Click.GiftLoad Removal Help!

[ken545]

Looks good, any issues ?

[soul4soul]

hey didnt mean to take so long to respond iv just be testing and using my PC making sure its all back to normal. It seems alright MS office will only open my old files in safe mode but besides that my system seems good. ran another scan with spybot and nothing showed up.

[ken545]

I missed what you have done, did you reinstall windows ?

Run another scan with ESET

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the icon on your desktop.
4. Check
5. Click the button.
6. Accept any security warnings from your browser.
7. Check
8. Make sure that the option "Remove found threats" is Unchecked
9. Push the Start button.
10. ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
11. When the scan completes, push
12. Push , and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
13. Push the button.
14. Push

Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.

[soul4soul]

no i didnt reinstall windows. just finished the scan nothing showed up.

[ken545]

Drag Combofix to the trash and lets download a fresh copy

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

[soul4soul]

here you go the new combofix log

ComboFix 11-04-29.02 - Lord 04/29/2011 17:30:00.3.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1319 [GMT -4:00]
Running from: c:\documents and settings\Lord\Desktop\Com-boFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((( Files Created from 2011-03-28 to 2011-04-29 )))))))))))))))))))))))))))))))
.
.
2011-04-29 15:28 . 2011-04-29 15:28 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8163993A-6F08-4E99-99F1-5CCE44669335}\MpKsl38d01e17.sys
2011-04-29 01:35 . 2011-04-18 13:15 7071056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8163993A-6F08-4E99-99F1-5CCE44669335}\mpengine.dll
2011-04-28 20:17 . 2011-04-28 20:17 -------- d-----w- C:\_OTL
2011-04-28 12:15 . 2011-04-28 12:15 -------- d-----w- c:\program files\ESET
2011-04-22 17:01 . 2011-04-22 17:01 -------- d-----w- c:\program files\CP-Autos
2011-04-21 21:44 . 2011-04-21 21:44 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2011-04-21 21:44 . 2011-04-21 21:44 -------- d-----w- c:\documents and settings\All Users\Microsoft
2011-04-21 21:39 . 2011-04-21 21:39 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-04-21 21:26 . 2011-04-21 21:26 -------- d-----r- C:\MSOCache
2011-04-21 16:27 . 2011-04-21 16:27 -------- d-----w- c:\documents and settings\Lord\Application Data\Malwarebytes
2011-04-21 16:27 . 2011-04-21 16:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-04-21 16:27 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-21 16:27 . 2011-04-21 16:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-21 16:27 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-21 16:04 . 2011-04-23 02:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-04-21 16:04 . 2011-04-21 16:05 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-04-21 03:43 . 2011-04-21 03:43 -------- d-----w- c:\documents and settings\Lord\Local Settings\Application Data\Microsoft Help
2011-04-20 18:04 . 2011-04-20 18:04 -------- d-----w- c:\windows\system32\wbem\Repository
2011-04-20 17:39 . 2011-04-21 14:01 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2011-04-20 16:00 . 2011-04-20 16:00 -------- d-----w- c:\windows\Sonic
2011-04-18 21:39 . 2011-04-18 21:39 -------- d-----w- c:\program files\Bonjour
2011-04-15 22:01 . 2009-07-23 03:08 50200 ----a-w- c:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2011-04-15 22:00 . 2009-07-23 03:08 79896 ----a-w- c:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2011-04-15 21:59 . 2011-04-15 21:59 -------- d-----w- c:\windows\system32\RsFx
2011-04-15 21:56 . 2011-04-15 21:59 -------- d-----w- c:\program files\Microsoft SQL Server
2011-04-15 19:18 . 2011-04-21 15:00 -------- d-----w- c:\documents and settings\Lord\Application Data\TweakNow RegCleaner 2011
2011-04-12 17:05 . 2011-04-12 17:05 -------- d-----w- c:\documents and settings\Lord\Local Settings\Application Data\Adobe
2011-04-12 16:31 . 2011-04-12 17:07 -------- d-----w- c:\program files\Common Files\Adobe
2011-04-10 03:34 . 2011-04-10 03:34 112832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCExpress\10.0\1033\ResourceCache.dll
2011-04-08 22:19 . 2011-04-08 22:19 -------- d-----w- c:\windows\symbols
2011-04-08 22:19 . 2011-04-08 22:19 -------- d-----w- c:\program files\Microsoft Help Viewer
2011-04-06 20:20 . 2011-04-06 20:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 20:20 . 2011-04-06 20:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-04-05 02:45 . 2011-04-05 02:45 -------- d-----w- c:\documents and settings\Lord\Local Settings\Application Data\PCTeX
2011-04-05 02:44 . 2011-04-05 02:44 -------- d-----w- c:\program files\PCTeX
2011-04-01 16:36 . 2011-04-01 16:36 -------- d-----w- c:\program files\Ghostgum
2011-04-01 16:32 . 2011-04-01 16:32 -------- d-----w- c:\program files\gs
2011-04-01 15:50 . 2011-04-12 16:38 -------- d-----w- c:\program files\Common Files\Adobe-BackupByPhotoshopCS5Portable
