Spybot v Virtumonde

[L5Brassco]

Hello and Happy Easter
3-4 days ago Spybot found virtumonde on my computer.
I have tried deleting it with Spybot but it says I am not an administrator and
therefore cannot remove it.
Vista on the other hand says I am an administrator...
Spybot says there are 3 entries.
I have followed your HJT log instructions to produce the report below.
Hope you can help get rid of it.
Thanks
L5Brassco

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:04:11 PM, on 12/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Lexmark 2600 Series\lxdnmon.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [PS121v2] "C:\Program Files\NETGEAR\PS121v2\PS121v2.exe" /hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [A00F29D4B6E.exe] C:\Windows\TEMP\_A00F29D4B6E.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [*LogMeInRescue_3091639056] "C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe" -runonce -gui (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [A00F29D4B6E.exe] C:\Windows\TEMP\_A00F29D4B6E.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [*LogMeInRescue_3091639056] "C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe" -runonce -gui (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.terrace.qld.edu.au/dwa7W.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe
O23 - Service: lxdn_device - - C:\Windows\system32\lxdncoms.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: QuickBooks Database Manager Service (QBCFMonitorService) - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 10028 bytes

[Shaba]

Hi L5Brassco

Please post next spybot report :)

[L5Brassco]

Hi Shaba

I hope this is what you need

L5


--- Search result list ---
Virtumonde: [SBI $BA8653F6] Autorun settings (A00F29D4B6E.exe) (Registry value, nothing done)
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A00F29D4B6E.exe

Virtumonde: [SBI $BA8653F6] Program file (File, nothing done)
C:\Windows\TEMP\_A00F29D4B6E.exe
Properties.size=38400
Properties.md5=598B54DE0C3B10F1EB419D24F82F0C9F
Properties.filedate=1239194458
Properties.filedatetext=2009-04-08 22:40:57

Virtumonde: [SBI $BA8653F6] Autorun settings (A00F29D4B6E.exe) (Registry value, nothing done)
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A00F29D4B6E.exe


--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2008-01-28 SDDelFile.exe (1.0.2.4)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-02-14 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-01-26 advcheck.dll (1.6.2.15)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2008-09-15 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2008-10-22 Tools.dll (2.1.6.8)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-03-25 Includes\Adware.sbi (*)
2009-03-25 Includes\AdwareC.sbi (*)
2009-01-22 Includes\Cookies.sbi (*)
2009-03-31 Includes\Dialer.sbi (*)
2009-03-25 Includes\DialerC.sbi (*)
2009-01-22 Includes\HeavyDuty.sbi (*)
2009-02-11 Includes\Hijackers.sbi (*)
2009-03-03 Includes\HijackersC.sbi (*)
2009-03-17 Includes\Keyloggers.sbi (*)
2009-03-17 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2009-04-07 Includes\Malware.sbi (*)
2009-04-07 Includes\MalwareC.sbi (*)
2009-03-25 Includes\PUPS.sbi (*)
2009-03-31 Includes\PUPSC.sbi (*)
2009-01-22 Includes\Revision.sbi (*)
2009-01-14 Includes\Security.sbi (*)
2009-03-23 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-04-07 Includes\Spyware.sbi (*)
2009-04-07 Includes\SpywareC.sbi (*)
2009-04-07 Includes\Tracks.uti
2009-04-08 Includes\Trojans.sbi (*)
2009-04-07 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll



--- System information ---
Windows Vista (Build: 6001) Service Pack 1 (6.0.6001)


--- Startup entries list ---
Located: HK_LM:Run, 00TCrdMain
command: %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
file: C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
size: 534648
MD5: A84D5D03F00577E511A79C6AA4207C7E

Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
file: C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
size: 35696
MD5: 452FA961163EF4AEE4815796A13AB2CF

Located: HK_LM:Run, Camera Assistant Software
command: "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
file: C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
size: 405504
MD5: 1A9D08B7017D50CC1A1E285C25FC1BD4

Located: HK_LM:Run, FaxCenterServer
command: "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
file: C:\Program Files\Lexmark Fax Solutions\fm3032.exe
size: 320168
MD5: 2914DA72CC26F5A74F05EF75543507EE

Located: HK_LM:Run, HSON
command: %ProgramFiles%\TOSHIBA\TBS\HSON.exe
file: C:\Program Files\TOSHIBA\TBS\HSON.exe
size: 55416
MD5: 15058804D8A48C67C007DD1D797CC72A

Located: HK_LM:Run, HWSetup
command: C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
file: C:\Program Files\TOSHIBA\Utilities\HWSetup.exe
size: 413696
MD5: 910B7CFD6E23D6E0A7370525B5AE5B7A

Located: HK_LM:Run, IntelliPoint
command: "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
file: C:\Program Files\Microsoft IntelliPoint\ipoint.exe
size: 842584
MD5: 091BE9A85F5681632E3C035E4F559448

Located: HK_LM:Run, iTunesHelper
command: "C:\Program Files\iTunes\iTunesHelper.exe"
file: C:\Program Files\iTunes\iTunesHelper.exe
size: 342312
MD5: 6B0E8DEE62C0C9695C77F14482DDF178

Located: HK_LM:Run, KeNotify
command: C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
file: C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
size: 34352
MD5: AFD400AEBCAB252C99E60991FF00D9D2

Located: HK_LM:Run, lxdnamon
command: "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
file: C:\Program Files\Lexmark 2600 Series\lxdnamon.exe
size: 16040
MD5: 5EB280B62F4A93115BFD920B13D8C3F4

Located: HK_LM:Run, lxdnmon.exe
command: "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
file: C:\Program Files\Lexmark 2600 Series\lxdnmon.exe
size: 660136
MD5: 204D63206C093F04EDAC558A043EAE26

Located: HK_LM:Run, NDSTray.exe
command: NDSTray.exe
file: NDSTray.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
file: C:\Windows\system32\NvCpl.dll
size: 7766016
MD5: 514E7132C5107D2EAF6042F2194FE3FC

Located: HK_LM:Run, NvMediaCenter
command: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
file: C:\Windows\system32\NvMcTray.dll
size: 81920
MD5: 8B20D7F8E1A67DAB187A94BD3631DE1E

Located: HK_LM:Run, NvSvc
command: RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
file: C:\Windows\system32\nvsvc.dll
size: 90191
MD5: 8C0F0746321B19ED0518D79E3BDC7D18

Located: HK_LM:Run, PS121v2
command: "C:\Program Files\NETGEAR\PS121v2\PS121v2.exe" /hide
file: C:\Program Files\NETGEAR\PS121v2\PS121v2.exe
size: 724992
MD5: 494E79369BA0BBC9784453F70FD30871

Located: HK_LM:Run, PSQLLauncher
command: "C:\Program Files\Protector Suite QL\launcher.exe" /startup
file: C:\Program Files\Protector Suite QL\launcher.exe
size: 49416
MD5: 26D67D32D7AE105954C720EB3DFA955E

Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
file: C:\Program Files\QuickTime\QTTask.exe
size: 413696
MD5: 0AB3C83FCB8EF6F56E4FB22089F0D3B9

Located: HK_LM:Run, RtHDVCpl
command: RtHDVCpl.exe
file: C:\Windows\RtHDVCpl.exe
size: 4349952
MD5: 5AA97A008CD2509C73A45AF6ACE95BF4

Located: HK_LM:Run, SmoothView
command: %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
file: C:\Program Files\Toshiba\SmoothView\SmoothView.exe
size: 448632
MD5: 6A47ACA35FD9D51B795466423096468C

Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre6\bin\jusched.exe"
file: C:\Program Files\Java\jre6\bin\jusched.exe
size: 136600
MD5: B98FFA8288EFAABC436C30D198608345

Located: HK_LM:Run, SVPWUTIL
command: C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
file: C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe
size: 438272
MD5: 91B08AF242B44CD46F15C96AE3354145

Located: HK_LM:Run, SynTPEnh
command: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
file: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
size: 1316136
MD5: DE3BF6F6A72E8A26945E1B8EAFA5DC64

Located: HK_LM:Run, SynTPStart
command: C:\Program Files\Synaptics\SynTP\SynTPStart.exe
file: C:\Program Files\Synaptics\SynTP\SynTPStart.exe
size: 204800
MD5: 85948695C8A021EC8ACCBFFED8906D97

Located: HK_LM:Run, TPwrMain
command: %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
file: C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE
size: 411768
MD5: 424C1ADB34F9F1B2BC947D8BF0D5FBE3

Located: HK_LM:Run, Windows Defender
command: %ProgramFiles%\Windows Defender\MSASCui.exe -hide
file: C:\Program Files\Windows Defender\MSASCui.exe
size: 1008184
MD5: 0D392EDE3B97E0B3131B2F63EF1DB94E

Located: HK_CU:Run, A00F29D4B6E.exe
where: .DEFAULT...
command: C:\Windows\TEMP\_A00F29D4B6E.exe
file: C:\Windows\TEMP\_A00F29D4B6E.exe
size: 38400
MD5: 598B54DE0C3B10F1EB419D24F82F0C9F

Located: HK_CU:RunOnce, *LogMeInRescue_3091639056
where: .DEFAULT...
command: "C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe" -runonce -gui
file: C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_CU:Run, PeerGuardian
where: S-1-5-21-1882435643-3835081554-1223697280-1000...
command: C:\Program Files\PeerGuardian2\pg2.exe
file: C:\Program Files\PeerGuardian2\pg2.exe
size: 1457152
MD5: F4C73B6FDCF7DD8FA2802724867E63DB

Located: HK_CU:Run, Sidebar
where: S-1-5-21-1882435643-3835081554-1223697280-1000...
command: C:\Program Files\Windows Sidebar\sidebar.exe
file: C:\Program Files\Windows Sidebar\sidebar.exe
size: 1233920
MD5: FD278E51A7D6F52D22FCE6C67E037AD6

Located: HK_CU:Run, SpybotSD TeaTimer
where: S-1-5-21-1882435643-3835081554-1223697280-1000...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2260480
MD5: 390679F7A217A5E73D756276C40AE887

Located: HK_CU:Run, A00F29D4B6E.exe
where: S-1-5-18...
command: C:\Windows\TEMP\_A00F29D4B6E.exe
file: C:\Windows\TEMP\_A00F29D4B6E.exe
size: 38400
MD5: 598B54DE0C3B10F1EB419D24F82F0C9F

Located: HK_CU:RunOnce, *LogMeInRescue_3091639056
where: S-1-5-18...
command: "C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe" -runonce -gui
file: C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: Startup (common), Bluetooth Manager.lnk
where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
command: C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
file: C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
size: 2756608
MD5: 3950CB4708B36F3259B95DA72CB6B06B

Located: Startup (common), NkbMonitor.exe.lnk
where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
command: C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
file: C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
size: 118784
MD5: 78B597251F72E91C5E07FF6A2C1C2BCC

Located: Startup (common), QuickBooks Update Agent.lnk
where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
command: C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
file: C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
size: 969792
MD5: 209F25C40A4D55409F20AF63064C49C2

Located: WinLogon, psfus
command: C:\Windows\system32\psqlpwd.dll
file: C:\Windows\system32\psqlpwd.dll
size: 96008
MD5: D9A9F3D2F69A30705965FA32CF11C601



--- Browser helper object list ---
{6D53EC84-6AAE-4787-AEEE-F4628F01010C} (Symantec Intrusion Prevention)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: Symantec Intrusion Prevention
CLSID name: Symantec Intrusion Prevention
Path: C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\
Long name: IPSBHO.dll
Short name:
Date (created): 29/03/2009 10:44:38 AM
Date (last access): 29/03/2009 10:44:38 AM
Date (last write): 29/03/2009 10:44:38 AM
Filesize: 107896
Attributes: readonly archive
MD5: 8FBB36058FF5FD998E5D6592B98819D0
CRC32: 88EB4BD5
Version: 9.0.3.10



--- ActiveX list ---
{67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object)
DPF name:
CLSID name: DivXBrowserPlugin Object
Installer: C:\Windows\Downloaded Program Files\DivXPlugin.inf
Codebase: http://download.divx.com/player/DivXBrowserPlugin.cab
description:
classification: Legitimate
known filename: npdivx32.dll
info link:
info source: Safer Networking Ltd.
Path: C:\Program Files\DivX\DivX Web Player\
Long name: npdivx32.dll
Short name:
Date (created): 24/07/2008 2:47:22 AM
Date (last access): 3/09/2008 9:19:30 PM
Date (last write): 24/07/2008 2:47:22 AM
Filesize: 1335600
Attributes: archive
MD5: 56E18C09654020009012A53FD332D397
CRC32: 56B7CC16
Version: 1.4.0.233

{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_11
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2iexp.dll
Short name:
Date (created): 14/12/2008 12:10:44 AM
Date (last access): 14/12/2008 12:10:44 AM
Date (last write): 14/12/2008 12:10:44 AM
Filesize: 94208
Attributes: archive
MD5: 3DA696FCE470365F830726A5DB33733F
CRC32: F0FC81C2
Version: 6.0.110.3

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ()
DPF name:
CLSID name:
Installer: C:\Windows\Downloaded Program Files\erma.inf
Codebase: http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
description:
classification: Open for discussion
known filename:
info link:
info source: Safer Networking Ltd.

