Spyware / Malware / Virus Removal

[Resolved] sillydl dic and redirect

4 min read

Looking for the outcome? Ask AI

Steveo83 Topic Starter

Post #1January 31, 2009, 10:10 AM UTC

I am also having problems with a internet browser redirect and with removing the sillydl dic file. It seems that all the anti-virus programs I have downloaded none of them detect the file except the yahoo anti-virus but yahoo cannot remove the file. I keep getting the need admin rights to remove error at the end. I have even contacted yahoo on how to run there anti-virus program in admin but they gave me the run around and assured me every thing was fine. I'm pretty sure that this file is causing havoc on my system because every hour or so symantec end point pops up with found viruses. I also noticed that on my start menu notepad (c:\windows\systems32) is spelled in Russian. I have tried to download other spyware and anitvirus programs such as AVG and spybot but for some reason my computer wont connect to there servers to finish the install.I have tried adding the files to my firewalls and even disabled my firewalls for the installs but still nothing. I have a good amount of computer knowledge but this one is killing me. Here is my hijack this and combofix logs.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:00:40 PM, on 1/30/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ActivIdentity\ActivClient\acsagent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/enterprise/securit...ponse/index.jsp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: VizController Class - {0F9CECE1-0306-4BB0-8BEF-C9EA3841E38A} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: DiskView - {6A882320-BDD0-4ff4-BE3A-D8BAF82668E9} - (no file)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [accrdsub] "C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: ActivClient Agent.lnk = C:\Program Files\ActivIdentity\ActivClient\acsagent.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Yahoo;! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps; - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS; - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix: 
O16 - DPF: {2CA2C9B8-E4F6-4BE9-8601-52ED0AFBA79D} (Pearson Accounting Player) - http://asp.mathxl.com/books/_Players/AccountingPlayer.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - C:\PROGRA~1\Stardock\Object Desktop\DeskScapes\DesktopControlPanel.dll
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\Object Desktop\DeskScapes\DreamControl.dll
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\Object Desktop\DeskScapes\deskscapes.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - C:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxbc_device -   - C:\Windows\system32\lxbccoms.exe
O23 - Service: lxbl_device -   - C:\Windows\system32\lxblcoms.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\Mabinogi\npkcmsvc.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Stardock WindowBlinds (WindowBlinds) - Stardock Corporation - C:\Program Files\Stardock\Object Desktop\WindowBlinds\vistasrv.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 11969 bytes

And here is my combo fix log

ComboFix 09-01-21.04 - Steve 2009-01-30 21:43:12.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.1.1033.18.3069.1509 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated)
FW: Symantec Endpoint Protection *disabled*
 * Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\windows\system32\Memman.vxd
c:\windows\system32\skinboxer43.dll

.
(((((((((((((((((((((((((   Files Created from 2008-12-28 to 2009-01-31  )))))))))))))))))))))))))))))))
.

