:\program files\Microsoft Works
2008-12-04 03:52 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-04 03:52 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2008-11-27 01:09 0 —-a-w c:\documents and settings\bryant caldwell\Application Data\wklnhst.dat
2008-11-17 05:08 ——— d—–w c:\program files\Dvd-cloner
2008-11-14 03:34 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Malwarebytes
2008-11-14 03:33 ——— d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-14 00:36 ——— d—–w c:\program files\Webroot
2008-11-14 00:36 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Webroot
2008-11-14 00:03 ——— d—–w c:\program files\Trend Micro
2008-11-13 03:19 ——— d—–w c:\program files\Windows Live Safety Center
2008-11-13 02:30 ——— d—–w c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\SDHelper (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-11-13 02:23 19,024 —-a-w c:\documents and settings\bryant caldwell\Application Data\fiqodid.pif
2008-11-13 02:23 18,405 —-a-w c:\windows\icalys.reg
2008-11-13 02:23 18,402 —-a-w c:\program files\Common Files\sypury.sys
2008-11-13 02:23 16,282 —-a-w c:\windows\movofowi.dll
2008-11-13 02:23 16,059 —-a-w c:\windows\awojavo.bin
2008-11-13 02:23 14,005 —-a-w c:\documents and settings\All Users\Application Data\sewypyku.scr
2008-11-13 02:23 13,065 —-a-w c:\documents and settings\bryant caldwell\Application Data\yqoxydixo.dll
2008-11-13 02:23 12,996 —-a-w c:\windows\yrevytisyb.bin
2008-11-13 02:23 12,241 —-a-w c:\documents and settings\bryant caldwell\Application Data\xilazamuq.bin
2008-11-13 02:23 12,234 —-a-w c:\windows\utuvopexow.reg
2008-11-13 02:23 10,703 —-a-w c:\documents and settings\bryant caldwell\Application Data\pyja.com
2008-11-13 02:23 10,530 —-a-w c:\windows\ducy.vbs
2007-06-17 23:10 47,360 —-a-w c:\documents and settings\bryant caldwell\Application Data\pcouffin.sys
2007-06-17 21:41 81,920 —-a-w c:\documents and settings\bryant caldwell\Application Data\ezpinst.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-29 65536]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-09 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2006-11-30 4662776]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-30 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-11 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-07 761946]
"Toshiba Hotkey Utility"="c:\program files\Toshiba\Windows Utilities\Hotkey.exe" [2006-08-01 1773568]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-12-05 1077322]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 151552]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-12-16 188416]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-19 98304]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"Media Codec Update Service"="c:\program files\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeper.exe" [2005-08-03 2966528]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-29 1261336]
"NDSTray.exe"="NDSTray.exe" [BU]
"TPSMain"="TPSMain.exe" [2005-05-31 c:\windows\system32\TPSMain.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-06 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2006-03-18 c:\windows\agrsmmsg.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-10-18 155648]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-30 12:45 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1161249244\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=
"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7250:TCP"= 7250:TCP:BitComet 7250 TCP
"7250:UDP"= 7250:UDP:BitComet 7250 UDP

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-29 97928]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-04 55024]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-29 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-29 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-29 76040]
R4 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [2006-06-28 98816]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\_aomg.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2d76773-33c7-11db-bd96-806d6172696f}]
\shell\play\command - "c:\program files\InterVideo\WinDVD\WinDVD.exe" %1
.
Contents of the 'Scheduled Tasks' folder

2009-01-06 c:\windows\Tasks\fziwzyul.job
- c:\windows\system32\rundll32.exe [2004-08-09 13:00]
.
- - - - ORPHANS REMOVED - - - -

BHO-{82a1b6f4-6744-4c9c-9502-9cebf395288f} - c:\windows\system32\qxoqam.dll
HKU-Default-Run-msiexec.exe - msiconf.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
TCP: {F999E094-05CA-4E6B-8F50-E9BE54BD3D7E} = 65.24.7.3,65.24.7.6
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-05 17:19:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\windows\TEMP\mc24.tmp"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(640)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
c:\program files\Webroot\Spy Sweeper\ssi.dll

- - - - - - - > 'lsass.exe'(696)
c:\program files\Webroot\Spy Sweeper\ssi.dll

- - - - - - - > 'explorer.exe'(5060)
c:\program files\Webroot\Spy Sweeper\ssi.dll

- - - - - - - > 'csrss.exe'(612)
c:\program files\Webroot\Spy Sweeper\ssi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\acs.exe
c:\program files\Common Files\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\DVDRAMSV.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Webroot\Spy Sweeper\WRSSSDK.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\windows\system32\TODDSrv.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\TPSBattM.exe
c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2009-01-05 17:28:54 - machine was rebooted [bryant caldwell]
ComboFix-quarantined-files.txt 2009-01-06 01:28:40