{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
description:
classification: Legitimate
known filename: npjpi160.dll
info link:
info source: Safer Networking Ltd.
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2iexp.dll
Short name:
Date (created): 14/12/2008 12:10:44 AM
Date (last access): 14/12/2008 12:10:44 AM
Date (last write): 14/12/2008 12:10:44 AM
Filesize: 94208
Attributes: archive
MD5: 3DA696FCE470365F830726A5DB33733F
CRC32: F0FC81C2
Version: 6.0.110.3

{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_03
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2iexp.dll
Short name:
Date (created): 14/12/2008 12:10:44 AM
Date (last access): 14/12/2008 12:10:44 AM
Date (last write): 14/12/2008 12:10:44 AM
Filesize: 94208
Attributes: archive
MD5: 3DA696FCE470365F830726A5DB33733F
CRC32: F0FC81C2
Version: 6.0.110.3

{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_05
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2iexp.dll
Short name:
Date (created): 14/12/2008 12:10:44 AM
Date (last access): 14/12/2008 12:10:44 AM
Date (last write): 14/12/2008 12:10:44 AM
Filesize: 94208
Attributes: archive
MD5: 3DA696FCE470365F830726A5DB33733F
CRC32: F0FC81C2
Version: 6.0.110.3

{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_07
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2iexp.dll
Short name:
Date (created): 14/12/2008 12:10:44 AM
Date (last access): 14/12/2008 12:10:44 AM
Date (last write): 14/12/2008 12:10:44 AM
Filesize: 94208
Attributes: archive
MD5: 3DA696FCE470365F830726A5DB33733F
CRC32: F0FC81C2
Version: 6.0.110.3

{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_11
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2iexp.dll
Short name:
Date (created): 14/12/2008 12:10:44 AM
Date (last access): 14/12/2008 12:10:44 AM
Date (last write): 14/12/2008 12:10:44 AM
Filesize: 94208
Attributes: archive
MD5: 3DA696FCE470365F830726A5DB33733F
CRC32: F0FC81C2
Version: 6.0.110.3

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_11
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
description:
classification: Legitimate
known filename: npjpi150_06.dll
info link:
info source: Safer Networking Ltd.
Path: C:\Program Files\Java\jre6\bin\
Long name: npjpi160_11.dll
Short name: NPJPI1~1.DLL
Date (created): 14/12/2008 12:10:44 AM
Date (last access): 14/12/2008 12:10:44 AM
Date (last write): 14/12/2008 12:10:44 AM
Filesize: 132504
Attributes: archive
MD5: D400116F6776ACB6EDB6B1F5EEB9F92D
CRC32: CECB5751
Version: 6.0.110.3

{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
DPF name:
CLSID name: Shockwave Flash Object
Installer: C:\Windows\Downloaded Program Files\swflash.inf
Codebase: http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
description: Macromedia Shockwave Flash Player
classification: Legitimate
known filename:
info link:
info source: Patrick M. Kolla
Path: C:\Windows\system32\Macromed\Flash\
Long name: Flash10b.ocx
Short name:
Date (created): 3/02/2009 12:07:18 PM
Date (last access): 19/03/2009 3:45:16 PM
Date (last write): 3/02/2009 12:07:18 PM
Filesize: 3866528
Attributes: readonly archive
MD5: 8AFC17155ED5AB60B7C52D7F553D579C
CRC32: 0FBC13F3
Version: 10.0.22.87

{E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control)
DPF name:
CLSID name: Domino Web Access 7 Control
Installer: C:\Windows\Downloaded Program Files\dwa7W.inf
Codebase: https://webmail.terrace.qld.edu.au/dwa7W.cab
description:
classification: Open for discussion
known filename: dwa7W.dll
info link:
info source: Safer Networking Ltd.
Path: C:\Windows\Downloaded Program Files\
Long name: dwa7W.dll
Short name:
Date (created): 25/06/2007 1:30:10 PM
Date (last access): 25/06/2007 1:30:10 PM
Date (last write): 25/06/2007 1:30:10 PM
Filesize: 325120
Attributes: archive
MD5: C7E0A3413B339663255B2C8AB98BAA03
CRC32: D96C78D2
Version: 7.0.37.0



--- Process list ---
PID: 4024 (1448) C:\Windows\system32\taskeng.exe
size: 169472
MD5: 5F109032CE46B7184ED9E50F9FE8489E
PID: 1788 (1420) C:\Windows\system32\Dwm.exe
size: 81920
MD5: 59903071D7ACE6A02093C47E9E38AF97
PID: 1144 (2712) C:\Windows\Explorer.EXE
size: 2927104
MD5: 4F554999D7D5F05DAAEBBA7B5BA1089D
PID: 3944 (1144) C:\Program Files\Windows Defender\MSASCui.exe
size: 1008184
MD5: 0D392EDE3B97E0B3131B2F63EF1DB94E
PID: 3952 (1144) C:\Windows\RtHDVCpl.exe
size: 4349952
MD5: 5AA97A008CD2509C73A45AF6ACE95BF4
PID: 3992 (1144) C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
size: 1372160
MD5: 93225E495B790822039F561839529B0B
PID: 1492 (1144) C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
size: 405504
MD5: 1A9D08B7017D50CC1A1E285C25FC1BD4
PID: 2412 (1144) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
size: 411768
MD5: 424C1ADB34F9F1B2BC947D8BF0D5FBE3
PID: 2896 (1144) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
size: 448632
MD5: 6A47ACA35FD9D51B795466423096468C
PID: 1304 (1144) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
size: 534648
MD5: A84D5D03F00577E511A79C6AA4207C7E
PID: 4112 (1144) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
size: 1316136
MD5: DE3BF6F6A72E8A26945E1B8EAFA5DC64
PID: 4120 (1144) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
size: 842584
MD5: 091BE9A85F5681632E3C035E4F559448
PID: 4180 (1104) C:\Windows\system32\wbem\unsecapp.exe
size: 37888
MD5: 25873356E52849C3F5B3F1B02317E8C8
PID: 4280 (1144) C:\Program Files\Java\jre6\bin\jusched.exe
size: 136600
MD5: B98FFA8288EFAABC436C30D198608345
PID: 4288 (1144) C:\Program Files\Lexmark 2600 Series\lxdnmon.exe
size: 660136
MD5: 204D63206C093F04EDAC558A043EAE26
PID: 4464 (1144) C:\Program Files\iTunes\iTunesHelper.exe
size: 342312
MD5: 6B0E8DEE62C0C9695C77F14482DDF178
PID: 4472 (1144) C:\Program Files\Windows Sidebar\sidebar.exe
size: 1233920
MD5: FD278E51A7D6F52D22FCE6C67E037AD6
PID: 4484 (1144) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2260480
MD5: 390679F7A217A5E73D756276C40AE887
PID: 4532 (3992) C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
size: 405504
MD5: AB7EB5E27E9F18698B9B6CB6F56E6745
PID: 4544 (1144) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
size: 2756608
MD5: 3950CB4708B36F3259B95DA72CB6B06B
PID: 4632 (4296) C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
size: 25256
MD5: B411215104EC77C4DC68ADD130875589
PID: 4652 (4272) C:\Program Files\Protector Suite QL\psqltray.exe
size: 54024
MD5: 0CFA86AC81F5550F5719B03D33D89E0A
PID: 4668 (4312) C:\Windows\System32\rundll32.exe
size: 44544
MD5: 4B555106290BD117334E9A08761C035A
PID: 4676 (4112) C:\Program Files\Synaptics\SynTP\SynToshiba.exe
size: 200704
MD5: 4402D4585AE9D7DF24CEBE3853489791
PID: 4752 (1492) C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
size: 4411392
MD5: 27FDCD6A199E028CB04DEAD27E45C4B3
PID: 5348 (4472) C:\Program Files\Windows Sidebar\sidebar.exe
size: 1233920
MD5: FD278E51A7D6F52D22FCE6C67E037AD6
PID: 6092 (4544) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
size: 278528
MD5: A7B50F4EE28D7AA1F8AC981C2F2980B1
PID: 2256 (4544) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
size: 69632
MD5: 2C92B17E820094F37037B6CE114BEB69
PID: 5512 (4544) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
size: 270336
MD5: 8C35DB52F07A78E8DF230D76F141FD29
PID: 5848 (4544) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
size: 278528
MD5: 2B380BC3936DB6C2FAABF00C7678BB12
PID: 4304 (4544) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
size: 307200
MD5: 1BEEBFE3E8C97FCA56864E590E20B45F
PID: 5584 (4304) C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
size: 2561352
MD5: 4B2584C4D0D2DACA384FFAE7A8A20570
PID: 5844 (1144) C:\Program Files\Internet Explorer\iexplore.exe
size: 638816
MD5: B60DDDD2D63CE41CB8C487FCFBB6419E
PID: 3700 (5844) C:\Program Files\Internet Explorer\iexplore.exe
size: 638816
MD5: B60DDDD2D63CE41CB8C487FCFBB6419E
PID: 4208 (1144) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
size: 5365592
MD5: 0477C2F9171599CA5BC3307FDFBA8D89
PID: 844 (5844) C:\Program Files\Internet Explorer\iexplore.exe
size: 638816
MD5: B60DDDD2D63CE41CB8C487FCFBB6419E
PID: 4956 (4208) C:\Windows\hh.exe
size: 14848
MD5: 7C06CED2F7B9272A126D53A2A9F52AC0
PID: 5956 (1104) C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
size: 240544
MD5: 5F7FC2C4D371AC8FDE09D57F7C904BA9
PID: 0 ( 0) [System Process]
PID: 4 ( 0) System
PID: 512 ( 4) smss.exe
size: 64000
PID: 692 ( 680) csrss.exe
size: 6144
PID: 828 ( 680) wininit.exe
size: 96768
PID: 840 ( 820) csrss.exe
size: 6144
PID: 872 ( 828) services.exe
size: 279040
PID: 888 ( 828) lsass.exe
size: 9728
PID: 896 ( 828) lsm.exe
size: 229888
PID: 972 ( 820) winlogon.exe
size: 314880
PID: 1104 ( 872) svchost.exe
size: 21504
PID: 1160 ( 872) PresentationFontCache.exe
PID: 1204 ( 872) svchost.exe
size: 21504
PID: 1252 ( 872) svchost.exe
size: 21504
PID: 1344 ( 872) svchost.exe
size: 21504
PID: 1420 ( 872) svchost.exe
size: 21504
PID: 1448 ( 872) svchost.exe
size: 21504
PID: 1516 (1344) audiodg.exe
size: 88064
PID: 1540 ( 872) svchost.exe
size: 21504
PID: 1572 ( 872) SLsvc.exe
size: 2623488
PID: 1616 ( 872) svchost.exe
size: 21504
PID: 1796 ( 872) svchost.exe
size: 21504
PID: 1992 ( 872) spoolsv.exe
size: 125952
PID: 2020 ( 872) svchost.exe
size: 21504
PID: 264 (1292) upeksvr.exe
PID: 2092 ( 872) agrsmsvc.exe
size: 9216
PID: 2124 ( 872) AppleMobileDeviceService.exe
PID: 2136 ( 872) BcmSqlStartupSvc.exe
PID: 2164 ( 872) mDNSResponder.exe
PID: 2176 ( 872) CFSvcs.exe
PID: 2248 ( 872) lxdncoms.exe
size: 594600
PID: 2280 ( 872) ccSvcHst.exe
PID: 2448 ( 872) svchost.exe
size: 21504
PID: 2520 ( 872) QBCFMonitorService.exe
PID: 2668 ( 872) sqlbrowser.exe
PID: 2696 ( 872) sqlwriter.exe
PID: 2716 ( 872) svchost.exe
size: 21504
PID: 2764 ( 872) TODDSrv.exe
size: 114688
PID: 2784 ( 872) TosCoSrv.exe
PID: 2820 ( 872) TosBtSrv.exe
PID: 2876 ( 872) ULCDRSvr.exe
PID: 2904 ( 872) svchost.exe
size: 21504
PID: 2956 ( 872) SearchIndexer.exe
size: 439808
PID: 3236 (1448) taskeng.exe
size: 169472
PID: 3912 (2280) ccSvcHst.exe
PID: 4016 (1104) WmiPrvSE.exe
PID: 3396 (1144) KeNotify.exe
PID: 3392 ( 872) wmpnetwk.exe
PID: 5872 ( 872) iPodService.exe
PID: 5140 (4112) SynTPHelper.exe


--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 14/04/2009 8:57:52 AM

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\Windows\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://go.microsoft.com/fwlink/?LinkId=54896
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.google.com.au/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
C:\Windows\System32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://go.microsoft.com/fwlink/?LinkId=54896
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://go.microsoft.com/fwlink/?LinkId=69157
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://go.microsoft.com/fwlink/?LinkId=69157
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://go.microsoft.com/fwlink/?LinkId=54896


--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 1: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 2: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 3: MSAFD Tcpip [TCP/IPv6]
GUID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IPv6 protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 4: MSAFD Tcpip [UDP/IPv6]
GUID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IPv6 protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 5: MSAFD Tcpip [RAW/IPv6]
GUID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IPv6 protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 6: RSVP TCPv6 Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider

Protocol 7: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider

Protocol 8: RSVP UDPv6 Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider

Protocol 9: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider

Protocol 10: MSAFD NetBIOS [\Device\NetBT_Tcpip_{B94798FB-B12F-4327-B2D7-2EA7BFF23362}] SEQPACKET 7
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 11: MSAFD NetBIOS [\Device\NetBT_Tcpip_{B94798FB-B12F-4327-B2D7-2EA7BFF23362}] DATAGRAM 7
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{6D16DDB7-F3D4-4503-A0CC-3154D7C59C3E}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{6D16DDB7-F3D4-4503-A0CC-3154D7C59C3E}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{1AE7ACBF-376F-496D-B86F-D1FA21E924FD}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 15: MSAFD NetBIOS [\Device\NetBT_Tcpip_{1AE7ACBF-376F-496D-B86F-D1FA21E924FD}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{306F24F5-1984-4037-AECE-AE4D10AFDB22}] SEQPACKET 10
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 17: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{306F24F5-1984-4037-AECE-AE4D10AFDB22}] DATAGRAM 10
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 18: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{A04013FA-576C-4AFA-B1D1-3D5C0F9B8E8E}] SEQPACKET 5
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 19: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{A04013FA-576C-4AFA-B1D1-3D5C0F9B8E8E}] DATAGRAM 5
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 20: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{A6AAF395-29BA-41D2-8482-DC600CEE6681}] SEQPACKET 9
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 21: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{A6AAF395-29BA-41D2-8482-DC600CEE6681}] DATAGRAM 9
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 22: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{B94798FB-B12F-4327-B2D7-2EA7BFF23362}] SEQPACKET 8
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 23: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{B94798FB-B12F-4327-B2D7-2EA7BFF23362}] DATAGRAM 8
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 24: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{E14AF730-DA35-4B6D-BFB9-3C12359C29B9}] SEQPACKET 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 25: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{E14AF730-DA35-4B6D-BFB9-3C12359C29B9}] DATAGRAM 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 26: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{6D16DDB7-F3D4-4503-A0CC-3154D7C59C3E}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 27: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{6D16DDB7-F3D4-4503-A0CC-3154D7C59C3E}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 28: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{1AE7ACBF-376F-496D-B86F-D1FA21E924FD}] SEQPACKET 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 29: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{1AE7ACBF-376F-496D-B86F-D1FA21E924FD}] DATAGRAM 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Namespace Provider 0: Network Location Awareness Legacy (NLAv1) Namespace
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename:
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace

Namespace Provider 1: E-mail Naming Shim Provider
GUID: {964ACBA2-B2BC-40EB-8C6A-A6DB40161CAE}
Filename:

Namespace Provider 2: PNRP Cloud Namespace Provider
GUID: {03FE89CE-766D-4976-B9C1-BB9BC42C7B4D}
Filename:

Namespace Provider 3: PNRP Name Namespace Provider
GUID: {03FE89CD-766D-4976-B9C1-BB9BC42C7B4D}
Filename:

Namespace Provider 4: Tcpip
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename:
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP

Namespace Provider 5: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS

Namespace Provider 6: mdnsNSP
GUID: {B600E6E9-553B-4A19-8696-335E5C896153}
Filename: C:\Program Files\Bonjour\mdnsNSP.dll
Description: Apple Rendezvous protocol
DB filename: %ProgramFiles%\Rendezvous\bin\mdnsNSP.dll
DB protocol: mdnsNSP

[Shaba]

Yes it is :)

Download random''s system information tool (RSIT) by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

[L5Brassco]

Hi Shaba
I was called away from my computer unexpectedly.
The logs are large so will post them seperatly
Kiitos
L5
info.txt logfile of random's system information tool 1.06 2009-04-18 14:24:35

======Uninstall list======

-->"C:\Program Files\InstallShield Installation Information\{A644254B-92F6-4970-8635-AB0775371E72}\setup.exe" --u:{A644254B-92F6-4970-8635-AB0775371E72}
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
-->MsiExec.exe /I{71EEA108-09C9-4D81-8FA2-D48C70681242}
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{622E6F16-0904-49B6-BBE1-4CC836314CCF}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{697AFC77-F318-4CD4-BF16-F50F4C1072DA}\setup.exe" -l0x9
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
ABBYY FineReader 6.0 Sprint-->MsiExec.exe /X{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Acrobat.com-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Acrobat 5.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft Panorama Maker 3-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A5F68DC8-0278-4AD8-B413-861509B5F25B}\Setup.exe" -l0x9
ArcSoft PhotoBase-->C:\Windows\IsUninst.exe -f"C:\Program Files\ArcSoft\PhotoBase\Uninst.isu"
ArcSoft PhotoStudio 2000-->C:\Windows\IsUninst.exe -f"C:\Program Files\ArcSoft\PhotoStudio 2000\Uninst.isu"
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Bluetooth Stack for Windows by Toshiba-->MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Business Contact Manager for Outlook 2007 SP1-->"C:\Program Files\Microsoft Small Business\Business Contact Manager\SetupBootstrap\Setup.exe" /remove {B32C4059-6E7A-41EF-AD20-56DF1872B923}
Business Contact Manager for Outlook 2007 SP1-->MsiExec.exe /X{B32C4059-6E7A-41EF-AD20-56DF1872B923}
Camera Assistant Software for Toshiba-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{37C866E4-AA67-4725-9E95-A39968DD7960}\setup.exe" -l0x9
Canon ScanGear Toolbox 3.0-->C:\Windows\IsUninst.exe -f"C:\Program Files\Canon\ScanGear Toolbox Ver3\Uninst.isu" -c"C:\Program Files\Canon\ScanGear Toolbox Ver3\uninst.dll"
CanoScan Toolbox Ver4.1-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BCE46757-7674-4416-BEDB-68205A60409E}\Setup.exe" -l0x9 anything
CD/DVD Drive Acoustic Silencer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\setup.exe" -l0x9
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD MovieFactory for TOSHIBA-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}\setup.exe" -l0x9
Fuji Xerox DocuPrint 203A-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B57EB0E5-13E3-475C-A4DB-94DEEC0E83A4}\SETUP.exe" -l0x9 -removeonly /uninst
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
Lexmark 2600 Series-->C:\Program Files\Lexmark 2600 Series\Install\x86\Uninst.exe
Lexmark Fax Solutions-->C:\Program Files\Lexmark Fax Solutions\Install\x86\Uninst.exe /R:faxunst
Lexmark Tools for Office-->regsvr32.exe /s /u "C:\Program Files\Lexmark Tools for Office\CustomOfficeRibbon.dll"
Magic DVD Ripper V5.1.1-->"C:\Program Files\MagicDVDRipper\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A40409-6000-11D3-8CFE-0150048383C9}
Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROR /dll OSETUP.DLL
Microsoft Office Professional 2007-->MsiExec.exe /X{91120000-0014-0000-0000-0000000FF1CE}
Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)-->MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}
Microsoft SQL Server 2005-->"c:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
Microsoft SQL Server Native Client-->MsiExec.exe /I{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}
Microsoft SQL Server Setup Support Files (English)-->MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
Microsoft SQL Server VSS Writer-->MsiExec.exe /I{56B4002F-671C-49F4-984C-C760FE3806B5}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MYOB BusinessBasics v1-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{A06176AF-7494-4B29-BE74-F01323AD3233}
NETGEAR Print Server Utility-->C:\Windows\IsUninst.exe -f"C:\Program Files\NETGEAR Print Server Utility\Uninst.isu"
NETGEAR PS121v2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{451B332F-E2A7-4F69-B1ED-99C99BDB9C2F}\setup.exe" -l0x9 -removeonly
Norton AntiVirus-->C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV\562C4DD5\16.5.0.134\InstStub.exe /X
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
OGA Notifier 1.7.0105.35.0-->MsiExec.exe /I{B148AB4B-C8FA-474B-B981-F2943C5B5BCD}
OmniPage Pro 9.0-->C:\Program Files\Caere\OmniPagePro90\Deinstall.exe "C:\Program Files\Caere\OmniPagePro90\uninstall.exe -f'C:\Program Files\Caere\OmniPagePro90\DeIsL1.isu'"
PC Connectivity Solution-->MsiExec.exe /I{6094AB91-4CC8-498E-9DFF-134CC0B159DE}
PeerGuardian 2.0-->"C:\Program Files\PeerGuardian2\unins000.exe"
PictureProject-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FF3999BE-1A7B-4738-88AA-97BF14094A4A}\Setup.exe" -l0x9 UNINSTALL
Protector Suite QL 5.8-->MsiExec.exe /I{2CD82D77-8D1E-44FC-9A90-BBA95AC8D6B7}
QuickBooks Accounting 2008-09-->msiexec.exe /I {71EEA108-09C9-4D81-8FA2-D48C70681242} UNIQUE_NAME="lite" QBFULLNAME="QuickBooks Accounting 2008-09" ADDREMOVE=1
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Scan Manager 5.2-->MsiExec.exe /I{E0A1559B-9886-11D4-8D06-0050DA284A39}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Security Update for Visio 2007 (KB947590)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Security Update for Visio 2007 (KB947590)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Security Update for Windows Media Encoder (KB954156)-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} MSIPATCHREMOVE={E836F1B7-43FB-46B0-A0D9-E4D2A5951659} /qb
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SupportSoft Assisted Service-->MsiExec.exe /I{5A3F6A80-7913-475E-8B96-477A952CFA43}
Symantec Technical Support Advanced Chat Controls-->MsiExec.exe /X{48FF6DE6-0619-4562-B4B1-21F161FE0DE0}
Symantec Technical Support Web Controls-->MsiExec.exe /X{20C53FA2-4307-4671-A93F-9463B29DFCF1}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Texas Instruments PCIxx21/x515/xx12 drivers.-->C:\Program Files\InstallShield Installation Information\{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}\setup.exe -runfromtemp -l0x0409
TOSHIBA Assist-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\setup.exe" -l0x9
TOSHIBA ConfigFree-->C:\Program Files\InstallShield Installation Information\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}\setup.exe -runfromtemp -l0x0009uninstall -removeonly
TOSHIBA Disc Creator-->MsiExec.exe /X{5DA0E02F-970B-424B-BF41-513A5018E4C0}
TOSHIBA Extended Tiles for Windows Mobility Center-->C:\Program Files\InstallShield Installation Information\{617C36FD-0CBE-4600-84B2-441CEB12FADF}\setup.exe -runfromtemp -l0x0409
TOSHIBA Flash Cards Support Utility-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{620BBA5E-F848-4D56-8BDA-584E44584C5E}
TOSHIBA Hardware Setup-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{5279374D-87FE-4879-9385-F17278EBB9D3} /l1033
TOSHIBA Recovery Disc Creator-->MsiExec.exe /X{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}
TOSHIBA SD Memory Utilities-->MsiExec.exe /X{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}
TOSHIBA Software Modem-->Tosmreg -U
TOSHIBA Speech System Applications-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EE033C1F-443E-41EC-A0E2-559B539A4E4D}\Setup.exe" -l0x9
TOSHIBA Speech System SR Engine(U.S.) Version1.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{008D69EB-70FF-46AB-9C75-924620DF191A}\Setup.exe" -l0x9 UNINSTALL
TOSHIBA Speech System TTS Engine(U.S.) Version1.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3FBF6F99-8EC6-41B4-8527-0A32241B5496}\Setup.exe" -l0x9
TOSHIBA Supervisor Password-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE} /l1033
TOSHIBA Value Added Package-->C:\Program Files\InstallShield Installation Information\{FEDD27A0-B306-45EF-BF58-B527406B42C8}\setup.exe -runfromtemp -l0x0409
TouchChip USB Driver 2.9-->MsiExec.exe /I{7CC71C42-99C1-4A28-B20B-FC47516975FD}
Update for Microsoft Office 2007 Help for Common Features (KB957244)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {C8C72583-C907-4D20-8973-C3858D96BD9E}
Update for Microsoft Office 2007 Help for Common Features (KB957244)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {C8C72583-C907-4D20-8973-C3858D96BD9E}
Update for Microsoft Office Access 2007 Help (KB957241)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {D670F9B9-3E84-47B5-8A4A-618B65DB1593}
Update for Microsoft Office Access 2007 Help (KB957241)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {D670F9B9-3E84-47B5-8A4A-618B65DB1593}
Update for Microsoft Office Excel 2007 Help (KB957242)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {51864046-74C8-487B-97CD-6167A4B1DB56}
Update for Microsoft Office Excel 2007 Help (KB957242)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {51864046-74C8-487B-97CD-6167A4B1DB56}
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {6F0E4983-E419-4591-B7DD-EFB0073D3E47}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {6F0E4983-E419-4591-B7DD-EFB0073D3E47}
Update for Microsoft Office PowerPoint 2007 Help (KB957247)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {B20E2C59-EEC5-4102-9E50-5DBB2093C37D}
Update for Microsoft Office PowerPoint 2007 Help (KB957247)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {B20E2C59-EEC5-4102-9E50-5DBB2093C37D}
Update for Microsoft Office Publisher 2007 Help (KB957249)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4E140A5A-4A90-404A-B955-10C2D98CD3EE}
Update for Microsoft Office Publisher 2007 Help (KB957249)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4E140A5A-4A90-404A-B955-10C2D98CD3EE}
Update for Microsoft Office Word 2007 Help (KB957252)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {54DF3345-0720-4224-9740-C7E00303F565}
Update for Microsoft Office Word 2007 Help (KB957252)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {54DF3345-0720-4224-9740-C7E00303F565}
Update for Microsoft Script Editor Help (KB957253)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {F21BF703-548C-47B2-B92A-6876E9566C42}
Update for Microsoft Script Editor Help (KB957253)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {F21BF703-548C-47B2-B92A-6876E9566C42}
Update for Office 2007 (KB946691)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Office 2007 (KB946691)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb962871)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {297857BF-4011-449B-BD74-DB64D182821C}
Update for Outlook 2007 Junk Email Filter (kb962871)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {297857BF-4011-449B-BD74-DB64D182821C}
Windows Live Messenger-->MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Live Sign-in Assistant-->MsiExec.exe /I{9422C8EA-B0C6-4197-B8FC-DC797658CA00}
Windows Media Encoder 9 Series-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
WinDVD for TOSHIBA-->C:\Program Files\InstallShield Installation Information\{20471B27-D702-4FE8-8DEC-0702CC8C0A85}\setup.exe -runfromtemp -l0x0409
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Security center information======

AS: Spybot - Search and Destroy (disabled)
AS: Windows Defender

======System event log======

Computer Name: Carl-PC
Event Code: 4
Message: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable.
Record Number: 230382
Source Name: Microsoft-Windows-SpoolerWin32SPL
Time Written: 20090327232049.000000-000
Event Type: Warning
User:

Computer Name: Carl-PC
Event Code: 4
Message: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable.
Record Number: 230383
Source Name: Microsoft-Windows-SpoolerWin32SPL
Time Written: 20090327232049.000000-000
Event Type: Warning
User:

Computer Name: Carl-PC
Event Code: 7030
Message: The Symantec RemoteAssist service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
Record Number: 230452
Source Name: Service Control Manager
Time Written: 20090328022945.000000-000
Event Type: Error
User:

Computer Name: Carl-PC
Event Code: 6008
Message: The previous system shutdown at 2:09:37 PM on 28/03/2009 was unexpected.
Record Number: 230469
Source Name: EventLog
Time Written: 20090328041326.000000-000
Event Type: Error
User:

Computer Name: CARL-PC
Event Code: 263
Message: The service 'TabletInputService' may not have unregistered for device event notifications before it was stopped.
Record Number: 230476
Source Name: PlugPlayManager
Time Written: 20090328041327.000000-000
Event Type: Warning
User:

=====Application event log=====

Computer Name: Carl-PC
Event Code: 3036
Message: The content source <mapi://{s-1-5-21-1882435643-3835081554-1223697280-1000}/> cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
A server error occurred. Check that the server is available. (0x80041206)

Record Number: 101044
Source Name: Microsoft-Windows-Search
Time Written: 20090413222045.000000-000
Event Type: Warning
User:

Computer Name: Carl-PC
Event Code: 1000
Message: Faulting application iexplore.exe, version 8.0.6001.18702, time stamp 0x49b3ad2e, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000374, fault offset 0x000b015d, process id 0x1464, application start time 0x01c9bc85d1c09a75.
Record Number: 101045
Source Name: Application Error
Time Written: 20090413223836.000000-000
Event Type: Error
User:

Computer Name: Carl-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-1882435643-3835081554-1223697280-1000:
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1882435643-3835081554-1223697280-1000

Record Number: 101059
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090414031120.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Carl-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-1882435643-3835081554-1223697280-1000_Classes:
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1882435643-3835081554-1223697280-1000_CLASSES

Record Number: 101060
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090414031121.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Carl-PC
Event Code: 3
Message: The configuration of the AdminConnection\TCP protocol in the SQL instance MSSMLBIZ is not valid.
Record Number: 101076
Source Name: SQLBrowser
Time Written: 20090418035554.000000-000
Event Type: Warning
User:

=====Security event log=====

Computer Name: Carl-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: CARL-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x328
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 84160
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090410203932.542605-000
Event Type: Audit Success
User:

Computer Name: Carl-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 84161
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090410203932.542605-000
Event Type: Audit Success
User:

Computer Name: Carl-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: CARL-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x328
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 84162
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090410203933.135409-000
Event Type: Audit Success
User:

Computer Name: Carl-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: CARL-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x328
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 84163
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090410203933.135409-000
Event Type: Audit Success
User:

Computer Name: Carl-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 84164
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090410203933.135409-000
Event Type: Audit Success
User:

======Environment variables======

"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"ComSpec"=%SystemRoot%\system32\cmd.exe
"configsetroot"=%SystemRoot%\ConfigSetRoot
"FP_NO_HOST_CHECK"=NO
"NUMBER_OF_PROCESSORS"=2
"OS"=Windows_NT
"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG;c:\Program Files\Microsoft SQL Server\90\Tools\binn\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_LEVEL"=6
"PROCESSOR_REVISION"=0f06
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%

-----------------EOF-----------------

[L5Brassco]

Here is the log txt
Logfile of random's system information tool 1.06 (written by random/random)
Run by Carl at 2009-04-18 14:23:42
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 126 GB (68%) free of 184 GB
Total RAM: 2045 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:24:30 PM, on 18/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Lexmark 2600 Series\lxdnmon.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\RCIS\RCIS\cisapp\Cis.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Carl\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Carl.exe
C:\Windows\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [PS121v2] "C:\Program Files\NETGEAR\PS121v2\PS121v2.exe" /hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [A00F29D4B6E.exe] C:\Windows\TEMP\_A00F29D4B6E.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [*LogMeInRescue_3091639056] "C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe" -runonce -gui (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [A00F29D4B6E.exe] C:\Windows\TEMP\_A00F29D4B6E.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [*LogMeInRescue_3091639056] "C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe" -runonce -gui (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.terrace.qld.edu.au/dwa7W.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe
O23 - Service: lxdn_device - - C:\Windows\system32\lxdncoms.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: QuickBooks Database Manager Service (QBCFMonitorService) - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9992 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{339872FA-415A-41ED-B597-6C343709253E}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL [2009-03-29 107896]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-01-18 4349952]
"NDSTray.exe"=NDSTray.exe []
"KeNotify"=C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [2006-11-07 34352]
"HWSetup"=C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [2006-11-02 413696]
"SVPWUTIL"=C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe [2006-11-02 438272]
"Camera Assistant Software"=C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [2007-02-14 405504]
"TPwrMain"=C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [2006-12-20 411768]
"HSON"=C:\Program Files\TOSHIBA\TBS\HSON.exe [2006-12-08 55416]
"SmoothView"=C:\Program Files\Toshiba\SmoothView\SmoothView.exe [2007-01-19 448632]
"00TCrdMain"=C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [2007-01-18 534648]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-06-20 1316136]
"IntelliPoint"=C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2006-11-22 842584]
"PS121v2"=C:\Program Files\NETGEAR\PS121v2\PS121v2.exe [2006-08-25 724992]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-07-27 204800]
"PSQLLauncher"=C:\Program Files\Protector Suite QL\launcher.exe [2007-11-14 49416]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-14 136600]
"lxdnmon.exe"=C:\Program Files\Lexmark 2600 Series\lxdnmon.exe [2007-12-17 660136]
"lxdnamon"=C:\Program Files\Lexmark 2600 Series\lxdnamon.exe [2007-12-17 16040]
"FaxCenterServer"=C:\Program Files\Lexmark Fax Solutions\fm3032.exe [2007-12-17 320168]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2007-01-13 90191]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-01-13 7766016]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-01-13 81920]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"PeerGuardian"=C:\Program Files\PeerGuardian2\pg2.exe [2007-06-02 1457152]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
C:\Windows\system32\psqlpwd.dll [2007-11-14 96008]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
psqlpwd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{55f7c04d-a50f-11dc-b9b1-0016d4f956e8}]
shell\1\command - RUNAUT~1\autorun.pif
shell\2\command - RUNAUT~1\autorun.pif
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNAUT~1\autorun.pif


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-04-18 14:23:42 ----D---- C:\rsit
2009-04-18 14:11:04 ----A---- C:\Windows\system32\winsetup66.exe
2009-04-12 13:03:04 ----D---- C:\Program Files\Trend Micro
2009-04-11 16:29:01 ----A---- C:\Windows\system32\GEARAspi.dll
2009-04-11 16:28:15 ----D---- C:\Program Files\iPod
2009-04-11 16:28:02 ----D---- C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-11 16:28:02 ----D---- C:\Program Files\iTunes
2009-04-11 16:26:10 ----D---- C:\Program Files\Bonjour
2009-04-10 07:51:35 ----A---- C:\ProgramData\SPL3E76.tmp
2009-04-08 23:03:13 ----A---- C:\Windows\system32\SelfDel.bat
2009-04-08 23:00:22 ----D---- C:\Users\Carl\AppData\Roaming\InstallShield
2009-04-08 22:40:55 ----A---- C:\Windows\system32\winsetupgl.exe
2009-04-04 02:02:28 ----A---- C:\Windows\system32\winsetup63.exe
2009-04-02 07:33:15 ----A---- C:\ProgramData\SPLE44.tmp
2009-03-31 21:45:02 ----A---- C:\Windows\system32\mfr532.exe
2009-03-31 17:22:51 ----A---- C:\Windows\system32\mshtmled.dll
2009-03-31 17:22:50 ----A---- C:\Windows\system32\mshtmler.dll
2009-03-31 17:22:50 ----A---- C:\Windows\system32\ieui.dll
2009-03-31 17:22:50 ----A---- C:\Windows\system32\icardie.dll
2009-03-31 17:22:50 ----A---- C:\Windows\system32\admparse.dll
2009-03-31 17:22:49 ----A---- C:\Windows\system32\msls31.dll
2009-03-31 17:22:49 ----A---- C:\Windows\system32\jsproxy.dll
2009-03-31 17:22:45 ----A---- C:\Windows\system32\corpol.dll
2009-03-31 17:22:44 ----A---- C:\Windows\system32\imgutil.dll
2009-03-31 17:22:44 ----A---- C:\Windows\system32\iernonce.dll
2009-03-31 17:22:44 ----A---- C:\Windows\system32\ieakeng.dll
2009-03-31 17:22:43 ----A---- C:\Windows\system32\dxtrans.dll
2009-03-31 17:22:43 ----A---- C:\Windows\system32\dxtmsft.dll
2009-03-31 17:22:42 ----A---- C:\Windows\system32\occache.dll
2009-03-31 17:22:42 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-03-31 17:22:42 ----A---- C:\Windows\system32\licmgr10.dll
2009-03-31 17:22:42 ----A---- C:\Windows\system32\inseng.dll
2009-03-31 17:22:42 ----A---- C:\Windows\system32\iepeers.dll
2009-03-31 17:22:41 ----A---- C:\Windows\system32\webcheck.dll
2009-03-31 17:22:41 ----A---- C:\Windows\system32\msrating.dll
2009-03-31 17:22:41 ----A---- C:\Windows\system32\iesetup.dll
2009-03-31 17:22:41 ----A---- C:\Windows\system32\ieakui.dll
2009-03-31 17:22:41 ----A---- C:\Windows\system32\ieaksie.dll
2009-03-31 17:22:40 ----A---- C:\Windows\system32\WinFXDocObj.exe
2009-03-31 17:22:40 ----A---- C:\Windows\system32\wextract.exe
2009-03-31 17:22:40 ----A---- C:\Windows\system32\mstime.dll
2009-03-31 17:22:40 ----A---- C:\Windows\system32\msfeedssync.exe
2009-03-31 17:22:40 ----A---- C:\Windows\system32\msfeeds.dll
2009-03-31 17:22:39 ----A---- C:\Windows\system32\pngfilt.dll
2009-03-31 17:22:39 ----A---- C:\Windows\system32\advpack.dll
2009-03-31 17:22:36 ----A---- C:\Windows\system32\ieapfltr.dll
2009-03-31 17:22:33 ----A---- C:\Windows\system32\vbscript.dll
2009-03-31 17:22:33 ----A---- C:\Windows\system32\url.dll
2009-03-31 17:22:33 ----A---- C:\Windows\system32\jscript.dll
2009-03-31 17:22:33 ----A---- C:\Windows\system32\iedkcs32.dll
2009-03-31 17:22:31 ----A---- C:\Windows\system32\mshta.exe
2009-03-31 17:22:31 ----A---- C:\Windows\system32\iexpress.exe
2009-03-31 17:22:31 ----A---- C:\Windows\system32\iesysprep.dll
2009-03-31 17:22:30 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2009-03-31 17:22:30 ----A---- C:\Windows\system32\SetDepNx.exe
2009-03-31 17:22:30 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2009-03-31 17:22:30 ----A---- C:\Windows\system32\PDMSetup.exe
2009-03-31 17:22:30 ----A---- C:\Windows\system32\ieUnatt.exe
2009-03-31 17:22:29 ----A---- C:\Windows\system32\wininet.dll
2009-03-31 17:22:29 ----A---- C:\Windows\system32\iertutil.dll
2009-03-31 17:22:29 ----A---- C:\Windows\system32\ie4uinit.exe
2009-03-31 17:22:28 ----A---- C:\Windows\system32\urlmon.dll
2009-03-31 17:22:25 ----A---- C:\Windows\system32\ieframe.dll
2009-03-31 17:22:24 ----A---- C:\Windows\system32\mshtml.dll
2009-03-29 10:45:22 ----D---- C:\Program Files\Symantec
2009-03-29 10:43:59 ----D---- C:\Program Files\Norton AntiVirus
2009-03-29 10:43:58 ----D---- C:\ProgramData\Norton
2009-03-29 10:40:59 ----SHD---- C:\$RECYCLE.BIN
2009-03-29 10:30:07 ----D---- C:\ProgramData\NortonInstaller
2009-03-29 10:30:07 ----D---- C:\Program Files\NortonInstaller
2009-03-28 15:25:26 ----D---- C:\Users\Carl\AppData\Roaming\Malwarebytes
2009-03-28 15:25:19 ----D---- C:\ProgramData\Malwarebytes
2009-03-28 14:13:04 ----A---- C:\Windows\ntbtlog.txt
2009-03-28 09:19:15 ----A---- C:\ProgramData\SPL47F7.tmp
2009-03-28 09:03:43 ----A---- C:\ProgramData\SPLB0DB.tmp
2009-03-27 15:52:22 ----D---- C:\Program Files\AVG
2009-03-22 06:43:44 ----D---- C:\temp
2009-03-20 17:00:16 ----D---- C:\Program Files\Common Files\supportsoft
2009-03-20 16:59:59 ----A---- C:\Windows\system32\cdintf251.dll
2009-03-20 16:54:32 ----D---- C:\Windows\Intuit
2009-03-20 16:54:04 ----D---- C:\Program Files\Common Files\AnswerWorks 4.0
2009-03-20 16:53:34 ----D---- C:\Program Files\Common Files\Intuit
2009-03-20 16:53:33 ----D---- C:\ProgramData\Intuit
2009-03-20 16:53:32 ----D---- C:\Program Files\Intuit
2009-03-20 16:51:13 ----D---- C:\ProgramData\COMMON FILES
2009-03-19 16:08:11 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-03-19 16:08:11 ----A---- C:\Windows\system32\infocardapi.dll
2009-03-19 16:08:10 ----A---- C:\Windows\system32\icardagt.exe
2009-03-19 16:08:09 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-03-19 16:08:09 ----A---- C:\Windows\system32\icardres.dll
2009-03-19 16:08:06 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-03-19 16:08:04 ----A---- C:\Windows\system32\PresentationHost.exe
2009-03-19 15:56:45 ----A---- C:\Windows\system32\dfshim.dll
2009-03-19 15:56:40 ----A---- C:\Windows\system32\mscoree.dll
2009-03-19 15:56:37 ----A---- C:\Windows\system32\netfxperf.dll
2009-03-19 15:56:05 ----A---- C:\Windows\system32\mscorier.dll
2009-03-19 15:55:56 ----A---- C:\Windows\system32\mscories.dll