2009-01-30 21:00 . 2009-01-30 21:00		d——–	c:\users\All Users\Kaspersky Lab Setup Files
2009-01-30 21:00 . 2009-01-30 21:00		d——–	c:\programdata\Kaspersky Lab Setup Files
2009-01-30 20:51 . 2009-01-30 20:56		d——–	c:\users\All Users\avg8
2009-01-30 20:51 . 2009-01-30 20:56		d——–	c:\programdata\avg8
2009-01-30 16:43 . 2009-01-30 16:43		d——–	c:\users\Steve\AppData\Roaming\SUPERAntiSpyware.com
2009-01-30 16:43 . 2009-01-30 16:43		d——–	c:\users\All Users\SUPERAntiSpyware.com
2009-01-30 16:43 . 2009-01-30 16:43		d——–	c:\programdata\SUPERAntiSpyware.com
2009-01-30 16:43 . 2009-01-30 16:43		d——–	c:\program files\SUPERAntiSpyware
2009-01-30 16:40 . 2009-01-30 16:40		d——–	c:\users\Steve\AppData\Roaming\Malwarebytes
2009-01-30 16:40 . 2009-01-30 16:40		d——–	c:\users\All Users\Malwarebytes
2009-01-30 16:40 . 2009-01-30 16:40		d——–	c:\programdata\Malwarebytes
2009-01-30 16:40 . 2009-01-30 16:40		d——–	c:\program files\Malwarebytes' Anti-Malware
2009-01-30 16:40 . 2009-01-14 16:11	38,496	–a——	c:\windows\System32\drivers\mbamswissarmy.sys
2009-01-30 16:40 . 2009-01-14 16:11	15,504	–a——	c:\windows\System32\drivers\mbam.sys
2009-01-27 21:06 . 2009-01-27 21:06		d——–	c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-27 21:06 . 2009-01-27 21:06		d——–	c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-27 21:06 . 2009-01-27 21:06		d——–	c:\program files\iPod
2009-01-27 21:06 . 2008-04-17 13:12	107,368	–a——	c:\windows\System32\GEARAspi.dll
2009-01-27 21:06 . 2008-04-17 13:12	15,464	–a——	c:\windows\System32\drivers\GEARAspiWDM.sys
2009-01-27 21:03 . 2009-01-27 21:04		d——–	c:\program files\QuickTime
2009-01-27 20:50 . 2009-01-27 20:50		d——–	c:\program files\Safari
2009-01-25 21:01 . 2009-01-25 21:01		d——–	c:\program files\Flying Lab Software
2009-01-25 21:00 . 2009-01-25 21:00		d——–	c:\program files\Sony
2009-01-25 00:22 . 2009-01-25 00:24		d——–	c:\program files\CA Yahoo! Anti-Spy
2009-01-25 00:19 . 2009-01-25 00:19	524,288	–ahs—-	C:\ntuser.dat{54131a8a-ea89-11dd-97ad-0019d1660227}.TMContainer00000000000000000002.regtrans-ms
2009-01-25 00:19 . 2009-01-25 00:19	524,288	–ahs—-	C:\ntuser.dat{54131a8a-ea89-11dd-97ad-0019d1660227}.TMContainer00000000000000000001.regtrans-ms
2009-01-25 00:19 . 2009-01-25 00:19	262,144	–a——	C:\ntuser.dat
2009-01-25 00:19 . 2009-01-25 00:19	65,536	–ahs—-	C:\ntuser.dat{54131a8a-ea89-11dd-97ad-0019d1660227}.TM.blf
2009-01-25 00:19 . 2009-01-25 00:19	5,120	–ah—–	C:\ntuser.dat.LOG1
2009-01-25 00:19 . 2009-01-25 00:19	0	–ah—–	C:\ntuser.dat.LOG2
2009-01-25 00:07 . 2009-01-25 00:22		d——–	c:\program files\Common Files\Scanner
2009-01-24 20:37 . 1997-01-16 00:00	958,224	–a——	c:\windows\System32\MSCHART.OCX
2009-01-24 20:37 . 1997-07-19 16:01	196,880	–a——	c:\windows\System32\RICHTX32.OCX
2009-01-24 20:37 . 1999-01-12 15:19	195,584	–a——	c:\windows\System32\XVoice.dll
2009-01-24 20:37 . 1999-10-09 14:11	190,464	–a——	c:\windows\System32\landplot.dll
2009-01-24 20:37 . 1999-01-12 15:19	173,056	–a——	c:\windows\System32\Vtext.dll
2009-01-24 14:30 . 2009-01-18 15:35	15,688	–a——	c:\windows\System32\lsdelete.exe
2009-01-23 23:23 . 2009-01-27 21:06		d—-c—	c:\windows\System32\DRVSTORE
2009-01-23 23:23 . 2009-01-18 15:30	64,160	–a——	c:\windows\System32\drivers\Lbd.sys
2009-01-23 22:57 . 2009-01-23 23:23		d——–	c:\users\All Users\Lavasoft
2009-01-23 22:57 . 2009-01-23 22:57		d–h-c—	c:\users\All Users\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-23 22:57 . 2009-01-23 23:23		d——–	c:\programdata\Lavasoft
2009-01-23 22:57 . 2009-01-23 22:57		d–h-c—	c:\programdata\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-21 17:41 . 2009-01-21 17:41		d——–	c:\program files\Microsoft
2009-01-20 22:51 . 2009-01-20 23:11		d——–	c:\program files\dwyco2
2009-01-20 22:30 . 2009-01-20 22:30		d——–	c:\users\Steve\AppData\Roaming\QQ Games Plugin
2009-01-20 22:30 . 2009-01-20 22:30		d——–	c:\users\Steve\AppData\Roaming\acccore
2009-01-20 22:29 . 2009-01-20 22:29		d——–	c:\users\Steve\AppData\Roaming\Tencent
2009-01-20 22:28 . 2009-01-20 22:28		d——–	c:\program files\Tencent
2009-01-20 22:27 . 2009-01-20 22:30		d——–	c:\program files\AIMTunes
2009-01-20 22:26 . 2009-01-20 22:26		d——–	c:\users\All Users\Viewpoint
2009-01-20 22:26 . 2009-01-20 22:30		d——–	c:\users\All Users\AOL OCP
2009-01-20 22:26 . 2009-01-20 22:27		d——–	c:\users\All Users\AOL Downloads
2009-01-20 22:26 . 2009-01-20 22:26		d——–	c:\users\All Users\AOL