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-18 13:15 . 2010-08-05 13:06 7071056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-03-07 05:33 . 2004-08-10 18:02 692736 ------w- c:\windows\system32\inetcomm.dll
2011-03-04 06:45 . 2004-08-10 17:51 434176 ------w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-10 17:51 1857920 ------w- c:\windows\system32\win32k.sys
2011-02-17 13:51 . 2004-08-10 17:51 667136 ----a-w- c:\windows\system32\wininet.dll
2011-02-17 13:51 . 2004-08-10 17:51 61952 ------w- c:\windows\system32\tdc.ocx
2011-02-17 13:51 . 2004-08-10 17:51 81920 ------w- c:\windows\system32\ieencode.dll
2011-02-17 13:18 . 2004-08-10 17:51 455936 ------w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-10 17:51 357888 ------w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:37 . 2004-08-10 17:51 369664 ------w- c:\windows\system32\html.iec
2011-02-17 12:32 . 2009-04-16 19:04 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-10 17:50 290432 ----a-w- c:\windows\system32\atmfd.dll
2011-02-11 13:25 . 2004-08-10 18:01 229888 ------w- c:\windows\system32\fxscover.exe
2011-02-09 13:53 . 2004-08-10 17:51 270848 ------w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-10 17:51 186880 ------w- c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2004-08-10 17:51 978944 ------w- c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2004-08-10 17:51 974848 ------w- c:\windows\system32\mfc42u.dll
2011-02-02 22:11 . 2010-04-23 18:00 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-02-02 07:58 . 2004-08-10 18:01 2067456 ------w- c:\windows\system32\mstscax.dll
2011-04-29 00:40 . 2011-04-21 17:58 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-26_01.39.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-29 15:28 . 2011-04-29 15:28 16384 c:\windows\Temp\Perflib_Perfdata_8e4.dat
+ 2011-04-29 15:28 . 2011-04-29 15:28 16384 c:\windows\Temp\Perflib_Perfdata_31c.dat
+ 2010-06-04 15:07 . 2011-04-27 13:02 49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
- 2010-06-04 15:07 . 2011-02-15 21:00 49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2011-04-29 15:28 . 2011-04-29 15:28 331776 c:\windows\ERDNT\AutoBackup\4-29-2011\Users\00000002\UsrClass.dat
+ 2011-04-29 15:28 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\4-29-2011\ERDNT.EXE
+ 2011-04-28 12:11 . 2011-04-28 12:11 331776 c:\windows\ERDNT\AutoBackup\4-28-2011\Users\00000002\UsrClass.dat
+ 2011-04-28 12:11 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\4-28-2011\ERDNT.EXE
+ 2011-04-27 12:52 . 2011-04-27 12:52 331776 c:\windows\ERDNT\AutoBackup\4-27-2011\Users\00000002\UsrClass.dat
+ 2011-04-27 12:52 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\4-27-2011\ERDNT.EXE
+ 2011-04-26 17:45 . 2011-04-26 17:45 331776 c:\windows\ERDNT\AutoBackup\4-26-2011\Users\00000002\UsrClass.dat
+ 2011-04-26 17:45 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\4-26-2011\ERDNT.EXE
+ 2008-05-22 01:11 . 2011-04-18 19:46 42181064 c:\windows\system32\MRT.exe
+ 2011-04-27 13:02 . 2011-04-27 13:02 20314624 c:\windows\Installer\9c5ec.msp
+ 2011-04-29 15:28 . 2011-04-29 15:28 17956864 c:\windows\ERDNT\AutoBackup\4-29-2011\Users\00000001\ntuser.dat
+ 2011-04-28 12:11 . 2011-04-28 12:11 17956864 c:\windows\ERDNT\AutoBackup\4-28-2011\Users\00000001\ntuser.dat
+ 2011-04-27 12:52 . 2011-04-27 12:52 17948672 c:\windows\ERDNT\AutoBackup\4-27-2011\Users\00000001\ntuser.dat
+ 2011-04-26 17:45 . 2011-04-26 17:45 17948672 c:\windows\ERDNT\AutoBackup\4-26-2011\Users\00000001\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
.
c:\documents and settings\Lord\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 23:43 69632 ----a-w- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 18:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 15:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-06-10 12:28 13758464 ------w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-05-28 21:32 16132608 ----a-w- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-05-21 14:55 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\CinemaNow\\CinemaNow Media Manager\\CinemaNowShell.exe"=
"c:\\Program Files\\Roxio 2010\\Venue\\Venue.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\UniServer\\usr\\local\\mysql\\bin\\mysqld-opt.exe"=
"c:\\UniServer\\usr\\local\\apache2\\bin\\Apache.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [3/3/2009 5:47 PM 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [3/3/2009 5:47 PM 15856]
R1 c2scsi;c2scsi;c:\windows\system32\drivers\c2scsi.sys [6/29/2009 4:07 PM 244608]
R1 MpKsl38d01e17;MpKsl38d01e17;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8163993A-6F08-4E99-99F1-5CCE44669335}\MpKsl38d01e17.sys [4/29/2011 11:28 AM 28752]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [3/3/2009 5:47 PM 25584]
R2 CinemaNow Service;CinemaNow Service;c:\program files\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [6/23/2009 5:40 PM 127352]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S1 MpKsl2367828d;MpKsl2367828d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3D425190-4599-4DA0-8E2E-4EE5EC030BA3}\MpKsl2367828d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3D425190-4599-4DA0-8E2E-4EE5EC030BA3}\MpKsl2367828d.sys [?]