Pre-Run: 36,257,988,608 bytes free
Post-Run: 36,184,670,208 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

262 — E O F — 2008-12-24 08:41:20

hi there,


I got to the final part where i'm sending a file online. At that point it seems to freeze. I press send and nothings happening.

thanks sooo much for your help


just sara

—————————————————–

ComboFix 09-01-05.05 - bryant caldwell 2009-01-06 16:29:39.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.446.132 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\bryant caldwell\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\sewypyku.scr
c:\documents and settings\bryant caldwell\Application Data\fiqodid.pif
c:\documents and settings\bryant caldwell\Application Data\pyja.com
c:\documents and settings\bryant caldwell\Application Data\xilazamuq.bin
c:\documents and settings\bryant caldwell\Application Data\yqoxydixo.dll
c:\program files\Common Files\sypury.sys
c:\windows\awojavo.bin
c:\windows\ducy.vbs
c:\windows\icalys.reg
c:\windows\movofowi.dll
c:\windows\system32\config\systemprofile\Application Data\Rapid Antivirus
c:\windows\system32\config\systemprofile\Application Data\Rapid Antivirus\Rapid Antivirus.ini
c:\windows\system32\config\systemprofile\Application Data\s_4610_fHx8fHx8fDEyNDMxNjIyMzh8_
c:\windows\system32\config\systemprofile\Application Data\s_4610_fHx8fHx8fDEyNDMxNjIyMzh8_\spl.ini
c:\windows\Tasks\fziwzyul.job
c:\windows\utuvopexow.reg
c:\windows\yrevytisyb.bin

.
((((((((((((((((((((((((( Files Created from 2008-12-07 to 2009-01-07 )))))))))))))))))))))))))))))))
.

2008-12-29 16:09 . 2009-01-04 16:11 d——– c:\windows\system32\drivers\Avg
2008-12-29 16:09 . 2008-12-29 16:09 d——– c:\program files\AVG
2008-12-29 16:09 . 2009-01-06 16:26 d——– c:\documents and settings\All Users\Application Data\avg8
2008-12-29 16:09 . 2008-12-29 16:09 97,928 –a—— c:\windows\system32\drivers\avgldx86.sys
2008-12-29 16:09 . 2008-12-29 16:09 76,040 –a—— c:\windows\system32\drivers\avgtdix.sys
2008-12-29 16:09 . 2008-12-29 16:09 10,520 –a—— c:\windows\system32\avgrsstx.dll
2008-12-29 14:30 . 2008-12-29 14:30 d——– c:\windows\ERUNT
2008-12-29 13:43 . 2008-12-30 12:45 d——– c:\program files\SUPERAntiSpyware
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\program files\Common Files\Wise Installation Wizard
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\documents and settings\bryant caldwell\Application Data\SUPERAntiSpyware.com
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-21 17:56 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2008-12-21 17:56 . 2008-10-16 14:06 208,744 –a—— c:\windows\system32\muweb.dll
2008-12-21 17:56 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2008-12-20 20:55 . 2008-12-20 20:55 d——– c:\program files\Microsoft Silverlight
2008-12-11 22:16 . 2008-12-11 22:17 1,393 –a—— c:\windows\imsins.BAK

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-29 05:03 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2008-12-28 02:36 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Template
2008-12-22 05:19 ——— d—–w c:\program files\Microsoft Works
2008-12-04 03:52 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-04 03:52 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2008-11-27 01:09 0 —-a-w c:\documents and settings\bryant caldwell\Application Data\wklnhst.dat
2008-11-17 05:08 ——— d—–w c:\program files\Dvd-cloner
2008-11-14 03:34 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Malwarebytes
2008-11-14 03:33 ——— d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-14 00:36 ——— d—–w c:\program files\Webroot
2008-11-14 00:36 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Webroot
2008-11-14 00:03 ——— d—–w c:\program files\Trend Micro
2008-11-13 03:19 ——— d—–w c:\program files\Windows Live Safety Center
2008-11-13 02:30 ——— d—–w c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\SDHelper (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-11-13 02:23 18,464 —-a-w c:\windows\system32\gohalesom.reg
2008-11-13 02:23 16,481 —-a-w c:\windows\system32\nelunilenu.dll
2008-11-13 02:23 14,069 —-a-w c:\windows\system32\qyzupa.pif
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 10:20 667,648 —-a-w c:\windows\system32\wininet.dll
2007-06-17 23:10 47,360 —-a-w c:\documents and settings\bryant caldwell\Application Data\pcouffin.sys
2007-06-17 21:41 81,920 —-a-w c:\documents and settings\bryant caldwell\Application Data\ezpinst.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-29 65536]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-09 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2006-11-30 4662776]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-30 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-11 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-07 761946]
"Toshiba Hotkey Utility"="c:\program files\Toshiba\Windows Utilities\Hotkey.exe" [2006-08-01 1773568]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-12-05 1077322]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 151552]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-12-16 188416]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-19 98304]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"Media Codec Update Service"="c:\program files\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeper.exe" [2005-08-03 2966528]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-29 1261336]
"NDSTray.exe"="NDSTray.exe" [BU]
"TPSMain"="TPSMain.exe" [2005-05-31 c:\windows\system32\TPSMain.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-06 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2006-03-18 c:\windows\agrsmmsg.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-10-18 155648]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-30 12:45 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1161249244\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=
"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7250:TCP"= 7250:TCP:BitComet 7250 TCP
"7250:UDP"= 7250:UDP:BitComet 7250 UDP