2009-01-20 22:26 . 2009-01-20 22:26		d——–	c:\users\All Users\acccore
2009-01-20 22:26 . 2009-01-20 22:26		d——–	c:\programdata\Viewpoint
2009-01-20 22:26 . 2009-01-20 22:30		d——–	c:\programdata\AOL OCP
2009-01-20 22:26 . 2009-01-20 22:27		d——–	c:\programdata\AOL Downloads
2009-01-20 22:26 . 2009-01-20 22:26		d——–	c:\programdata\AOL
2009-01-20 22:26 . 2009-01-20 22:26		d——–	c:\programdata\acccore
2009-01-20 22:26 . 2009-01-20 22:26		d——–	c:\program files\Viewpoint
2009-01-20 22:26 . 2009-01-20 22:26	21	–a——	c:\windows\atid.ini
2009-01-20 22:25 . 2009-01-20 22:25		d——–	c:\program files\Common Files\AOL
2009-01-20 22:25 . 2009-01-20 22:29		d——–	c:\program files\AIM6
2009-01-20 22:25 . 2009-01-20 22:29	1,214	–ah—–	C:\IPH.PH
2009-01-20 22:06 . 2009-01-20 22:06		d——–	c:\program files\Eyeball
2009-01-17 21:25 . 2009-01-17 21:25		d——–	c:\windows\PaltalkScene
2009-01-17 21:25 . 2009-01-20 20:45		d——–	c:\users\Steve\AppData\Roaming\Paltalk
2009-01-17 21:25 . 2009-01-20 20:45		d——–	c:\program files\Paltalk Messenger
2009-01-13 23:14 . 2008-12-15 20:42	288,768	–a——	c:\windows\System32\drivers\srv.sys
2009-01-08 16:22 . 2009-01-08 16:22		d——–	c:\program files\Common Files\ActivIdentity
2009-01-05 16:18 . 2009-01-05 16:18	90,112	–a——	c:\windows\System32\QuickTimeVR.qtx
2009-01-05 16:18 . 2009-01-05 16:18	57,344	–a——	c:\windows\System32\QuickTime.qts
2008-12-31 03:08 . 2008-12-31 03:08		d——–	c:\users\All Users\SlySoft
2008-12-31 03:08 . 2008-12-31 03:08		d——–	c:\programdata\SlySoft
2008-12-13 20:26 . 2009-01-24 20:20		d——–	c:\program files\Frets on Fire
2008-12-12 21:32 . 2008-12-12 21:32		d——–	c:\users\Steve\AppData\Roaming\Corel
2008-12-12 21:32 . 2009-01-25 02:49	2,516	–ahs—-	c:\users\All Users\KGyGaAvL.sys
2008-12-12 21:32 . 2009-01-25 02:49	2,516	–ahs—-	c:\programdata\KGyGaAvL.sys
2008-12-12 21:32 . 2008-12-12 21:32	8	-r-hs—-	c:\users\All Users\3DE0D388F6.sys
2008-12-12 21:32 . 2008-12-12 21:32	8	-r-hs—-	c:\programdata\3DE0D388F6.sys
2008-12-12 21:15 . 2008-12-12 21:19		d——–	c:\users\All Users\Corel
2008-12-12 21:15 . 2008-12-12 21:19		d——–	c:\programdata\Corel
2008-12-12 21:15 . 2008-12-12 21:15		d——–	c:\program files\Common Files\Protexis
2008-12-12 21:15 . 2008-12-12 21:17		d——–	c:\program files\Common Files\Corel
2008-12-11 14:10 . 2009-01-28 18:00		d——–	c:\program files\Norton Security Scan
2008-12-11 11:09 . 2008-12-11 11:09		d——–	c:\windows\System32\Adobe
2008-12-10 07:43 . 2008-12-10 07:43		d——–	c:\program files\ActivIdentity
2008-12-10 03:03 . 2008-10-21 19:22	2,048	–a——	c:\windows\System32\tzres.dll
2008-12-09 22:28 . 2008-10-31 19:21	4,240,384	–a——	c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-09 22:28 . 2008-10-29 00:29	2,927,104	–a——	c:\windows\explorer.exe
2008-12-09 22:28 . 2008-10-20 23:25	296,960	–a——	c:\windows\System32\gdi32.dll
2008-12-09 22:28 . 2008-10-31 21:44	28,672	–a——	c:\windows\System32\Apphlpdm.dll
2008-12-09 22:27 . 2008-06-22 19:59	2,868,736	–a——	c:\windows\System32\mf.dll
2008-12-09 22:27 . 2008-06-22 19:59	996,352	–a——	c:\windows\System32\WMNetMgr.dll
2008-12-09 22:27 . 2008-10-15 22:47	827,392	–a——	c:\windows\System32\wininet.dll
2008-12-09 22:27 . 2008-06-22 19:58	94,720	–a——	c:\windows\System32\logagent.exe
2008-12-09 15:02 . 2000-10-20 01:05	25,088	–a——	c:\windows\System32\msxml3a.dll
2008-12-09 14:55 . 2008-12-09 14:55		d——–	c:\program files\ffdshow
2008-12-09 14:55 . 2006-08-23 12:33	7,680	–a——	c:\windows\System32\ff_acm.acm
2008-12-09 14:55 . 2006-08-23 12:33	6,144	–a——	c:\windows\System32\ff_vfw.dll
2008-12-09 14:55 . 2006-08-23 12:33	547	–a——	c:\windows\System32\ff_vfw.dll.manifest
2008-12-09 14:53 . 2008-12-09 14:53		d——–	c:\program files\PlayFLV
2008-12-09 11:20 . 2008-12-09 11:20		d——–	c:\users\Steve\AppData\Roaming\VirtuaWin
2008-12-09 11:20 . 2008-12-09 11:20		d——–	c:\program files\VirtuaWin
2008-12-09 07:54 . 2008-12-09 07:54	0	–a——	c:\windows\WB.ini
2008-12-09 07:51 . 2008-04-26 16:14	58,792	–a——	c:\windows\System32\wbload.dll
2008-12-09 07:51 . 2008-04-26 16:14	42,672	–a——	c:\windows\System32\wbsys.dll
2008-12-09 07:23 . 2008-12-09 07:23		d——–	c:\program files\Devious Codeworks
2008-12-09 07:12 . 2008-12-09 07:12		d——–	c:\program files\AveIconifier2
2008-12-09 06:19 . 2009-01-24 20:25		d——–	c:\program files\Samurize
2008-12-09 06:15 . 2008-12-09 15:02		d——–	c:\program files\Common Files\Stardock
2008-12-09 06:06 . 2009-01-24 20:26		d——–	c:\program files\Rainmeter