======List of files/folders modified in the last 1 months======

2009-04-18 14:23:47 ----D---- C:\Windows\Temp
2009-04-18 14:13:29 ----D---- C:\Windows\system32\catroot
2009-04-18 14:13:05 ----D---- C:\Windows\winsxs
2009-04-18 14:12:29 ----D---- C:\Windows\system32\catroot2
2009-04-18 14:11:13 ----D---- C:\Windows\System32
2009-04-18 13:55:52 ----D---- C:\Windows
2009-04-14 08:15:28 ----SHD---- C:\System Volume Information
2009-04-14 08:14:39 ----D---- C:\Windows\Prefetch
2009-04-12 13:03:04 ----RD---- C:\Program Files
2009-04-12 10:35:31 ----D---- C:\ProgramData\Lx_cats
2009-04-12 10:35:18 ----HD---- C:\ProgramData
2009-04-11 16:30:01 ----SHD---- C:\Windows\Installer
2009-04-11 16:29:07 ----D---- C:\Windows\system32\drivers
2009-04-11 16:29:00 ----DC---- C:\Windows\system32\DRVSTORE
2009-04-11 16:28:15 ----D---- C:\Program Files\Common Files\Apple
2009-04-08 21:49:34 ----D---- C:\Users\Carl\AppData\Roaming\LimeWire
2009-04-07 20:54:08 ----D---- C:\Program Files\Mozilla Firefox
2009-04-07 20:51:22 ----D---- C:\Windows\inf
2009-04-07 20:50:16 ----D---- C:\Program Files\Common Files\Nokia
2009-04-07 20:47:57 ----D---- C:\Program Files\Common Files
2009-03-31 17:49:42 ----D---- C:\Windows\rescache
2009-03-31 17:26:42 ----D---- C:\Program Files\Internet Explorer
2009-03-31 17:26:41 ----D---- C:\Windows\system32\migration
2009-03-31 17:26:41 ----D---- C:\Windows\system32\en-US
2009-03-31 17:26:41 ----D---- C:\Windows\PolicyDefinitions
2009-03-31 17:21:32 ----D---- C:\Windows\SoftwareDistribution
2009-03-29 16:47:29 ----D---- C:\ProgramData\Symantec
2009-03-29 10:52:34 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-03-29 07:52:17 ----RD---- C:\Users
2009-03-29 07:47:16 ----D---- C:\Windows\Tasks
2009-03-28 21:14:29 ----D---- C:\Windows\Minidump
2009-03-28 18:37:25 ----D---- C:\Program Files\Google
2009-03-28 18:35:29 ----D---- C:\BBasics1
2009-03-28 11:30:17 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-03-27 13:44:58 ----SD---- C:\ProgramData\Microsoft
2009-03-27 08:48:58 ----D---- C:\Windows\system32\spool
2009-03-24 11:16:19 ----D---- C:\Windows\system32\Tasks
2009-03-20 16:58:55 ----RSD---- C:\Windows\assembly
2009-03-20 16:55:42 ----RSD---- C:\Windows\Fonts
2009-03-19 16:34:03 ----D---- C:\Windows\Microsoft.NET
2009-03-19 16:19:49 ----D---- C:\Windows\system32\XPSViewer
2009-03-19 16:19:48 ----D---- C:\Windows\system32\wbem
2009-03-19 16:18:22 ----D---- C:\Program Files\PeerGuardian2
2009-03-19 15:50:41 ----SD---- C:\Windows\Downloaded Program Files
2009-03-19 15:32:48 ----D---- C:\Program Files\Microsoft SQL Server
2009-03-19 15:31:56 ----D---- C:\Windows\registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;Symantec Heuristics Driver; \??\C:\Windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [2009-03-29 258608]
R1 ccHP;Symantec Hash Provider; \??\C:\Windows\system32\drivers\NAV\1005000.086\ccHPx86.sys [2009-03-29 482352]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2009-03-29 371248]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090414.001\IDSvix86.sys [2009-03-29 292912]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); \??\C:\Windows\system32\drivers\NAV\1005000.086\SRTSPX.SYS [2009-03-29 43696]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2009-03-29 25136]
R1 SYMTDI;Symantec Network Dispatch Driver; \??\C:\Windows\system32\drivers\NAV\1005000.086\SYMTDI.SYS [2009-03-29 217392]
R1 Tosrfcom;Bluetooth RFCOMM; C:\Windows\System32\Drivers\tosrfcom.sys [2005-08-01 64896]
R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2006-11-28 1161888]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-29 101936]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-03-19 23400]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-01-18 1729632]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090417.025\NAVENG.SYS [2009-03-29 89104]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090417.025\NAVEX15.SYS [2009-03-29 876144]
R3 NETGEARUHOST;NETGEAR Network USB Host Controller; C:\Windows\system32\DRIVERS\NETGEARUHOST.sys [2006-08-17 10752]
R3 NETGEARUHUB;NETGEAR Network USB Root Hub; C:\Windows\system32\DRIVERS\NETGEARUHUB.sys [2006-08-17 37120]
R3 NETw4v32;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-04-30 2219520]
R3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys [2007-01-15 9728]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-01-13 4452288]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:\Windows\system32\DRIVERS\point32k.sys [2006-11-08 24064]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-01-25 106496]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-19 88576]
R3 SRTSP;Symantec Real Time Storage Protection; \??\C:\Windows\system32\drivers\NAV\1005000.086\SRTSP.SYS [2009-03-29 307760]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2009-03-29 124464]
R3 SYMFW;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NAV\1005000.086\SYMFW.SYS [2009-03-29 89776]
R3 SYMNDISV;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NAV\1005000.086\SYMNDISV.SYS [2009-03-29 39984]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-06-20 200112]
R3 TcUsb;TC USB Kernel Driver; C:\Windows\System32\Drivers\tcusb.sys [2008-01-30 50576]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-19 16128]
R3 tifm21;tifm21; C:\Windows\system32\drivers\tifm21.sys [2006-07-06 168448]
R3 tosporte;Bluetooth COM Port; C:\Windows\system32\DRIVERS\tosporte.sys [2006-10-10 41600]
R3 tosrfbd;Bluetooth RFBUS; C:\Windows\system32\DRIVERS\tosrfbd.sys [2007-01-12 113792]
R3 tosrfbnp;Bluetooth RFBNEP; C:\Windows\System32\Drivers\tosrfbnp.sys [2006-11-20 36480]
R3 tosrfec;Bluetooth ACPI; C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 9216]
R3 Tosrfhid;Bluetooth RFHID; C:\Windows\system32\DRIVERS\Tosrfhid.sys [2007-01-24 73728]
R3 tosrfnds;Bluetooth Personal Area Network; C:\Windows\system32\DRIVERS\tosrfnds.sys [2005-01-06 18612]
R3 Tosrfusb;Bluetooth USB Controller; C:\Windows\system32\DRIVERS\tosrfusb.sys [2007-01-12 40576]
R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2006-11-02 132352]
R3 UVCFTR;UVCFTR; C:\Windows\system32\DRIVERS\UVCFTR_S.SYS [2007-01-27 17712]
S3 BVRPMPR5;BVRPMPR5 NDIS Protocol Driver; \??\C:\Windows\system32\drivers\BVRPMPR5.SYS [2007-06-16 49904]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETGEARUCOMP;NETGEAR Network USB Composite Device; C:\Windows\system32\DRIVERS\NETGEARUCOMP.sys [2006-08-17 11648]
S3 pgfilter;pgfilter; \??\C:\Program Files\PeerGuardian2\pgfilter.sys [2007-06-02 8192]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2008-01-19 8192]
S3 SymIMMP;SymIMMP; C:\Windows\system32\DRIVERS\SymIM.sys []
S3 TosRfSnd;Bluetooth Audio; C:\Windows\system32\drivers\tosrfsnd.sys [2007-01-22 53376]
S3 TpChoice;Touch Pad Detection Filter driver; C:\Windows\system32\DRIVERS\TpChoice.sys []
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2007-10-31 30464]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 winusb;WinUSB Service; C:\Windows\system32\DRIVERS\WinUSB.SYS [2008-01-19 31616]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2006-10-05 9216]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-06 132424]
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-11 30312]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2006-11-14 40960]
R2 lxdn_device;lxdn_device; C:\Windows\system32\lxdncoms.exe [2007-12-05 594600]
R2 Norton AntiVirus;Norton AntiVirus; C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [2009-03-29 115560]
R2 QBCFMonitorService;QuickBooks Database Manager Service; C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [2008-10-30 20480]
R2 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\Windows\system32\TODDSrv.exe [2006-05-26 114688]
R2 TosCoSrv;TOSHIBA Power Saver; C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe [2006-12-20 428152]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-02 118784]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2006-08-24 49152]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2007-12-05 98984]
S2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-27 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-02-08 212480]
S3 Symantec RemoteAssist;Symantec RemoteAssist; C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe [2008-01-29 394704]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]
S4 QBFCService;Intuit QuickBooks FCS; C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [2008-10-30 68672]

-----------------EOF-----------------

[Shaba]

Please click this link-->Jotti (http://virusscan.jotti.org/)

Copy/paste the file on the list into the white Upload a file box and click Submit/Send (depends on which one you are using Jotti or VirusTotal).

C:\Windows\system32\winsetup66.exe

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/

[L5Brassco]

Hi Shaba

Thank you for the prompt reply
I tried both
Jotti found nothing
VirusTotal 0/40
Norton keeps telling me it has blocked a trojan horse and/or a MH690.A Heuristic Virus.

L5

[Shaba]

Where that is according to norton?

[L5Brassco]

Norton says the Heuristic virus was in

c:\windows\temp\ovfsthtqcliohssd.tmp

On start up today Windows defender also found a trojan with these details

regkey:
HKCU@S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\InetChk

runkey:
HKCU@S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\InetChk

file:
C:\Windows\TEMP\ms239150627.exe (UPX)

containerfile:
C:\Windows\TEMP\ms239150627.exe

windows defender had to remove this to continue start up

Thank you
L5

[Shaba]

I see.

We will continue with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here. (http://www.bleepingcomputer.com/forums/topic114351.html)

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

[L5Brassco]

Shaba
I can't get Combo Fix to run.
I keep getting message saying ComboFix package has been compromised.
I have turned off Norton, followed instructions about tea timer on Spybot.
turned off windows defender and firewall.
Still won't run.
Have tried downloading from all 3 sites...still not working.
Any ideas?
Thanks
L5

[Shaba]

Then please rename it and let me know if it runs now.

[L5Brassco]

Hi Shaba
I assume you mean rename the exe file.
Have done this but still won't run...
What am I doing wrong???
L5

[Shaba]

You are not necessarily doing anything wrong. It can be infection as well which prevents combofix to run.

Download gmer.zip (http://gmer.net/gmer.zip) and save to your desktop.
alternate download site (http://hype.free.googlepages.com/gmer.zip)

Unzip/extract the file to its own folder. (Click here (http://www.bleepingcomputer.com/tutorials/tutorial105.html) for information on how to do this if not sure. Win 2000 users click here (http://www.bleepingcomputer.com/tutorials/tutorial106.html).
When you have done this, disconnect from the Internet and close all running programs.
There is a small chance this application may crash your computer so save any work you have open.
Double-click on Gmer.exe to start the program.
Allow the gmer.sys driver to load if asked.
If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
Click on the Rootkit tab.
Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
Click on the "Scan" and wait for the scan to finish.
Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
Note: If you have any problems, try running GMER in SAFE MODE (http://www.bleepingcomputer.com/forums/tutorial61.html)"
Important! Please do not select the "Show all" checkbox during the scan..