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-29 97928]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-04 55024]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-29 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-29 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-29 76040]
R4 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [2006-06-28 98816]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
TCP: {F999E094-05CA-4E6B-8F50-E9BE54BD3D7E} = 65.24.7.3,65.24.7.6
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-06 16:32:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\windows\TEMP\mc25.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\DJZERO]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\metajuan]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000
"LBL"=hex:9e,a9,73,a6,cd,6e,c9,01
"MN"=hex:01,00,00,00

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\meta_mg]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\profiling4]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\superjuan]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\TrackDJuan]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(636)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
c:\program files\Webroot\Spy Sweeper\ssi.dll

- - - - - - - > 'lsass.exe'(692)
c:\program files\Webroot\Spy Sweeper\ssi.dll

- - - - - - - > 'csrss.exe'(608)
c:\program files\Webroot\Spy Sweeper\ssi.dll
.
Completion time: 2009-01-06 16:34:09
ComboFix-quarantined-files.txt 2009-01-07 00:34:05
ComboFix2.txt 2009-01-06 01:29:02

Pre-Run: 36,211,433,472 bytes free
Post-Run: 36,211,056,640 bytes free

243 — E O F — 2008-12-24 08:41:20

Hi Rorschach112


And thanxs again for your time and help


just sara


—————————————————-

ComboFix 09-01-07.02 - bryant caldwell 2009-01-07 18:39:41.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.446.84 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\bryant caldwell\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\gohalesom.reg
c:\windows\system32\nelunilenu.dll
c:\windows\system32\qyzupa.pif
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\gohalesom.reg
c:\windows\system32\nelunilenu.dll
c:\windows\system32\qyzupa.pif

.
((((((((((((((((((((((((( Files Created from 2008-12-08 to 2009-01-08 )))))))))))))))))))))))))))))))
.

2008-12-29 16:09 . 2009-01-07 13:39 d——– c:\windows\system32\drivers\Avg
2008-12-29 16:09 . 2008-12-29 16:09 d——– c:\program files\AVG
2008-12-29 16:09 . 2009-01-07 13:42 d——– c:\documents and settings\All Users\Application Data\avg8
2008-12-29 16:09 . 2008-12-29 16:09 97,928 –a—— c:\windows\system32\drivers\avgldx86.sys
2008-12-29 16:09 . 2008-12-29 16:09 76,040 –a—— c:\windows\system32\drivers\avgtdix.sys
2008-12-29 16:09 . 2008-12-29 16:09 10,520 –a—— c:\windows\system32\avgrsstx.dll
2008-12-29 14:30 . 2008-12-29 14:30 d——– c:\windows\ERUNT
2008-12-29 13:43 . 2008-12-30 12:45 d——– c:\program files\SUPERAntiSpyware
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\program files\Common Files\Wise Installation Wizard
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\documents and settings\bryant caldwell\Application Data\SUPERAntiSpyware.com
2008-12-29 13:43 . 2008-12-29 13:43 d——– c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-21 17:56 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2008-12-21 17:56 . 2008-10-16 14:06 208,744 –a—— c:\windows\system32\muweb.dll
2008-12-21 17:56 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2008-12-20 20:55 . 2008-12-20 20:55 d——– c:\program files\Microsoft Silverlight
2008-12-11 22:16 . 2008-12-11 22:17 1,393 –a—— c:\windows\imsins.BAK