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-31 03:11	———	d—–w	c:\program files\Common Files\Apple
2009-01-31 02:55	———	d—–w	c:\programdata\Avg7
2009-01-31 02:03	———	d—–w	c:\programdata\Google Updater
2009-01-30 22:43	———	d—–w	c:\program files\Common Files\Wise Installation Wizard
2009-01-28 03:06	———	d—–w	c:\program files\iTunes
2009-01-26 03:01	———	d–h–w	c:\program files\InstallShield Installation Information
2009-01-25 06:22	———	d—–w	c:\program files\Yahoo!
2009-01-25 06:20	———	d—–w	c:\programdata\Yahoo! Companion
2009-01-25 06:19	———	d—–w	c:\users\Steve\AppData\Roaming\yahoo!
2009-01-25 06:19	———	d—–w	c:\programdata\yahoo!
2009-01-25 02:35	———	d—–w	c:\program files\Image-Line
2009-01-25 02:31	———	d—–w	c:\program files\VstPlugins
2009-01-25 02:27	———	d—–w	c:\program files\Pando Networks
2009-01-25 02:25	———	d—–w	c:\program files\mozilla.org
2009-01-25 02:25	———	d—–w	c:\program files\HP
2009-01-24 04:57	———	d—–w	c:\program files\Lavasoft
2009-01-21 02:44	149,760	—-a-w	c:\windows\system32\drivers\WpsHelper.sys
2009-01-14 09:03	———	d—–w	c:\programdata\Microsoft Help
2009-01-14 09:03	———	d—–w	c:\program files\Windows Mail
2009-01-08 15:51	———	d—–w	c:\program files\Mozilla Thunderbird
2009-01-06 16:00	———	d—–w	c:\users\Steve\AppData\Roaming\SPORE
2008-12-29 05:50	———	d—–w	c:\program files\Apple Software Update
2008-12-16 09:06	———	d—–w	c:\program files\BOINC
2008-12-13 22:58	———	d—–w	c:\program files\Corel
2008-12-13 03:30	———	d—–w	c:\users\Steve\AppData\Roaming\U3
2008-12-11 20:10	———	d—–w	c:\program files\Common Files\Symantec Shared
2008-12-09 21:01	———	d—–w	c:\programdata\Stardock
2008-12-09 13:51	———	d—–w	c:\program files\Stardock
2008-11-11 23:47	413,696	—-a-w	c:\windows\System32\wrap_oal.dll
2008-11-11 23:47	110,592	—-a-w	c:\windows\System32\OpenAL32.dll
2008-11-01 03:44	541,696	—-a-w	c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44	52,736	—-a-w	c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44	460,288	—-a-w	c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44	2,154,496	—-a-w	c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44	173,056	—-a-w	c:\windows\AppPatch\AcXtrnal.dll
2008-10-22 03:57	241,152	—-a-w	c:\windows\System32\PortableDeviceApi.dll
2008-10-21 05:25	1,645,568	—-a-w	c:\windows\System32\connect.dll
2008-10-16 21:48	130,208	——r	c:\windows\bwUnin-8.1.1.87-8876480SL.exe
2008-10-16 21:13	1,809,944	—-a-w	c:\windows\System32\wuaueng.dll
2008-10-16 21:12	561,688	—-a-w	c:\windows\System32\wuapi.dll
2008-10-16 21:09	51,224	—-a-w	c:\windows\System32\wuauclt.exe
2008-10-16 21:09	43,544	—-a-w	c:\windows\System32\wups2.dll
2008-10-16 21:08	34,328	—-a-w	c:\windows\System32\wups.dll
2008-10-16 20:56	1,524,736	—-a-w	c:\windows\System32\wucltux.dll
2008-10-16 20:55	83,456	—-a-w	c:\windows\System32\wudriver.dll
2008-10-16 20:08	162,064	—-a-w	c:\windows\System32\wuwebv.dll
2008-10-16 19:56	31,232	—-a-w	c:\windows\System32\wuapp.exe
2008-10-16 17:11	127,034	——r	c:\windows\bwUnin-8.1.1.50-8876480SL.exe
2008-08-17 18:56	0	—-a-w	c:\users\Steve\jagex_runescape_preferences.dat
2008-07-23 18:09	174	–sha-w	c:\program files\desktop.ini
2004-08-18 17:00	270,336	——w	c:\program files\mozilla firefox\plugins\DCAENTU.dll
2004-08-18 17:00	1,294,336	——w	c:\program files\mozilla firefox\plugins\DCARSA.dll
2004-08-18 17:00	348,160	——w	c:\program files\mozilla firefox\plugins\GuiUtils.dll
2004-08-18 17:00	122,880	——w	c:\program files\mozilla firefox\plugins\nsldap32v30.dll
2007-10-17 22:05	61	–sh–w	c:\windows\cnerolf.dat
2008-08-24 18:13	16,384	–sha-w	c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-08-24 18:13	32,768	–sha-w	c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-12-24 18:30	16,384	–sha-w	c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
2008-08-24 18:13	16,384	–sha-w	c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-06-10 02:58	8	–sh–r	c:\windows\System32\F5E6750E52.sys
2007-06-12 01:48	2,516	–sha-w	c:\windows\System32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-22 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 115560]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 81920]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-18 506712]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608]