[L5Brassco]

Shaba
I hope this is what you want
I am a bit worried about my files.
All my photo previews have dissappeared, yet if i double click on the the icons they open ok.
I think it is since I turned all my protection back on.
oh and my desktop wallpaper has gone too.
Feel a bit like Alice in Wonderland falling down the rabbit hole.
Thanks
Over to you

GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-04-19 23:04:15
Windows 6.0.6001 Service Pack 1


---- System - GMER 1.0.15 ----

SSDT 90A96050 ZwAlertResumeThread
SSDT 90A96188 ZwAlertThread
SSDT 90A82658 ZwAllocateVirtualMemory
SSDT 8DEE0558 ZwAlpcConnectPort
SSDT 90A96448 ZwAssignProcessToJobObject
SSDT 8DFDCFC0 ZwCreateMutant
SSDT 8DF4D158 ZwCreateSymbolicLinkObject
SSDT 8DF5DBD8 ZwCreateThread
SSDT 90A5A1C8 ZwDebugActiveProcess
SSDT 90A96C88 ZwDuplicateObject
SSDT 90A824B8 ZwFreeVirtualMemory
SSDT 8DEFCD80 ZwImpersonateAnonymousToken
SSDT 8DF08558 ZwImpersonateThread
SSDT 8DEA34C8 ZwLoadDriver
SSDT 90A823D8 ZwMapViewOfSection
SSDT 8DFFF108 ZwOpenEvent
SSDT 90A96E28 ZwOpenProcess
SSDT 90A593B8 ZwOpenProcessToken
SSDT 8DFE7068 ZwOpenSection
SSDT 90A96D58 ZwOpenThread
SSDT 90A96378 ZwProtectVirtualMemory
SSDT 900395D0 ZwResumeThread
SSDT 90A6E568 ZwSetContextThread
SSDT 90A96640 ZwSetInformationProcess
SSDT 90A590B0 ZwSetSystemInformation
SSDT 9004A108 ZwSuspendProcess
SSDT 90A6E150 ZwSuspendThread
SSDT 90A47A08 ZwTerminateProcess
SSDT 90A5A090 ZwTerminateThread
SSDT 90A472A0 ZwUnmapViewOfSection
SSDT 90A82588 ZwWriteVirtualMemory
SSDT 8DF4D228 ZwCreateThreadEx

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!KeInsertQueue + 30D 8247B904 8 Bytes [50, 60, A9, 90, 88, 61, A9, ...] {PUSH EAX; PUSHA ; TEST EAX, 0xa9618890; NOP }
.text ntoskrnl.exe!KeInsertQueue + 321 8247B918 4 Bytes [58, 26, A8, 90]
.text ntoskrnl.exe!KeInsertQueue + 32D 8247B924 4 Bytes [58, 05, EE, 8D]
.text ntoskrnl.exe!KeInsertQueue + 381 8247B978 4 Bytes [48, 64, A9, 90]
.text ntoskrnl.exe!KeInsertQueue + 3E5 8247B9DC 4 Bytes [C0, CF, FD, 8D]
.text ...

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe[4600] ntdll.dll!DbgBreakPoint 77187DFE 1 Byte [90]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74677BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [746B98C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7467D3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7466F527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74677599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7466E43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [746AB33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7467D68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7467012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [74670095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [746671F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [746FD802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [746975E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7466DAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [7466668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [746666BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74671E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS
AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS
AttachedDevice \Driver\tdx \Device\RawIp SYMTDI.SYS

---- Services - GMER 1.0.15 ----

Service system32\drivers\ovfsthfqomlsqgjtctbuclfpdpdbugicnhsfdr.sys (*** hidden *** ) [SYSTEM] ovfsthntnvxbrvfcqvqytdchpvxebppyptockf <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@imagepath \systemroot\system32\drivers\ovfsthfqomlsqgjtctbuclfpdpdbugicnhsfdr.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@inst 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@ver icv230309
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@cid 02
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@bid 4101417366-1882435643-3835081554-1223697280
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@aid 303612
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@sid 201
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@feed 0x22 0x64 0x78 0x36 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@cmddelay 14401
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\ff
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\ff@extension \\?\C:\Program Files\Mozilla Firefox\extensions\{4B2E3350-B561-4545-A2D1-F5109AB6008F}
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\ff@version 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\injector@iexplore.exe ovfsthwi.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\injector@explorer.exe ovfsthff.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\injector@winlogon.exe senekaadwrem.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@fn (null)
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@url http://dglcxlcfmk.net/ak1.exe
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@timeout 900
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@type 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@count 5
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@fn (null)
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@url http://catch-you.ru/files/winsetup66.exe
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@timeout 900
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@type 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@count 5
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsth.dll \systemroot\system32\ovfsthupidcwcsjrvmoxiwmssoertarieyamvc.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsth.sys \systemroot\system32\drivers\ovfsthfqomlsqgjtctbuclfpdpdbugicnhsfdr.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthlog.dat \systemroot\system32\ovfsthgecgxrxatyijmuwndigcxkvvhdgeeilg.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthwi.dll \systemroot\system32\ovfsthoixffoncroidojefjdybsajetkavmdae.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthff.dll \systemroot\system32\ovfsthxucvawsoqwxoehajbxqguhpirrwieumj.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsth.dat \systemroot\system32\ovfsthwlqotvsshpbktbvgtpwrmtxgxxiubmmu.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthmal.db \systemroot\system32\ovfsthhkponrweoqoiepmxbivcfweedyarvgju.db
Reg HKLM\SYSTEM\CurrentControlSet\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthadwrem.dll \systemroot\system32\ovfsthiqnlbvtddiwxipvnmumyqxvaqncwfaot.dll
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@imagepath \systemroot\system32\drivers\ovfsthfqomlsqgjtctbuclfpdpdbugicnhsfdr.sys
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf@inst 0
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@ver icv230309
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@cid 02
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@bid 4101417366-1882435643-3835081554-1223697280
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@aid 303612
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@sid 201
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@feed 0x22 0x64 0x78 0x36 ...
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main@cmddelay 14401
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\delete
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\ff
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\ff@extension \\?\C:\Program Files\Mozilla Firefox\extensions\{4B2E3350-B561-4545-A2D1-F5109AB6008F}
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\ff@version 1
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\injector
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\injector@iexplore.exe ovfsthwi.dll
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\injector@explorer.exe ovfsthff.dll
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\injector@winlogon.exe senekaadwrem.dll
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@fn (null)
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@url http://dglcxlcfmk.net/ak1.exe
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@timeout 900
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@type 0
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000001@count 5
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@fn (null)
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@url http://catch-you.ru/files/winsetup66.exe
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@timeout 900
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@type 0
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\main\tasks\0000000002@count 5
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsth.dll \systemroot\system32\ovfsthupidcwcsjrvmoxiwmssoertarieyamvc.dll
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsth.sys \systemroot\system32\drivers\ovfsthfqomlsqgjtctbuclfpdpdbugicnhsfdr.sys
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthlog.dat \systemroot\system32\ovfsthgecgxrxatyijmuwndigcxkvvhdgeeilg.dat
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthwi.dll \systemroot\system32\ovfsthoixffoncroidojefjdybsajetkavmdae.dll
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthff.dll \systemroot\system32\ovfsthxucvawsoqwxoehajbxqguhpirrwieumj.dll
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsth.dat \systemroot\system32\ovfsthwlqotvsshpbktbvgtpwrmtxgxxiubmmu.dat
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthmal.db \systemroot\system32\ovfsthhkponrweoqoiepmxbivcfweedyarvgju.db
Reg HKLM\SYSTEM\ControlSet002\Services\ovfsthntnvxbrvfcqvqytdchpvxebppyptockf\modules@ovfsthadwrem.dll \systemroot\system32\ovfsthiqnlbvtddiwxipvnmumyqxvaqncwfaot.dll
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit_DLLs 1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@IconServiceLib IconCodecService.dll
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DdeSendTimeout 0
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DesktopHeapLogging 1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@ShutdownWarningDialogTimeout -1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERPostMessageLimit 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@ mnmsrvc
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90

---- Files - GMER 1.0.15 ----

File C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.002 (size mismatch) 360448/311296 bytes
File C:\Windows\System32\wfp\wfpdiag.etl (size mismatch) 65536/0 bytes

---- EOF - GMER 1.0.15 ----

[Shaba]

Yes we have a rootkit

Run gmer.exe
Click the tab called Processes and click the Safe... button. The computer will reboot and the Gmer screen will open.
Click Files... and browse to the following file:
c:\windows\system32\drivers\ovfsthfqomlsqgjtctbuclfpdpdbugicnhsfdr.sys

Now click Delete
Also do that with these files:

c:\windows\system32\ovfsthupidcwcsjrvmoxiwmssoertarieyamvc.dll
c:\windows\system32\ovfsthgecgxrxatyijmuwndigcxkvvhdgeeilg.dat
c:\windows\system32\ovfsthoixffoncroidojefjdybsajetkavmdae.dll
c:\windows\system32\ovfsthxucvawsoqwxoehajbxqguhpirrwieumj.dll
c:\windows\system32\ovfsthwlqotvsshpbktbvgtpwrmtxgxxiubmmu.dat
c:\windows\system32\ovfsthhkponrweoqoiepmxbivcfweedyarvgju.db
c:\windows\system32\ovfsthiqnlbvtddiwxipvnmumyqxvaqncwfaot.dll

Now click the Services tab. Click the entries in red one by one with your right mouse button and click Delete... Answer Yes to all the warning windows.
When you've removed all the Service entries in red, reboot your computer.

Rerun gmer and post back a fresh gmer log, please.

[L5Brassco]

Hi Shaba
I'm confused...
Ran gmer.exe
Clicked Processes
But there is no Safe button.
There is a restart button on right hand side.
Should I try that?

[Shaba]

Yes you can try that one.

[L5Brassco]

Shaba
I was able to find and delete all the dat and dll files.
I could not find the db file.
The only sys file I could find was windows\system32\drivers\ovfsth.sys
So I left it alone.
Then when I went to the services tab the only file in red was the original sys file so I deleted it.
Then got a message saying "could not delete- system cannot find path specified"
Tried running gmer but it crashed x 2.
Ran gmer in safe mode x 2 and it crashed.
What now?
thanks L5

[Shaba]

Well it is possible that those filenames mutate.

That file is bad as well, you can delete it via gmer.

Post back a fresh gmer log afterwards, please.

[L5Brassco]

Shaba
Couldn't delete c:\windows\system32\drivers\ovfsth.sys
When I hit the kill button I get error message "Reached the end of the file"
L5

[Shaba]

OK, please then run gmer again and we will delete bad files using other means.

[L5Brassco]

Shaba
gmer keeps crashing
Windows tells me it is because of Anti Kapersky virus.

[Shaba]

That is strange because you have norton and not kaspersky.

Please disable norton and try again.

[L5Brassco]

Deleted all gmer
Downloaded gmer
Turned off Norton and Windows Defender.
Ran gmer.
Gmer crashed at \Device\HarddiskVolumeShadowCopy22
windows says there is a problem with the program.
or sometimes goes to blue screen shutdown

[Shaba]

So let's try this one:

Download Rooter.exe (http://forums.whatthetech.com/redirect.php?url=http%3A%2F%2Feric.71.mespages.googlepages.com%2FRooter.exe) to your desktop.

Then double-click it to start the tool.
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here.

[L5Brassco]

When I try to open Rooter.exe I get message
Find String (QGREP) Utility has stopped working
Tried opening in safe mode and got same message

[Shaba]

Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

[L5Brassco]

Here is the Kaspersky Scan result

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, April 24, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, April 23, 2009 19:23:33
Records in database: 2073015
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 128674
Threat name: 1
Infected objects: 0
Suspicious objects: 1
Duration of the scan: 02:11:05


File name / Threat name / Threats count
C:\Users\Carl\AppData\Local\Temp\ovfsthpotcqebndu.tmp Suspicious: Trojan.Win32.Patched.dy 1

The selected area was scanned.





And the Hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:34:00 AM, on 24/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Lexmark 2600 Series\lxdnmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [PS121v2] "C:\Program Files\NETGEAR\PS121v2\PS121v2.exe" /hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [*LogMeInRescue_3091639056] "C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe" -runonce -gui (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [*LogMeInRescue_3091639056] "C:\Users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe" -runonce -gui (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.terrace.qld.edu.au/dwa7W.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe
O23 - Service: lxdn_device - - C:\Windows\system32\lxdncoms.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: QuickBooks Database Manager Service (QBCFMonitorService) - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9548 bytes

[Shaba]

OK, as combofix didn't work let's try this.

Move combofix.exe to c: root (c:\)

Restart computer and start tapping F8 before windows logo until you see menu.
Choose safe mode with command prompt from that menu.

When it is in command prompt, type:

cd\ (enter)
combofix (enter)

Let me know if it works now.

[L5Brassco]

Hallelujah
Combofix ran ok in safe mode (I had to download it again)
Here is the log

ComboFix 09-04-24.01 - Carl 24/04/2009 20:21.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.61.1033.18.2045.1645 [GMT 10:00]
Running from: C:\ComboFix.exe
Command switches used :: combofix
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\ovfsth.sys

.
((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-4-24 )))))))))))))))))))))))))))))))
.