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-29 05:03 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2008-12-28 02:36 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Template
2008-12-22 05:19 ——— d—–w c:\program files\Microsoft Works
2008-12-04 03:52 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-04 03:52 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2008-11-27 01:09 0 —-a-w c:\documents and settings\bryant caldwell\Application Data\wklnhst.dat
2008-11-17 05:08 ——— d—–w c:\program files\Dvd-cloner
2008-11-14 03:34 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Malwarebytes
2008-11-14 03:33 ——— d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-14 00:36 ——— d—–w c:\program files\Webroot
2008-11-14 00:36 ——— d—–w c:\documents and settings\bryant caldwell\Application Data\Webroot
2008-11-14 00:03 ——— d—–w c:\program files\Trend Micro
2008-11-13 03:19 ——— d—–w c:\program files\Windows Live Safety Center
2008-11-13 02:30 ——— d—–w c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\SDHelper (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-13 02:29 ——— d—–w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 10:20 667,648 —-a-w c:\windows\system32\wininet.dll
2007-06-17 23:10 47,360 —-a-w c:\documents and settings\bryant caldwell\Application Data\pcouffin.sys
2007-06-17 21:41 81,920 —-a-w c:\documents and settings\bryant caldwell\Application Data\ezpinst.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-29 65536]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-09 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2006-11-30 4662776]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-30 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-11 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-07 761946]
"Toshiba Hotkey Utility"="c:\program files\Toshiba\Windows Utilities\Hotkey.exe" [2006-08-01 1773568]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-12-05 1077322]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 151552]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-12-16 188416]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-19 98304]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"Media Codec Update Service"="c:\program files\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeper.exe" [2005-08-03 2966528]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-29 1261336]
"NDSTray.exe"="NDSTray.exe" [BU]
"TPSMain"="TPSMain.exe" [2005-05-31 c:\windows\system32\TPSMain.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-06 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2006-03-18 c:\windows\agrsmmsg.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-10-18 155648]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-30 12:45 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1161249244\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=
"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7250:TCP"= 7250:TCP:BitComet 7250 TCP
"7250:UDP"= 7250:UDP:BitComet 7250 UDP

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-29 97928]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-04 55024]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-29 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-29 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-29 76040]
R4 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [2006-06-28 98816]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
TCP: {F999E094-05CA-4E6B-8F50-E9BE54BD3D7E} = 65.24.7.3,65.24.7.6
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-07 18:42:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\windows\TEMP\mc27.tmp"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(636)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-01-07 18:43:52
ComboFix-quarantined-files.txt 2009-01-08 02:43:39
ComboFix2.txt 2009-01-07 00:34:12
ComboFix3.txt 2009-01-06 01:29:02