c:\users\Steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-12-09 3450608]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ActivClient Agent.lnk - c:\program files\ActivIdentity\ActivClient\acsagent.exe [2007-05-15 130864]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-03-25 214360]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-10-16 91440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-09-17 08:05 222456 c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.VSPX"= vspxvfw.dll
"msacm.ac3filter"= ac3filter.acm
"msacm.avis"= ff_acm.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PalTalk.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VirtuaWin.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VirtuaWin.lnk
backup=c:\windows\pss\VirtuaWin.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Steve^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BOINC Manager.lnk]
path=c:\users\Steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BOINC Manager.lnk
backup=c:\windows\pss\BOINC Manager.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Steve^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MEMonitor.lnk]
path=c:\users\Steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEMonitor.lnk
backup=c:\windows\pss\MEMonitor.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Steve^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Rainmeter.lnk]
path=c:\users\Steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
backup=c:\windows\pss\Rainmeter.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra—— 2007-03-01 09:37 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
–a—— 2006-09-28 13:21 57344 c:\program files\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel File Shell Monitor]
-ra—— 2008-08-18 16:53 16712 c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
-ra—— 2008-08-18 16:53 532808 c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
–a—— 2007-04-03 16:29 165784 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a—— 2007-08-24 07:00 33648 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe]
–a—— 2008-08-01 12:36 1103216 c:\program files\Download Manager\DLM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2009-01-06 13:06 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2009-01-05 16:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2008-10-02 05:25 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2007-08-30 17:43 4670704 c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2469313061-3269130606-2295043518-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"= c:\program files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{5C8D79F1-3E87-4764-A696-AC7238B4C670}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{3E870791-E31B-4ACB-A2CF-FBFC4BF25CB7}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7CA21198-F5DF-4EA6-BF6F-C55D99D1060D}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{606C4753-A593-48FC-A6B3-C596F82F1F32}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{18E8DEBC-6DDC-4365-A090-2F2A3391FFF4}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{CE4B6784-9A8B-4C1E-AF80-83CF687DF9DE}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{34360DFF-F719-4733-ABD0-D895486A051C}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{6C46655B-A30A-4EA0-8779-B800222D6865}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{AF506557-FF28-4657-AFFF-9946789421CA}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{68EE24FE-12ED-46D5-8E47-BAD8CDE3FEE6}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{EAD7B441-E035-409B-B7F2-342A815DF79B}"= UDP:c:\program files\Symantec AntiVirus\Rtvscan.exe:Symantec Antivirus
"{4E54E75A-9E5A-4E6D-92EA-61F03E942257}"= TCP:c:\program files\Symantec AntiVirus\Rtvscan.exe:Symantec Antivirus
"{945FE469-4A5B-484C-A56D-75FE1C7C1BA2}"= UDP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
"{D256D58F-4AEC-4FD7-89B9-406C3EB54FD8}"= TCP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
"TCP Query User{71BE66A2-32B4-44E7-B510-8F63833F7672}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{AE1EB56E-6F9D-4378-8CDC-3E18F60142DE}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"{5529E60F-1E71-4A25-B318-6FC70B630719}"= UDP:c:\games\World of Warcraft\BackgroundDownloader.exe:Blizzard Downloader
"{DF6EE65E-92C4-4231-9CD6-4596DDF61566}"= TCP:c:\games\World of Warcraft\BackgroundDownloader.exe:Blizzard Downloader
"{78CB764C-2FBC-432D-A32E-A0B3C24727FB}"= UDP:3724:Blizzard Downloader: 3724
"{D0C10B0F-EAF7-4460-9B07-A0F2394DF130}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{1D2F3CA8-2506-443D-8781-5EF95C043428}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{B0B7D2D4-F255-4F9F-A5CD-85DBF0E3FF0E}"= UDP:c:\windows\System32\lxbccoms.exe:Lexmark Communications System
"{6DAE3C77-3D80-4766-A5B0-E5B0091D3870}"= TCP:c:\windows\System32\lxbccoms.exe:Lexmark Communications System
"{A0CCC5CD-EEBB-4B8C-BF59-F45CBE1FE6D5}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxbcpswx.exe:Printer Status Window
"{28B1F501-3CF0-4B29-918D-7CD906B7AC87}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxbcpswx.exe:Printer Status Window
"{FDDD77F4-BE52-41CD-8412-DD3561F9F9BC}"= UDP:c:\program files\SEGA\Medieval II Total War\medieval2.exe:Medieval II Total War
"{A9B93B4D-44EB-43EF-A745-706E35E4A990}"= TCP:c:\program files\SEGA\Medieval II Total War\medieval2.exe:Medieval II Total War
"{62979C37-D201-4F58-8C16-B116F1007F2C}"= Disabled:UDP:135:TCP Port 135
"{9C4746CE-194B-4C64-8CF9-8C196FF74D06}"= Disabled:UDP:5000:TCP Port 5000
"{7B717E1C-D904-41F2-B6B3-F369C2BDDB60}"= Disabled:UDP:5001:TCP Port 5001
"{03BD3E53-5316-4C81-8162-58D89AE86CDB}"= Disabled:UDP:5002:TCP Port 5002
"{BAB5439C-7FB4-447E-A1CA-50F4359F0DB5}"= Disabled:UDP:5003:TCP Port 5003
"{D5E20C8E-8E5E-4BA9-B739-F2788824B624}"= Disabled:UDP:5004:TCP Port 5004
"{BED1E505-C160-4E0A-9FD2-D7416DC4EAFA}"= Disabled:UDP:5005:TCP Port 5005
"{6F765680-6FF6-4015-80D2-E567D6A41312}"= Disabled:UDP:5006:TCP Port 5006
"{722C66F3-C868-4C4E-A057-91CFBB2C0DB7}"= Disabled:UDP:5007:TCP Port 5007
"{D88E56F6-A5F1-4238-8C24-1D0816DF01CE}"= Disabled:UDP:5008:TCP Port 5008
"{A29B6400-4CCB-44FC-87FF-566C6AD3E716}"= Disabled:UDP:5009:TCP Port 5009
"{9945AE0D-0AF8-41B8-9C2C-8AA6A5BC719E}"= Disabled:UDP:5010:TCP Port 5010
"{0AB5FA75-347E-45D9-A27E-C884A3BB5749}"= Disabled:UDP:5011:TCP Port 5011
"{BA059D82-ED84-44EC-B10E-4AA52B7BA6F8}"= Disabled:UDP:5012:TCP Port 5012
"{E41F478E-E7AE-48EC-8549-FA2F9FA028FA}"= Disabled:UDP:5013:TCP Port 5013
"{3BB2862D-2398-4CA9-B188-11698DBEF623}"= Disabled:UDP:5014:TCP Port 5014
"{DF4A210F-61BB-40D2-B51F-E89373FD39DD}"= Disabled:UDP:5015:TCP Port 5015
"{B3346500-A838-45BC-9821-704F10206DAC}"= Disabled:UDP:5016:TCP Port 5016
"{24C2C0E0-CB32-4B8E-8141-03D4707B1C21}"= Disabled:UDP:5017:TCP Port 5017
"{F7CE171F-7491-4322-9FA0-4C557CD0A07B}"= Disabled:UDP:5018:TCP Port 5018