2009-04-24 10:12 . 2009-04-24 10:12 2999256 ----a-r C:\ComboFix.exe
2009-04-23 08:19 . 2009-04-23 09:25 -------- d-----w C:\Rooter$
2009-04-18 05:12 . 2009-04-18 05:13 108032 ----a-w c:\windows\system32\winsetup66.exe
2009-04-18 05:07 . 2009-04-18 05:07 118 ----a-w c:\windows\system32\MRT.INI
2009-04-18 05:01 . 2009-04-18 05:01 -------- d-sh--w c:\windows\system32\%APPDATA%
2009-04-18 04:23 . 2009-04-18 04:24 -------- d-----w C:\rsit
2009-04-18 04:15 . 2008-12-06 04:42 376832 ----a-w c:\windows\system32\winhttp.dll
2009-04-18 04:15 . 2008-06-06 03:27 38912 ----a-w c:\windows\system32\xolehlp.dll
2009-04-18 04:15 . 2008-06-06 03:27 562176 ----a-w c:\windows\system32\msdtcprx.dll
2009-04-18 04:15 . 2009-03-03 04:46 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-04-18 04:15 . 2009-03-03 04:39 551424 ----a-w c:\windows\system32\rpcss.dll
2009-04-18 04:15 . 2009-03-03 04:46 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-04-18 04:15 . 2009-03-03 04:39 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-04-18 04:15 . 2009-03-03 04:39 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-04-18 04:15 . 2009-03-03 04:37 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-04-18 04:15 . 2009-03-03 03:04 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-04-18 04:14 . 2009-03-03 04:37 54784 ----a-w c:\windows\system32\iasads.dll
2009-04-18 04:14 . 2009-03-03 04:37 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-04-18 04:14 . 2009-03-03 02:38 17408 ----a-w c:\windows\system32\iashost.exe
2009-04-18 04:13 . 2009-02-13 08:49 1255936 ----a-w c:\windows\system32\lsasrv.dll
2009-04-18 04:13 . 2009-02-13 08:49 72704 ----a-w c:\windows\system32\secur32.dll
2009-04-18 04:13 . 2009-03-17 03:38 13824 ----a-w c:\windows\system32\apilogen.dll
2009-04-18 04:13 . 2009-03-17 03:38 24064 ----a-w c:\windows\system32\amxread.dll
2009-04-12 03:03 . 2009-04-12 03:03 -------- d-----w c:\program files\Trend Micro
2009-04-11 06:29 . 2009-03-19 06:32 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-11 06:29 . 2008-04-17 02:12 107368 ----a-w c:\windows\system32\GEARAspi.dll
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\program files\iPod
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\users\All Users\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\program files\iTunes
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\progra~2\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-11 06:26 . 2009-04-11 06:26 -------- d-----w c:\program files\Bonjour
2009-04-08 13:03 . 2009-04-08 13:03 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-08 13:00 . 2009-04-08 13:00 -------- d-----w c:\users\Carl\AppData\Roaming\InstallShield
2009-04-03 16:02 . 2009-04-03 18:03 128000 ----a-w c:\windows\system32\winsetup63.exe
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\waverspw.dat
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\pcadg.dat
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\ogldrcsg.dat
2009-03-31 11:45 . 2009-03-31 11:45 153 ----a-w c:\windows\system32\KBDHE2D0.dat
2009-03-31 11:45 . 2009-03-31 11:45 0 ----a-w c:\windows\system32\psbape.dat
2009-03-31 11:45 . 2009-03-31 11:45 139264 ----a-w c:\windows\system32\mfr532.exe
2009-03-29 00:45 . 2009-03-29 00:44 25136 ----a-r c:\windows\system32\drivers\SymIMV.sys
2009-03-29 00:45 . 2009-03-29 00:45 -------- d-----w c:\program files\Symantec
2009-03-29 00:45 . 2009-03-29 00:45 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-03-29 00:45 . 2009-03-29 00:45 7386 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-03-29 00:45 . 2009-03-29 00:45 124464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-03-29 00:44 . 2009-03-29 00:44 -------- d-----w c:\windows\system32\drivers\NAV
2009-03-29 00:43 . 2009-03-29 00:44 -------- d-----w c:\program files\Norton AntiVirus
2009-03-29 00:43 . 2009-03-29 00:46 -------- d-----w c:\users\All Users\Norton
2009-03-29 00:43 . 2009-03-29 00:46 -------- d-----w c:\progra~2\Norton
2009-03-29 00:40 . 2009-03-29 00:40 -------- d-sh--w C:\$RECYCLE.BIN
2009-03-29 00:30 . 2009-03-29 00:41 -------- d-----w c:\users\All Users\NortonInstaller
2009-03-29 00:30 . 2009-03-29 00:41 -------- d-----w c:\progra~2\NortonInstaller
2009-03-29 00:30 . 2009-03-29 00:30 -------- d-----w c:\program files\NortonInstaller
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\users\Carl\AppData\Roaming\Malwarebytes
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\users\All Users\Malwarebytes
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\progra~2\Malwarebytes
2009-03-27 05:52 . 2009-03-27 05:52 -------- d-----w c:\program files\AVG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-24 09:52 . 2007-06-23 07:24 12978 ----a-w c:\users\Carl\AppData\Roaming\nvModes.dat
2009-04-23 09:06 . 2007-07-02 12:08 1356 ----a-w c:\users\Carl\AppData\Local\d3d9caps.dat
2009-04-21 13:56 . 2007-02-26 23:40 -------- d-----w c:\program files\Java
2009-04-18 05:26 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-18 05:05 . 2007-02-27 00:44 -------- d-----w c:\progra~2\Microsoft Help
2009-04-12 00:35 . 2008-12-17 07:30 -------- d-----w c:\progra~2\Lx_cats
2009-04-11 06:28 . 2007-07-03 06:45 -------- d-----w c:\program files\Common Files\Apple
2009-04-09 21:51 . 2009-04-09 21:51 271455 ----a-w c:\users\All Users\SPL3E76.tmp
2009-04-09 21:51 . 2009-04-09 21:51 271455 ----a-w c:\progra~2\SPL3E76.tmp
2009-04-08 11:49 . 2008-06-03 02:49 -------- d-----w c:\users\Carl\AppData\Roaming\LimeWire
2009-04-07 11:03 . 2007-06-23 05:45 121112 ----a-w c:\users\Carl\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-07 10:51 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstor.dat
2009-04-07 10:51 . 2006-11-02 10:25 51200 ----a-w c:\windows\Inf\infpub.dat
2009-04-07 10:51 . 2006-11-02 10:25 143360 ----a-w c:\windows\Inf\infstrng.dat
2009-04-07 10:50 . 2009-01-23 12:23 -------- d-----w c:\program files\Common Files\Nokia
2009-04-01 21:33 . 2009-04-01 21:33 249997 ----a-w c:\users\All Users\SPLE44.tmp
2009-04-01 21:33 . 2009-04-01 21:33 249997 ----a-w c:\progra~2\SPLE44.tmp
2009-03-29 06:47 . 2008-08-13 09:00 -------- d-----w c:\progra~2\Symantec
2009-03-29 00:52 . 2007-06-23 06:00 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-28 08:37 . 2007-08-23 00:59 -------- d-----w c:\program files\Google
2009-03-27 23:19 . 2009-03-27 23:19 84654 ----a-w c:\users\All Users\SPL47F7.tmp
2009-03-27 23:19 . 2009-03-27 23:19 84654 ----a-w c:\progra~2\SPL47F7.tmp
2009-03-27 23:03 . 2009-03-27 23:03 84654 ----a-w c:\users\All Users\SPLB0DB.tmp
2009-03-27 23:03 . 2009-03-27 23:03 84654 ----a-w c:\progra~2\SPLB0DB.tmp
2009-03-20 07:00 . 2009-03-20 07:00 -------- d-----w c:\program files\Common Files\supportsoft
2009-03-20 06:58 . 2009-03-20 06:53 -------- d-----w c:\progra~2\Intuit
2009-03-20 06:55 . 2009-03-20 06:53 -------- d-----w c:\program files\Common Files\Intuit
2009-03-20 06:54 . 2009-03-20 06:54 -------- d-----w c:\program files\Common Files\AnswerWorks 4.0
2009-03-20 06:53 . 2009-03-20 06:53 -------- d-----w c:\program files\Intuit
2009-03-20 06:51 . 2009-03-20 06:51 -------- d-----w c:\progra~2\COMMON FILES
2009-03-19 06:18 . 2008-12-07 22:59 -------- d-----w c:\program files\PeerGuardian2
2009-03-19 05:32 . 2007-09-03 01:52 -------- d-----w c:\program files\Microsoft SQL Server
2009-03-17 03:38 . 2009-04-18 04:13 40960 ----a-w c:\windows\AppPatch\apihex86.dll
2009-03-17 02:23 . 2007-02-26 22:31 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-17 01:44 . 2007-07-19 04:20 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-16 17:48 . 2007-06-24 01:01 -------- d-----w c:\program files\Common Files\Adobe
2009-03-14 00:53 . 2009-03-14 00:53 -------- d-----w c:\progra~2\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-14 00:49 . 2009-03-14 00:48 -------- d-----w c:\program files\QuickTime
2009-03-08 23:18 . 2007-06-27 04:26 -------- d-----w c:\program files\Call of Duty Game of the Year Edition
2009-03-08 19:19 . 2008-12-13 14:11 410984 ----a-w c:\windows\System32\deploytk.dll
2009-03-08 11:34 . 2009-03-31 07:22 914944 ----a-w c:\windows\System32\wininet.dll
2009-03-08 11:34 . 2009-03-31 07:22 43008 ----a-w c:\windows\System32\licmgr10.dll
2009-03-08 11:33 . 2009-03-31 07:22 18944 ----a-w c:\windows\System32\corpol.dll
2009-03-08 11:33 . 2009-03-31 07:22 109056 ----a-w c:\windows\System32\iesysprep.dll
2009-03-08 11:33 . 2009-03-31 07:22 109568 ----a-w c:\windows\System32\PDMSetup.exe
2009-03-08 11:33 . 2009-03-31 07:22 132608 ----a-w c:\windows\System32\ieUnatt.exe
2009-03-08 11:33 . 2009-03-31 07:22 107520 ----a-w c:\windows\System32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-03-31 07:22 107008 ----a-w c:\windows\System32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-03-31 07:22 103936 ----a-w c:\windows\System32\SetDepNx.exe
2009-03-08 11:33 . 2009-03-31 07:22 420352 ----a-w c:\windows\System32\vbscript.dll
2009-03-08 11:32 . 2009-03-31 07:22 72704 ----a-w c:\windows\System32\admparse.dll
2009-03-08 11:32 . 2009-03-31 07:22 71680 ----a-w c:\windows\System32\iesetup.dll
2009-03-08 11:32 . 2009-03-31 07:22 66560 ----a-w c:\windows\System32\wextract.exe
2009-03-08 11:32 . 2009-03-31 07:22 169472 ----a-w c:\windows\System32\iexpress.exe
2009-03-08 11:31 . 2009-03-31 07:22 34816 ----a-w c:\windows\System32\imgutil.dll
2009-03-08 11:31 . 2009-03-31 07:22 48128 ----a-w c:\windows\System32\mshtmler.dll
2009-03-08 11:31 . 2009-03-31 07:22 45568 ----a-w c:\windows\System32\mshta.exe
2009-03-08 11:22 . 2009-03-31 07:22 156160 ----a-w c:\windows\System32\msls31.dll
2009-03-04 10:51 . 2007-09-07 07:20 -------- d-----w c:\program files\DOOM 3
2009-03-04 00:56 . 2007-07-05 11:05 -------- d-----w c:\program files\Brownie
2009-03-04 00:56 . 2008-12-17 07:16 -------- d-----w c:\program files\Abbyy FineReader 6.0 Sprint
2009-03-04 00:55 . 2007-07-19 04:20 -------- d-----w c:\progra~2\Spybot - Search & Destroy
2009-03-04 00:55 . 2009-01-20 13:00 -------- d-----w c:\program files\PC Connectivity Solution
2009-03-04 00:55 . 2007-06-23 05:39 -------- d-----w c:\program files\Protector Suite QL
2009-03-04 00:55 . 2007-02-27 00:48 -------- d-----w c:\program files\Microsoft Works
2009-03-01 11:55 . 2008-11-20 07:11 -------- d-----w c:\users\Carl\AppData\Roaming\FrostWire
2009-02-09 03:10 . 2009-03-11 04:07 2033152 ----a-w c:\windows\System32\win32k.sys
2008-12-29 08:08 . 2008-12-29 08:08 34056 ----a-w c:\users\All Users\SPL1C47.tmp
2008-12-29 08:08 . 2008-12-29 08:08 34056 ----a-w c:\progra~2\SPL1C47.tmp
2008-12-29 08:06 . 2008-12-29 08:06 34056 ----a-w c:\users\All Users\SPL273.tmp
2008-12-29 08:06 . 2008-12-29 08:06 34056 ----a-w c:\progra~2\SPL273.tmp
2008-12-29 06:52 . 2008-12-29 06:52 129662 ----a-w c:\users\All Users\SPLA4C6.tmp
2008-12-29 06:52 . 2008-12-29 06:52 129662 ----a-w c:\progra~2\SPLA4C6.tmp
2008-12-28 22:37 . 2008-12-28 22:37 129662 ----a-w c:\users\All Users\SPL26E4.tmp
2008-12-28 22:37 . 2008-12-28 22:37 129662 ----a-w c:\progra~2\SPL26E4.tmp
2008-12-28 22:35 . 2008-12-28 22:35 129662 ----a-w c:\users\All Users\SPL9E9A.tmp
2008-12-28 22:35 . 2008-12-28 22:35 129662 ----a-w c:\progra~2\SPL9E9A.tmp
2008-05-27 04:35 . 2007-11-25 21:52 22328 ----a-w c:\users\Carl\AppData\Roaming\PnkBstrK.sys
2008-05-24 01:55 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
2007-11-25 22:02 . 2007-11-25 22:02 92 ----a-w c:\users\Carl\AppData\Local\fusioncache.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\kbdhe2d0]
@="{C2F2E748-E7D6-0E58-35E0-D780ABE07D4C}"
[HKEY_CLASSES_ROOT\CLSID\{C2F2E748-E7D6-0E58-35E0-D780ABE07D4C}]
2006-11-02 09:39 126976 ----a-w c:\windows\system32\KBDHE2D0.dIl

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-11-14 02:22 3186440 ----a-w c:\program files\Protector Suite QL\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-11-14 02:22 3186440 ----a-w c:\program files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2007-06-02 1457152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-07 34352]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-02-13 405504]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-20 411768]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-01-19 448632]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-01-17 534648]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-19 1316136]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-22 842584]
"PS121v2"="c:\program files\NETGEAR\PS121v2\PS121v2.exe" [2006-08-25 724992]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-07-26 204800]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2007-11-14 49416]
"lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136]
"lxdnamon"="c:\program files\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-12-17 320168]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-13 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-13 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-13 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-08 148888]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-01-18 4349952]
"NDSTray.exe"="NDSTray.exe" [BU]