Pre-Run: 36,212,756,480 bytes free
Post-Run: 36,202,807,296 bytes free

191 — E O F — 2008-12-24 08:41:20

The new logs,

Thank you

just sara


========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\bryant caldwell\Incomplete moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\BRYANT~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\CS000D69D0-1FD1-45C3-8377-205872528499.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS00949825-CD73-4FE1-923B-E5CF0EBEEA8D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS018C45B7-28DF-4ED4-A648-1EFE78D3B4F2.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS037E9EDB-8590-40E8-B5D6-C4798C39354B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS08E43DB1-37E5-4C62-A594-A01D04490EA7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS0CDAA034-88E9-48DC-B222-F279CDEACACE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS14E3FF6E-2904-4C79-A75D-A19DA41C659E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS1765A0FF-EC65-4420-84AD-36F7D249A564.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS1B46892A-9AE6-4D14-A95F-0015D6339CB6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS21CDBF11-F5B0-4103-B576-BE93664A6864.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS22DA5D65-7D30-491D-9133-205A009AF012.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS23F5026A-C333-4287-A247-F1262EE5DA18.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS24844177-0C87-458F-BAB9-6C7F74A79C37.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS29299929-E935-4102-BD5B-E149CC56EE0D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS2CCC2CDF-119F-433E-85F4-CE6FC4171B76.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS2FD92240-A6CD-4EC0-9F8D-7E7BEAE2041A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS31799CE2-7EE4-4B42-8E7A-97D22197448C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS3B164A93-2B3F-4246-88E6-C82487CC012E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS3F66AD23-33EC-4730-99A2-038FB5411130.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS4085C985-C619-485E-A6A6-000500066C41.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS40C5027C-1D20-471B-B144-AFBD36509659.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS43E1BAB7-5A88-485C-BE70-FCDF82798D47.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS45FFB664-B70E-46AC-8746-ECD7C8F45357.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS466069AB-38DE-42A8-93A0-A7CB2F0394EE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS47188672-B8C5-4910-BA6B-F2251379CFC3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS4731A0AB-1C88-4E3F-9C85-30E78BD53DF6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS497CE7E1-D681-49DE-8267-11ED26762B60.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS4F8F4243-161A-4612-A654-F17C640EA1F3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS519D2ADB-27E6-433F-AF6E-FDBA48C99C71.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS52B260C9-80EB-46B1-84DC-A05CBEBC100B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS55356E7B-DCB7-4C65-876A-55703807AE0E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS55D2E70C-0CBF-4383-BD25-0AB75D20086A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS564F7548-BD08-4557-AD7E-B7B8176239A4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS56C88788-B7D0-4F82-A0B3-DDF10FE2FF65.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS579687A5-D449-42A0-90F4-E81B6E03296B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS58BE426F-B2C9-4B72-9518-9D31735FBF38.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS59F332B5-CA51-4895-916D-4F1AD93D9639.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS5E15CDCF-4DC9-4C8D-B049-F4A23AC5D104.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS5E6959AD-9FAE-4A60-81BB-61D0A54BE4A3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS61D2CE5A-3BBF-4CB2-B6F8-D9CE27C2B3D9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS626E8799-F748-4D83-A282-F52DB427D0FC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS634D3A6F-69A0-4015-9432-3DA9215D576C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS647A602B-7F0A-48E4-9BA5-2647E8ABA29D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS65E2D01B-07BA-42AB-B981-E55F28CB78C6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS683BC3D4-F61E-4885-BDEB-7EFA531DE5CF.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS6B770885-6F7D-428D-BD2D-5DF8A2EFF1A6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS6C71367F-AB6A-4499-849B-B375EB526DD1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS6C79F76F-39F8-40E1-B899-2A6898CB643C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS723EC5CD-1F6B-496E-9A6F-2F0DA5BF0A80.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS789F8E57-EB5E-41A3-8707-2D7CC439F524.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS7960198D-4323-43AE-B115-6766C23EE955.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS817D16AD-E655-470A-931B-DBBA8C0FEC67.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS821EB616-2EC1-4C91-903C-CB45A58FD603.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS883F7925-8E18-4EC6-8A09-A24F8CFC4F13.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS8CD253CC-9164-4E9F-AC8B-F286395B26AE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS8F2A1AED-39D3-403A-83CF-7CAEDD6A82E5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS90A65FAF-5233-4308-ABC7-5C003A38F815.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS97AF4133-5D8B-4499-9362-241CBA2B2184.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS9919DD9D-1451-473A-8A95-DC6C580988E8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS99FA070E-1B38-41F0-8C22-07EDCD004D28.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS9A17EFF4-1D01-4EFF-AC6E-1C09570846B2.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS9AA8078D-5A9E-4D53-8087-BC2E0F09F23B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CS9BD887C1-7323-430D-B082-A38D51369754.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA10E575D-5030-4495-9D6D-BDEC216CE136.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA5766963-BF82-41B3-A8B6-1D09C63B793C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA599F2C6-ED30-49B8-906B-6A383B10F8B7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA5DC8905-A69B-447C-9367-149CD3685642.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA6376775-4C4A-4BEA-9800-8FF9A25D2799.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA65458A1-E11A-4893-9F7C-C20258B025FB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA8091347-C209-4DD2-9E0E-54851E320894.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA8692C82-8676-44EE-81B5-C55FC02CB061.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA996E8CF-C781-419E-ADC9-1E5518EB1F9E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSA99D9B53-64E0-44B5-9FF0-A194F4086B69.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSAA4798FD-CC13-45EA-A95C-D8FC09ECE1FB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSAC43779C-A087-492E-B419-DEBC585C5E22.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSAD3978FB-3C11-4F40-8853-A2A709B27944.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSAEC10C17-F89D-44B6-99F0-AD499C358923.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSB0404F9D-15C1-4349-A5D9-078FD66695A9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSB59B6AB8-8211-42A5-BB31-F85997F17120.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSB6666C54-5BFA-4FD9-ABD7-EAC0A6A6A6CA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSB7344605-5E92-475B-BFCB-5BF2313A71DD.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSB8F32C8B-B989-4B3F-BC77-BCAABA40B7E3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSBCBE2149-CF2D-4C45-AFD7-F15076C623AB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSBCC68E3B-A7AC-44F2-9C86-F79B041B498E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSC8811534-79D7-4420-B2C0-7384560144F2.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSC9C8472B-97CC-4997-8AC3-BBA2F850628C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSD415C8C0-A767-4BC5-AC9C-CF7B16E226D6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSD50E6305-CC90-4851-BD66-9F4165881CAC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSD62A29A9-BEBC-4026-AA43-7F54AAF79E27.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSD69F32B7-30DA-4511-AFFE-51FE06E7F578.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSD7E456FC-B522-4C1D-AA52-7023EFF8ED0B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSDB7E824E-0F4F-4F41-AEB4-BC07AC9DEFEC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSE01A4C4D-A128-45F0-BD98-DC7B38A50470.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSE086B009-8E44-4AA3-949E-094749730502.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSE2159A9A-E230-4018-A901-0007D51836DA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSEDA6F275-5548-4A6F-9945-EEF77FFDE627.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSF0489487-DF3D-4A79-A434-B2991BE256D6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSF07C98C6-50FD-41BC-9F94-F2DEA1BD7BCB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSF33B34C7-D6CB-44E8-A472-3C4DA4DD796B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSF399D3DC-4B86-42B4-8934-88EF0DF1ECAC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\CSF480D45C-2AD4-415D-861D-C40E0EB3D2AB.tmp scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01092009_174344