"{7F985D5C-60FF-48EE-99AF-6E48F6C685F8}"= Disabled:UDP:5019:TCP Port 5019
"{737252C3-5D1B-48BF-A13A-870CF5B3A2BD}"= Disabled:UDP:5020:TCP Port 5020
"{B26806BD-6375-4BA8-B98E-FD8E1EEF67FB}"= UDP:c:\windows\System32\lxblcoms.exe:Z700-P700 Series Server
"{67DB292A-536A-4D7C-83BE-7B55236420D6}"= TCP:c:\windows\System32\lxblcoms.exe:Z700-P700 Series Server
"{60DB6201-BCF6-4E98-BD17-030BF9138FC3}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxblpswx.exe:Z700-P700 Series Printer Status
"{FD1DAA50-77E6-4B00-9E49-B0A2EEEBC96C}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxblpswx.exe:Z700-P700 Series Printer Status
"{11AAB2A1-3507-4A03-87AD-CFA038A1D40D}"= UDP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk
"{3547D8FF-CAE3-40C6-BDE8-951F701EC83C}"= TCP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk
"TCP Query User{E46D4886-A46A-4730-8E77-16AE19DCF70F}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{9A190940-A9F3-4424-8BF0-5ECA2798D936}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{CC466F20-FF35-488F-8A72-9F547C14C6E5}c:\\program files\\veoh networks\\veoh\\veohclient.exe"= UDP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"UDP Query User{2FDD923D-AEA2-448E-99BC-8B30F94A6912}c:\\program files\\veoh networks\\veoh\\veohclient.exe"= TCP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"{D5CF7A66-BB39-4F6E-B77A-5C86E2E9DAF7}"= UDP:9420:Red Swoosh
"{7495BE3B-9CC7-42AE-AE7B-C90E70047F9F}"= TCP:5000:Red Swoosh
"{85D96F78-C2D8-46E4-A6BF-1BAAC10EC335}"= UDP:990:LocalSubnet:LocalSubnet|IF={58C85298-F9D1-48EA-B64F-9EEE4E1EF866}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
"{398C2471-9F66-4106-89C7-150CF892A8F6}"= UDP:c:\games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"{EB98B480-6041-435B-99BC-6508A931ABB6}"= TCP:c:\games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"{66CB66F9-6DD3-4EC3-AA5B-FD55F4A00A72}"= UDP:c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe:SMC Service
"{85932436-3DE6-43C9-B500-C00D1AB4F7C7}"= TCP:c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe:SMC Service
"{3E7CA452-4E1F-45B3-9545-34AD5C21D60C}"= UDP:c:\program files\Symantec\Symantec Endpoint Protection\SNAC.EXE:SNAC Service
"{0D258C64-51EE-4282-B7B4-FED2C9F1FCD4}"= TCP:c:\program files\Symantec\Symantec Endpoint Protection\SNAC.EXE:SNAC Service
"{317281AE-2076-4363-A34C-5BA235D13D94}"= UDP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
"{936186AA-6ABE-488D-84EC-E54C85D06707}"= TCP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
"{355843B8-4B79-40F9-B0E7-7717805A9E27}"= UDP:990:LocalSubnet:LocalSubnet|IF={58C85298-F9D1-48EA-B64F-9EEE4E1EF866}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
"{3CCD37C0-2426-4DE2-B1FC-BC61EA98FEE1}"= UDP:990:LocalSubnet:LocalSubnet|IF={58C85298-F9D1-48EA-B64F-9EEE4E1EF866}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
"{EA784E39-5878-43AA-B7DA-48D5187B2376}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{27C59DBB-F764-4FA0-A729-31B3DFCDA8BD}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{2BA81C3E-A251-438B-A795-F2FB1DA718D5}"= UDP:c:\games\Sid Meier's Civilization IV Colonization\Colonization.exe:Sid Meier's Civilization IV Colonization
"{2B808470-4B5F-4D19-83E6-AD432AD0F823}"= TCP:c:\games\Sid Meier's Civilization IV Colonization\Colonization.exe:Sid Meier's Civilization IV Colonization
"{53D47012-A3A0-40A2-99B2-D496302C8D8E}"= UDP:c:\games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{ACBAFA13-CBDB-4668-BDD5-37050EE7054E}"= TCP:c:\games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{CCA2FB2B-053F-4C1A-A6E4-AF1460CFDA42}"= UDP:c:\games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4 Warlords
"{E25F8562-315D-4A09-9C21-2FB6627A3C24}"= TCP:c:\games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4 Warlords
"{F2937D47-8A1B-4DE1-BEB4-B35A060E2BAB}"= UDP:c:\games\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe:Sid Meier's Civilization 4 Pitboss
"{A69ACAA2-E049-4D50-A506-A4D43EADB4AF}"= TCP:c:\games\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe:Sid Meier's Civilization 4 Pitboss
"{4691BC3D-429F-4A05-8F25-97FC3E4CEB9C}"= UDP:c:\games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{D3E0F628-5710-4157-9578-0353D3403E48}"= TCP:c:\games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{E996C089-9B69-4401-8E7E-1156D0A7A4C0}"= UDP:c:\games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"{E68CFD07-F71E-44E3-8788-BB390C65CED8}"= TCP:c:\games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"{002BA8FB-1819-4482-92B3-BF5CC8B4E09B}"= c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{72CBA9A2-37DC-48D0-B5D5-472F357D3FE1}"= c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{AFE573B0-61B1-4700-86DD-589A1962328D}"= c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{014423E2-344E-4205-8AD4-834B01767AEC}"= c:\program files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{A5C22F23-BFCA-473B-BD7B-93C689F0BD65}"= c:\program files\HP\Digital Imaging\bin\hpiscnapp.exe:hpiscnapp.exe
"{9DB164F3-077B-4BE3-9E7F-7B11BB821543}"= c:\program files\Common Files\HP\Digital Imaging\bin\hpqphotocrm.exe:hpqphotocrm.exe
"{71568577-1E85-4C74-AD22-88C896AF323C}"= c:\program files\HP\Digital Imaging\bin\hpqsudi.exe:hpqsudi.exe
"{15B4219C-D0E6-4B4A-BCD7-0C9562F31D0C}"= c:\program files\HP\Digital Imaging\bin\hpqpsapp.exe:hpqpsapp.exe
"{FCE504FF-D8B8-4118-A6BC-55476C060BE7}"= c:\program files\HP\Digital Imaging\bin\hpqcopy2.exe:hpqcopy2.exe
"{A2C7D774-A362-4F77-9BB9-158A010FCD09}"= c:\program files\HP\Digital Imaging\bin\hpqpse.exe:hpqpse.exe
"{FB687CFC-A557-4C28-BDE6-39162368C140}"= c:\program files\HP\Digital Imaging\bin\hpqgplgtupl.exe:hpqgplgtupl.exe
"{EBDA7FD5-9432-4163-890F-4A199A6596CA}"= c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe:hpqgpc01.exe
"{1DC1BE19-7EA9-44BB-AEA1-133569F0A930}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{669470FE-4DED-4FF2-9024-C514322D65E9}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{2312FA09-A251-440F-8347-5CA86746CA54}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{52B47986-2139-479C-A3D4-0F4DBCD9F227}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{E2026369-9A28-4187-BD27-D612C228E394}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{BBCA8EE3-FBCF-46B8-B76B-02CCEBA2B51D}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{269DEB0F-62CE-48B2-B760-7034D07A3CF7}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{4DA7D8D3-C096-4106-B1F2-DB030B74EC5D}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{7E87DE54-D477-4F7F-94E4-7C522E9C50B9}c:\\program files\\camfrog\\camfrog video chat\\camfrog video chat.exe"= UDP:c:\program files\camfrog\camfrog video chat\camfrog video chat.exe:Camfrog Client Module
"UDP Query User{DDEBF98A-7EFB-49F8-A286-CBC838D382F2}c:\\program files\\camfrog\\camfrog video chat\\camfrog video chat.exe"= TCP:c:\program files\camfrog\camfrog video chat\camfrog video chat.exe:Camfrog Client Module