S1 MpKsla5c5fa87;MpKsla5c5fa87;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D169990F-BC33-4B6B-82B7-63FD0528929B}\MpKsla5c5fa87.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D169990F-BC33-4B6B-82B7-63FD0528929B}\MpKsla5c5fa87.sys [?]
S1 MpKslb0fe2e80;MpKslb0fe2e80;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E0E98532-B5D7-4909-99D2-D34B8A22CBB6}\MpKslb0fe2e80.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E0E98532-B5D7-4909-99D2-D34B8A22CBB6}\MpKslb0fe2e80.sys [?]
S1 MpKslbf8fe406;MpKslbf8fe406;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CA88CD10-8669-4943-BEFF-1157A933CA7C}\MpKslbf8fe406.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CA88CD10-8669-4943-BEFF-1157A933CA7C}\MpKslbf8fe406.sys [?]
S1 MpKslcefc53da;MpKslcefc53da;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8DC3CA08-2D57-46E5-8955-C1F1CB43D965}\MpKslcefc53da.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8DC3CA08-2D57-46E5-8955-C1F1CB43D965}\MpKslcefc53da.sys [?]
S1 MpKsldf37030e;MpKsldf37030e;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B6C30763-7F6C-421B-B864-DAA92D8CF64B}\MpKsldf37030e.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B6C30763-7F6C-421B-B864-DAA92D8CF64B}\MpKsldf37030e.sys [?]
S1 MpKsle49a001f;MpKsle49a001f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9EF5287B-A0B5-4213-8CCC-4D7DC910CA46}\MpKsle49a001f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9EF5287B-A0B5-4213-8CCC-4D7DC910CA46}\MpKsle49a001f.sys [?]
S2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe --> c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 KMService;KMService;c:\windows\system32\srvany.exe [9/27/2010 8:40 PM 8192]
S2 Roxio Upnp Server 11;Roxio Upnp Server 11;"c:\program files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUpnpService11.exe" --> c:\program files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUpnpService11.exe [?]
S2 RoxLiveShare11;LiveShare P2P Server 11;"c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe" --> c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe [?]
S2 RoxWatch11;Roxio Hard Drive Watcher 11;"c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe" --> c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe [?]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatch12.exe [7/24/2009 8:33 AM 219632]
S3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;"c:\program files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUPnPRenderer11.exe" --> c:\program files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUPnPRenderer11.exe [?]
S3 RoxMediaDB11;RoxMediaDB11;"c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe" --> c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [?]
S3 RoxMediaDB12;RoxMediaDB12;c:\program files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe [7/24/2009 8:33 AM 1116656]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/22/2009 11:08 PM 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [3/30/2009 3:09 AM 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [3/30/2009 3:23 AM 366936]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL38D01E17
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]
.
2011-04-29 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 17:26]
.
2011-04-29 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3908872593-1432629759-1091945336-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]
.
2011-04-29 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3908872593-1432629759-1091945336-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]
.
.
------- Supplementary Scan -------
.
uLocal Page =
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
Trusted Zone: cinemanow.com
Trusted Zone: qflix.com
Trusted Zone: roxio.com
Trusted Zone: sonic.com\redirect
Trusted Zone: sonic.com\redirect2
FF - ProfilePath - c:\documents and settings\Lord\Application Data\Mozilla\Firefox\Profiles\ns2o3ouy.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2438727&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 55273
FF - prefs.js: network.proxy.ssl - localhost
FF - prefs.js: network.proxy.ssl_port - 8888
FF - prefs.js: network.proxy.type - 0
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-29 17:37
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3908872593-1432629759-1091945336-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1616)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-04-29 17:40:01
ComboFix-quarantined-files.txt 2011-04-29 21:39
.
Pre-Run: 152,864,915,456 bytes free
Post-Run: 152,847,413,248 bytes free
.
- - End Of File - - 6973EBEAEAC07862105F2F9CF578D61C

[ken545]

Looking good, maybe that infection is gone, lets hope so. Lets do this, use your computer for a few days and then run OTL and post a new log and lets see if anything returned

[soul4soul]

thanks for the help so far. ill post back sunday morning that should give me enough time to test everything out and see how my system runs.

[ken545]

Ok, let me know how it goes