Files moved on Reboot…
C:\DOCUME~1\BRYANT~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\CS000D69D0-1FD1-45C3-8377-205872528499.tmp not found!
File C:\WINDOWS\temp\CS00949825-CD73-4FE1-923B-E5CF0EBEEA8D.tmp not found!
File C:\WINDOWS\temp\CS018C45B7-28DF-4ED4-A648-1EFE78D3B4F2.tmp not found!
File C:\WINDOWS\temp\CS037E9EDB-8590-40E8-B5D6-C4798C39354B.tmp not found!
File C:\WINDOWS\temp\CS08E43DB1-37E5-4C62-A594-A01D04490EA7.tmp not found!
File C:\WINDOWS\temp\CS0CDAA034-88E9-48DC-B222-F279CDEACACE.tmp not found!
File C:\WINDOWS\temp\CS14E3FF6E-2904-4C79-A75D-A19DA41C659E.tmp not found!
File C:\WINDOWS\temp\CS1765A0FF-EC65-4420-84AD-36F7D249A564.tmp not found!
File C:\WINDOWS\temp\CS1B46892A-9AE6-4D14-A95F-0015D6339CB6.tmp not found!
File C:\WINDOWS\temp\CS21CDBF11-F5B0-4103-B576-BE93664A6864.tmp not found!
File C:\WINDOWS\temp\CS22DA5D65-7D30-491D-9133-205A009AF012.tmp not found!
File C:\WINDOWS\temp\CS23F5026A-C333-4287-A247-F1262EE5DA18.tmp not found!
File C:\WINDOWS\temp\CS24844177-0C87-458F-BAB9-6C7F74A79C37.tmp not found!
File C:\WINDOWS\temp\CS29299929-E935-4102-BD5B-E149CC56EE0D.tmp not found!
File C:\WINDOWS\temp\CS2CCC2CDF-119F-433E-85F4-CE6FC4171B76.tmp not found!
File C:\WINDOWS\temp\CS2FD92240-A6CD-4EC0-9F8D-7E7BEAE2041A.tmp not found!
File C:\WINDOWS\temp\CS31799CE2-7EE4-4B42-8E7A-97D22197448C.tmp not found!
File C:\WINDOWS\temp\CS3B164A93-2B3F-4246-88E6-C82487CC012E.tmp not found!
File C:\WINDOWS\temp\CS3F66AD23-33EC-4730-99A2-038FB5411130.tmp not found!
File C:\WINDOWS\temp\CS4085C985-C619-485E-A6A6-000500066C41.tmp not found!
File C:\WINDOWS\temp\CS40C5027C-1D20-471B-B144-AFBD36509659.tmp not found!
File C:\WINDOWS\temp\CS43E1BAB7-5A88-485C-BE70-FCDF82798D47.tmp not found!
File C:\WINDOWS\temp\CS45FFB664-B70E-46AC-8746-ECD7C8F45357.tmp not found!
File C:\WINDOWS\temp\CS466069AB-38DE-42A8-93A0-A7CB2F0394EE.tmp not found!
File C:\WINDOWS\temp\CS47188672-B8C5-4910-BA6B-F2251379CFC3.tmp not found!
File C:\WINDOWS\temp\CS4731A0AB-1C88-4E3F-9C85-30E78BD53DF6.tmp not found!
File C:\WINDOWS\temp\CS497CE7E1-D681-49DE-8267-11ED26762B60.tmp not found!
File C:\WINDOWS\temp\CS4F8F4243-161A-4612-A654-F17C640EA1F3.tmp not found!
File C:\WINDOWS\temp\CS519D2ADB-27E6-433F-AF6E-FDBA48C99C71.tmp not found!
File C:\WINDOWS\temp\CS52B260C9-80EB-46B1-84DC-A05CBEBC100B.tmp not found!
File C:\WINDOWS\temp\CS55356E7B-DCB7-4C65-876A-55703807AE0E.tmp not found!
File C:\WINDOWS\temp\CS55D2E70C-0CBF-4383-BD25-0AB75D20086A.tmp not found!
File C:\WINDOWS\temp\CS564F7548-BD08-4557-AD7E-B7B8176239A4.tmp not found!
File C:\WINDOWS\temp\CS56C88788-B7D0-4F82-A0B3-DDF10FE2FF65.tmp not found!
File C:\WINDOWS\temp\CS579687A5-D449-42A0-90F4-E81B6E03296B.tmp not found!