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"= c:\program files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [2009-01-23 64160]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-09 99376]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
R3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\System32\drivers\SCR3XX2K.sys [2007-10-17 56448]
R4 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [2007-05-15 182576]
R4 lxbc_device;lxbc_device;c:\windows\system32\lxbccoms.exe -service –> c:\windows\system32\lxbccoms.exe -service [?]
R4 lxbl_device;lxbl_device;c:\windows\system32\lxblcoms.exe -service –> c:\windows\system32\lxblcoms.exe -service [?]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2009-01-20 24652]
R4 YahooAUService;Yahoo! Updater;c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
S3 COH_Mon;COH_Mon;c:\windows\System32\drivers\COH_Mon.sys [2007-05-29 23888]
S3 SCR131C;SCRx31 Serial Smart Card Reader;c:\windows\System32\drivers\SCR131C.sys [2002-11-07 181875]
S3 SCR33X USB Smart Card Reader;SCR33X USB Smart Card Reader;c:\windows\System32\drivers\SCR33X2K.sys [2004-04-06 64088]
S3 STCFUx32;STC DFU Driver;c:\windows\System32\drivers\STCFUx32.sys [2007-01-24 7680]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 921936]

— Other Services/Drivers In Memory —

*NewlyCreated* - AVGLDX86
*Deregistered* - AvgLdx86
*Deregistered* - sptd

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6dc75083-9bed-11dd-9206-0019d1660227}]
\shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{710647dc-e823-11dc-a73e-8000600fe800}]
\shell\AutoRun\command - I:\setup.exe
\shell\setup\command - I:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dde7c98c-f58a-11db-9a9d-806e6f6e6963}]
\shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e738c2d3-b9ef-11dc-9172-0019d1660227}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-01-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 15:34]

2009-01-29 c:\windows\Tasks\Norton Security Scan for Steve.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]

2009-01-31 c:\windows\Tasks\User_Feed_Synchronization-{8D63F995-423F-4570-84AD-8B305627E92F}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 01:33]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
SafeBoot-Symantec Antvirus
MSConfigStartUp-googletalk - c:\program files\Google\Google Talk\googletalk.exe
MSConfigStartUp-ManyCam - c:\program files\ManyCam 2.3\ManyCam.exe
MSConfigStartUp-Yodm3D - c:\users\Steve\Desktop\New Folder\Yodm3D.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.symantec.com/enterprise/security_response/index.jsp
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &Yahoo;! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary; - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps; - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS; - file:///c:\program files\Yahoo!\Common/ycsms.htm
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {2CA2C9B8-E4F6-4BE9-8601-52ED0AFBA79D} - hxxp://asp.mathxl.com/books/_Players/AccountingPlayer.cab
FF - ProfilePath - c:\users\Steve\AppData\Roaming\Mozilla\Firefox\Profiles\r93gr8re.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=ytff-tyc7&p;=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=ytff-tyc7&p;=
FF - plugin: c:\progra~1\Gradkell Systems, Inc\DBsign Web Signer\lib\npDBsignWeb.dll
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npDBsignWeb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npDBsignWeb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npDBsignWeb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nptgeqplugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-30 21:43:42
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …  

scanning hidden autostart entries … 

scanning hidden files …  

scan completed successfully
hidden files: 

**************************************************************************
.
Completion time: 2009-01-30 21:46:35
ComboFix-quarantined-files.txt  2009-01-31 03:46:30

Pre-Run: 37,166,280,704 bytes free
Post-Run: 37,130,678,272 bytes free

521	— E O F —	2009-01-21 23:42:24

And here is my notepad in russian not sure if its related I just noticed it so figured it was

[external image: Posted Image]

I would love any help you can provide this is a nasty little bug.
~Steve

Steveo83

Post #2January 31, 2009, 10:15 AM UTC last edited January 31, 2009, 10:17 AM UTC

I forgot to add that I am closly following LP57's and LDTate's threads and I have tried running my anti virus programs in safe mode.

ken545

Post #3February 4, 2009, 12:23 PM UTC

HelloSteveo83

Welcome to the Whatthetech Malware Removal Forum,

All advice given by anyone volunteering here, is taken at your own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.

Combofix is an extremely powerful tool and should only be run under the direction of a forum helper. As you can see it was run in - REDUCED FUNCTIONALITY MODE - so it was not run correctly. This forum, myself and sUbs will not be responsible if you run this on your own and damage your system

Please do not quote or code any reports, just copy and paste them in.

Post a new HJT log and lets see where we stand

Steveo83

Post #4February 5, 2009, 9:11 PM UTC last edited February 5, 2009, 9:14 PM UTC

Here is my latest HJT file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:08:09 PM, on 2/5/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ActivIdentity\ActivClient\acsagent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
C:\program files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/enterprise/securit…ponse/index.jsp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: VizController Class - {0F9CECE1-0306-4BB0-8BEF-C9EA3841E38A} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: DiskView - {6A882320-BDD0-4ff4-BE3A-D8BAF82668E9} - (no file)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [accrdsub] "C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: ActivClient Agent.lnk = C:\Program Files\ActivIdentity\ActivClient\acsagent.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix:
O16 - DPF: {2CA2C9B8-E4F6-4BE9-8601-52ED0AFBA79D} (Pearson Accounting Player) - http://asp.mathxl.com/books/_Players/AccountingPlayer.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - C:\PROGRA~1\Stardock\Object Desktop\DeskScapes\DesktopControlPanel.dll
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\Object Desktop\DeskScapes\DreamControl.dll
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\Object Desktop\DeskScapes\deskscapes.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - C:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxbc_device - - C:\Windows\system32\lxbccoms.exe
O23 - Service: lxbl_device - - C:\Windows\system32\lxblcoms.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\Mabinogi\npkcmsvc.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Stardock WindowBlinds (WindowBlinds) - Stardock Corporation - C:\Program Files\Stardock\Object Desktop\WindowBlinds\vistasrv.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 11824 bytes

ken545

Post #5February 5, 2009, 10:28 PM UTC

Hello,

Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Go to your Control Panel and open up Programs and Features and uninstall Viewpoint, its Adware, installs without your knowledge or consent , uses system resources and is not needed.

The rest of your log looks fine, no malware that I can see.

Please run this free online virus scanner from ESET

Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is ticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

Steveo83

Post #6February 12, 2009, 3:50 AM UTC

One of my virus scanners must of picked it up because I get no more redirect and even "notepad" is back to English and I apologize for not posting this earlier Thank You for your help and informing me of view point. You all are doing wonderful work on this site and I'm extremely glad I came across it. V/r Steve

ken545

Post #7February 12, 2009, 9:31 AM UTC

Your welcome Steve,

Your Java is outdated and outdated versions let these type of infections onto your system, we need to update it.

Download the latest version Here save it, do not install it yet.

JRE 6 Update 12 <–This is what you need

Go to your Add Remove Programs in the Control Panel and uninstall any previous versions of Java
Reboot your computer
Install the latest version

You can verify the installation Here

Combofix <—Is not a general cleaning tool, just run it with supervision or you can bork your system

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
When shown the disclaimer, Select "2"

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
WhattheTech
TonyKlein CastleCops
Grinler BleepingComputer
GeeksTo Go
Dslreports

Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster and Spyware Guard, they will conflict with the TeaTimer in Spybot , you can still install Spybot Search and Destroy but do not enable the TeaTimer .

Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community

Spybot Search and Destroy 1.6
Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
IE-Spyad
IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
Firefox 3 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.

Safe Surfn
Ken

ken545

Post #8February 14, 2009, 9:37 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] sillydl dic and redirect

✨ Ask AI

Ask AI