File C:\WINDOWS\temp\CS58BE426F-B2C9-4B72-9518-9D31735FBF38.tmp not found!
File C:\WINDOWS\temp\CS59F332B5-CA51-4895-916D-4F1AD93D9639.tmp not found!
File C:\WINDOWS\temp\CS5E15CDCF-4DC9-4C8D-B049-F4A23AC5D104.tmp not found!
File C:\WINDOWS\temp\CS5E6959AD-9FAE-4A60-81BB-61D0A54BE4A3.tmp not found!
File C:\WINDOWS\temp\CS61D2CE5A-3BBF-4CB2-B6F8-D9CE27C2B3D9.tmp not found!
File C:\WINDOWS\temp\CS626E8799-F748-4D83-A282-F52DB427D0FC.tmp not found!
File C:\WINDOWS\temp\CS634D3A6F-69A0-4015-9432-3DA9215D576C.tmp not found!
File C:\WINDOWS\temp\CS647A602B-7F0A-48E4-9BA5-2647E8ABA29D.tmp not found!
File C:\WINDOWS\temp\CS65E2D01B-07BA-42AB-B981-E55F28CB78C6.tmp not found!
File C:\WINDOWS\temp\CS683BC3D4-F61E-4885-BDEB-7EFA531DE5CF.tmp not found!
File C:\WINDOWS\temp\CS6B770885-6F7D-428D-BD2D-5DF8A2EFF1A6.tmp not found!
File C:\WINDOWS\temp\CS6C71367F-AB6A-4499-849B-B375EB526DD1.tmp not found!
File C:\WINDOWS\temp\CS6C79F76F-39F8-40E1-B899-2A6898CB643C.tmp not found!
File C:\WINDOWS\temp\CS723EC5CD-1F6B-496E-9A6F-2F0DA5BF0A80.tmp not found!
File C:\WINDOWS\temp\CS789F8E57-EB5E-41A3-8707-2D7CC439F524.tmp not found!
File C:\WINDOWS\temp\CS7960198D-4323-43AE-B115-6766C23EE955.tmp not found!
File C:\WINDOWS\temp\CS817D16AD-E655-470A-931B-DBBA8C0FEC67.tmp not found!
File C:\WINDOWS\temp\CS821EB616-2EC1-4C91-903C-CB45A58FD603.tmp not found!
File C:\WINDOWS\temp\CS883F7925-8E18-4EC6-8A09-A24F8CFC4F13.tmp not found!
File C:\WINDOWS\temp\CS8CD253CC-9164-4E9F-AC8B-F286395B26AE.tmp not found!
File C:\WINDOWS\temp\CS8F2A1AED-39D3-403A-83CF-7CAEDD6A82E5.tmp not found!
File C:\WINDOWS\temp\CS90A65FAF-5233-4308-ABC7-5C003A38F815.tmp not found!
File C:\WINDOWS\temp\CS97AF4133-5D8B-4499-9362-241CBA2B2184.tmp not found!
File C:\WINDOWS\temp\CS9919DD9D-1451-473A-8A95-DC6C580988E8.tmp not found!
File C:\WINDOWS\temp\CS99FA070E-1B38-41F0-8C22-07EDCD004D28.tmp not found!
File C:\WINDOWS\temp\CS9A17EFF4-1D01-4EFF-AC6E-1C09570846B2.tmp not found!
File C:\WINDOWS\temp\CS9AA8078D-5A9E-4D53-8087-BC2E0F09F23B.tmp not found!
File C:\WINDOWS\temp\CS9BD887C1-7323-430D-B082-A38D51369754.tmp not found!
File C:\WINDOWS\temp\CSA10E575D-5030-4495-9D6D-BDEC216CE136.tmp not found!
File C:\WINDOWS\temp\CSA5766963-BF82-41B3-A8B6-1D09C63B793C.tmp not found!
File C:\WINDOWS\temp\CSA599F2C6-ED30-49B8-906B-6A383B10F8B7.tmp not found!
File C:\WINDOWS\temp\CSA5DC8905-A69B-447C-9367-149CD3685642.tmp not found!
File C:\WINDOWS\temp\CSA6376775-4C4A-4BEA-9800-8FF9A25D2799.tmp not found!
File C:\WINDOWS\temp\CSA65458A1-E11A-4893-9F7C-C20258B025FB.tmp not found!
File C:\WINDOWS\temp\CSA8091347-C209-4DD2-9E0E-54851E320894.tmp not found!
File C:\WINDOWS\temp\CSA8692C82-8676-44EE-81B5-C55FC02CB061.tmp not found!
File C:\WINDOWS\temp\CSA996E8CF-C781-419E-ADC9-1E5518EB1F9E.tmp not found!
File C:\WINDOWS\temp\CSA99D9B53-64E0-44B5-9FF0-A194F4086B69.tmp not found!
File C:\WINDOWS\temp\CSAA4798FD-CC13-45EA-A95C-D8FC09ECE1FB.tmp not found!
File C:\WINDOWS\temp\CSAC43779C-A087-492E-B419-DEBC585C5E22.tmp not found!
File C:\WINDOWS\temp\CSAD3978FB-3C11-4F40-8853-A2A709B27944.tmp not found!
File C:\WINDOWS\temp\CSAEC10C17-F89D-44B6-99F0-AD499C358923.tmp not found!
File C:\WINDOWS\temp\CSB0404F9D-15C1-4349-A5D9-078FD66695A9.tmp not found!
File C:\WINDOWS\temp\CSB59B6AB8-8211-42A5-BB31-F85997F17120.tmp not found!
File C:\WINDOWS\temp\CSB6666C54-5BFA-4FD9-ABD7-EAC0A6A6A6CA.tmp not found!
File C:\WINDOWS\temp\CSB7344605-5E92-475B-BFCB-5BF2313A71DD.tmp not found!
File C:\WINDOWS\temp\CSB8F32C8B-B989-4B3F-BC77-BCAABA40B7E3.tmp not found!
File C:\WINDOWS\temp\CSBCBE2149-CF2D-4C45-AFD7-F15076C623AB.tmp not found!
File C:\WINDOWS\temp\CSBCC68E3B-A7AC-44F2-9C86-F79B041B498E.tmp not found!
File C:\WINDOWS\temp\CSC8811534-79D7-4420-B2C0-7384560144F2.tmp not found!
File C:\WINDOWS\temp\CSC9C8472B-97CC-4997-8AC3-BBA2F850628C.tmp not found!
File C:\WINDOWS\temp\CSD415C8C0-A767-4BC5-AC9C-CF7B16E226D6.tmp not found!
File C:\WINDOWS\temp\CSD50E6305-CC90-4851-BD66-9F4165881CAC.tmp not found!
File C:\WINDOWS\temp\CSD62A29A9-BEBC-4026-AA43-7F54AAF79E27.tmp not found!
File C:\WINDOWS\temp\CSD69F32B7-30DA-4511-AFFE-51FE06E7F578.tmp not found!
File C:\WINDOWS\temp\CSD7E456FC-B522-4C1D-AA52-7023EFF8ED0B.tmp not found!
File C:\WINDOWS\temp\CSDB7E824E-0F4F-4F41-AEB4-BC07AC9DEFEC.tmp not found!
File C:\WINDOWS\temp\CSE01A4C4D-A128-45F0-BD98-DC7B38A50470.tmp not found!
File C:\WINDOWS\temp\CSE086B009-8E44-4AA3-949E-094749730502.tmp not found!
File C:\WINDOWS\temp\CSE2159A9A-E230-4018-A901-0007D51836DA.tmp not found!
File C:\WINDOWS\temp\CSEDA6F275-5548-4A6F-9945-EEF77FFDE627.tmp not found!
File C:\WINDOWS\temp\CSF0489487-DF3D-4A79-A434-B2991BE256D6.tmp not found!
File C:\WINDOWS\temp\CSF07C98C6-50FD-41BC-9F94-F2DEA1BD7BCB.tmp not found!
File C:\WINDOWS\temp\CSF33B34C7-D6CB-44E8-A472-3C4DA4DD796B.tmp not found!
File C:\WINDOWS\temp\CSF399D3DC-4B86-42B4-8934-88EF0DF1ECAC.tmp not found!
File C:\WINDOWS\temp\CSF480D45C-2AD4-415D-861D-C40E0EB3D2AB.tmp not found!

————————————–hjt log———————————————————-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:54:49 PM, on 1/9/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Toshiba Hotkey Utility] "c:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang en
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F999E094-05CA-4E6B-8F50-E9BE54BD3D7E}: NameServer = 65.24.7.3,65.24.7.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

–
End of file - 9577 bytes