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-2-2 2756608]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2007-8-16 118784]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-30 969792]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-11-14 02:07 96008 ----a-w c:\windows\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{22EFF41D-631D-40C9-989D-2712EF8D50A0}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= UDP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"UDP Query User{DAF6DF97-1477-4D7D-A48F-B853C976638A}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= TCP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"TCP Query User{F8658306-F07E-42BB-B00A-8D25053DA4E4}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{B08A1C9C-5466-4A99-83B5-B29606D574E9}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"TCP Query User{C262F8E5-9AD3-4FA5-81D3-D7AAA951F14A}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"= UDP:c:\windows\system32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"UDP Query User{FBA97FCB-AE9B-4A09-A619-C3C842206897}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"= TCP:c:\windows\system32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"TCP Query User{078EFE2F-F6A8-483B-BCEF-C6CC64A586B6}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= UDP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"UDP Query User{73C9C2C1-6022-49E7-810A-F7C36548FB22}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= TCP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"TCP Query User{596CF229-D0B6-4322-A74C-EB5EC1A616A2}c:\\users\\carl\\appdata\\local\\temp\\lmi6c0c.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi6c0c.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{D8F09C2A-6EAD-4CE8-9D25-25ABE7EED859}c:\\users\\carl\\appdata\\local\\temp\\lmi6c0c.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi6c0c.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{56EF1469-FCC7-4931-AF1A-BD2C1B92B8F1}c:\\users\\temp\\appdata\\local\\temp\\lmic5b0.tmp\\lmi_rescue.exe"= UDP:c:\users\temp\appdata\local\temp\lmic5b0.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{580923D4-ED9E-467C-9FEA-989B9276ED30}c:\\users\\temp\\appdata\\local\\temp\\lmic5b0.tmp\\lmi_rescue.exe"= TCP:c:\users\temp\appdata\local\temp\lmic5b0.tmp\lmi_rescue.exe:LogMeIn Rescue
"{C33BE070-A998-41CB-BACE-8C60A8A0EF51}"= UDP:c:\users\TEMP\AppData\Local\Temp\7zSCFB.tmp\SymNRT.exe:Norton Removal Tool
"{FA88B3A9-6139-42D9-B7A6-04C37DA5C339}"= TCP:c:\users\TEMP\AppData\Local\Temp\7zSCFB.tmp\SymNRT.exe:Norton Removal Tool
"TCP Query User{80264584-7F58-4ABF-B9C5-320A685B756C}c:\\users\\carl\\appdata\\local\\temp\\lmi83f0.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi83f0.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{4C564DC5-23E1-4372-80F8-01975EC8EBE0}c:\\users\\carl\\appdata\\local\\temp\\lmi83f0.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi83f0.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{868DF9FD-4144-4420-9CA6-3407D74B657B}c:\\users\\carl\\appdata\\local\\temp\\lmi67c9.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi67c9.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{79930D5F-60F2-44F1-BE6A-3E4DFF4EA24D}c:\\users\\carl\\appdata\\local\\temp\\lmi67c9.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi67c9.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{0983364B-1583-4A6B-8C0D-D7691316EEA4}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{4554DACF-6B06-4781-B56E-9B463BF38268}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"TCP Query User{712C9F86-FB44-4CDB-AE61-5E61471A71AD}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{AF6CD684-2B19-4C66-A844-DF67C48C555C}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{E5C44461-D1BC-4DD4-9BCE-97B59B2131F6}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B8349452-B959-44E6-B871-956E454EB8DC}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{225DADB3-12AE-4BDB-A386-A027B6F633F5}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{1941303B-DA35-4EBB-9A9E-A3DCAE43B1B9}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{3366980F-648C-4DE1-AC9F-1890073D4019}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{E66F7B7A-9FCD-416C-A009-9329CCFD157C}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F79F2373-27D2-4239-B302-D9034484898B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{0DA2CFD5-C10A-4F09-A2EF-553FC6DDF668}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2007-12-05 98984]
R3 MBAMSwissArmy;MBAMSwissArmy; [x]
R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
R3 NETGEARUCOMP;NETGEAR Network USB Composite Device;c:\windows\system32\DRIVERS\NETGEARUCOMP.sys [2006-08-17 11648]
R3 TpChoice;Touch Pad Detection Filter driver; [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SYMEFA.SYS [2009-03-29 310320]
S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [2009-03-29 258608]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\ccHPx86.sys [2009-03-29 482352]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090414.001\IDSvix86.sys [2009-03-29 292912]
S2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-11 30312]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-12-05 594600]
S2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [2009-03-29 115560]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-29 101936]
S3 NETGEARUHOST;NETGEAR Network USB Host Controller;c:\windows\system32\DRIVERS\NETGEARUHOST.sys [2006-08-17 10752]
S3 NETGEARUHUB;NETGEAR Network USB Root Hub;c:\windows\system32\DRIVERS\NETGEARUHUB.sys [2006-08-17 37120]
S3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\NAV\1005000.086\SYMNDISV.SYS [2009-03-29 39984]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{55f7c04d-a50f-11dc-b9b1-0016d4f956e8}]
\shell\1\Command - RUNAUT~1\autorun.pif
\shell\2\Command - RUNAUT~1\autorun.pif
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNAUT~1\autorun.pif

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

HKU-Default-RunOnce-*LogMeInRescue_3091639056 - c:\users\Carl\AppData\Local\Temp\LMI6C0C.tmp\lmi_rescue.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-24 20:30
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(884)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infql2.dll

- - - - - - - > 'Explorer.exe'(3712)
c:\program files\Protector Suite QL\farchns.dll
c:\program files\Protector Suite QL\infql2.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\System32\audiodg.exe
c:\program files\Protector Suite QL\upeksvr.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\System32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
c:\program files\Protector Suite QL\psqltray.exe
c:\program files\Lexmark 2600 Series\lxdnmsdmon.exe
c:\windows\System32\rundll32.exe
c:\program files\Synaptics\SynTP\SynToshiba.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\TOSHIBA\ConfigFree\CFSwMgr.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosAVRC.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosOBEX.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
.
**************************************************************************
.
Completion time: 2009-04-24 20:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-24 10:35

Pre-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
Post-Run: 122,992,062,464 bytes free

351 --- E O F --- 2009-04-23 19:00

[Shaba]

Great :)

Let me know if you can now run combofix also in normal mode.

[L5Brassco]

When I woke up this morning the sun was shining.
I started the computer all my pictures and wallpaper were back
Combofix ran in normal mode.
Things are improving...
Here is the log

ComboFix 09-04-25.03 - Carl 25/04/2009 8:44.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.61.1033.18.2045.1042 [GMT 10:00]
Running from: c:\users\Carl\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-4-24 )))))))))))))))))))))))))))))))
.

2009-04-24 10:12 . 2009-04-24 10:12 2999256 ----a-r C:\ComboFix.exe
2009-04-23 08:19 . 2009-04-23 09:25 -------- d-----w C:\Rooter$
2009-04-18 05:12 . 2009-04-18 05:13 108032 ----a-w c:\windows\system32\winsetup66.exe
2009-04-18 05:07 . 2009-04-18 05:07 118 ----a-w c:\windows\system32\MRT.INI
2009-04-18 05:01 . 2009-04-18 05:01 -------- d-sh--w c:\windows\system32\%APPDATA%
2009-04-18 04:23 . 2009-04-18 04:24 -------- d-----w C:\rsit
2009-04-18 04:15 . 2008-12-06 04:42 376832 ----a-w c:\windows\system32\winhttp.dll
2009-04-18 04:15 . 2008-06-06 03:27 38912 ----a-w c:\windows\system32\xolehlp.dll
2009-04-18 04:15 . 2008-06-06 03:27 562176 ----a-w c:\windows\system32\msdtcprx.dll
2009-04-18 04:15 . 2009-03-03 04:46 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-04-18 04:15 . 2009-03-03 04:39 551424 ----a-w c:\windows\system32\rpcss.dll
2009-04-18 04:15 . 2009-03-03 04:46 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-04-18 04:15 . 2009-03-03 04:39 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-04-18 04:15 . 2009-03-03 04:39 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-04-18 04:15 . 2009-03-03 04:37 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-04-18 04:15 . 2009-03-03 03:04 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-04-18 04:14 . 2009-03-03 04:37 54784 ----a-w c:\windows\system32\iasads.dll
2009-04-18 04:14 . 2009-03-03 04:37 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-04-18 04:14 . 2009-03-03 02:38 17408 ----a-w c:\windows\system32\iashost.exe
2009-04-18 04:13 . 2009-02-13 08:49 1255936 ----a-w c:\windows\system32\lsasrv.dll
2009-04-18 04:13 . 2009-02-13 08:49 72704 ----a-w c:\windows\system32\secur32.dll
2009-04-18 04:13 . 2009-03-17 03:38 13824 ----a-w c:\windows\system32\apilogen.dll
2009-04-18 04:13 . 2009-03-17 03:38 24064 ----a-w c:\windows\system32\amxread.dll
2009-04-12 03:03 . 2009-04-12 03:03 -------- d-----w c:\program files\Trend Micro
2009-04-11 06:29 . 2009-03-19 06:32 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-11 06:29 . 2008-04-17 02:12 107368 ----a-w c:\windows\system32\GEARAspi.dll
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\program files\iPod
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\users\All Users\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\program files\iTunes
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\progra~2\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-11 06:26 . 2009-04-11 06:26 -------- d-----w c:\program files\Bonjour
2009-04-08 13:03 . 2009-04-08 13:03 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-08 13:00 . 2009-04-08 13:00 -------- d-----w c:\users\Carl\AppData\Roaming\InstallShield
2009-04-03 16:02 . 2009-04-03 18:03 128000 ----a-w c:\windows\system32\winsetup63.exe
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\waverspw.dat
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\pcadg.dat
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\ogldrcsg.dat
2009-03-31 11:45 . 2009-03-31 11:45 153 ----a-w c:\windows\system32\KBDHE2D0.dat
2009-03-31 11:45 . 2009-03-31 11:45 0 ----a-w c:\windows\system32\psbape.dat
2009-03-31 11:45 . 2009-03-31 11:45 139264 ----a-w c:\windows\system32\mfr532.exe
2009-03-29 00:45 . 2009-03-29 00:44 25136 ----a-r c:\windows\system32\drivers\SymIMV.sys
2009-03-29 00:45 . 2009-03-29 00:45 -------- d-----w c:\program files\Symantec
2009-03-29 00:45 . 2009-03-29 00:45 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-03-29 00:45 . 2009-03-29 00:45 7386 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-03-29 00:45 . 2009-03-29 00:45 124464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-03-29 00:44 . 2009-03-29 00:44 -------- d-----w c:\windows\system32\drivers\NAV
2009-03-29 00:43 . 2009-03-29 00:44 -------- d-----w c:\program files\Norton AntiVirus
2009-03-29 00:43 . 2009-03-29 00:46 -------- d-----w c:\users\All Users\Norton
2009-03-29 00:43 . 2009-03-29 00:46 -------- d-----w c:\progra~2\Norton
2009-03-29 00:40 . 2009-03-29 00:40 -------- d-sh--w C:\$RECYCLE.BIN
2009-03-29 00:30 . 2009-03-29 00:41 -------- d-----w c:\users\All Users\NortonInstaller
2009-03-29 00:30 . 2009-03-29 00:41 -------- d-----w c:\progra~2\NortonInstaller
2009-03-29 00:30 . 2009-03-29 00:30 -------- d-----w c:\program files\NortonInstaller
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\users\Carl\AppData\Roaming\Malwarebytes
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\users\All Users\Malwarebytes
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\progra~2\Malwarebytes
2009-03-27 05:52 . 2009-03-27 05:52 -------- d-----w c:\program files\AVG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-24 11:13 . 2007-06-23 07:24 12978 ----a-w c:\users\Carl\AppData\Roaming\nvModes.dat
2009-04-23 09:06 . 2007-07-02 12:08 1356 ----a-w c:\users\Carl\AppData\Local\d3d9caps.dat
2009-04-21 13:56 . 2007-02-26 23:40 -------- d-----w c:\program files\Java
2009-04-18 05:26 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-18 05:05 . 2007-02-27 00:44 -------- d-----w c:\progra~2\Microsoft Help
2009-04-12 00:35 . 2008-12-17 07:30 -------- d-----w c:\progra~2\Lx_cats
2009-04-11 06:28 . 2007-07-03 06:45 -------- d-----w c:\program files\Common Files\Apple
2009-04-09 21:51 . 2009-04-09 21:51 271455 ----a-w c:\users\All Users\SPL3E76.tmp
2009-04-09 21:51 . 2009-04-09 21:51 271455 ----a-w c:\progra~2\SPL3E76.tmp
2009-04-08 11:49 . 2008-06-03 02:49 -------- d-----w c:\users\Carl\AppData\Roaming\LimeWire
2009-04-07 11:03 . 2007-06-23 05:45 121112 ----a-w c:\users\Carl\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-07 10:51 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstor.dat
2009-04-07 10:51 . 2006-11-02 10:25 51200 ----a-w c:\windows\Inf\infpub.dat
2009-04-07 10:51 . 2006-11-02 10:25 143360 ----a-w c:\windows\Inf\infstrng.dat
2009-04-07 10:50 . 2009-01-23 12:23 -------- d-----w c:\program files\Common Files\Nokia
2009-04-01 21:33 . 2009-04-01 21:33 249997 ----a-w c:\users\All Users\SPLE44.tmp
2009-04-01 21:33 . 2009-04-01 21:33 249997 ----a-w c:\progra~2\SPLE44.tmp
2009-03-29 06:47 . 2008-08-13 09:00 -------- d-----w c:\progra~2\Symantec
2009-03-29 00:52 . 2007-06-23 06:00 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-28 08:37 . 2007-08-23 00:59 -------- d-----w c:\program files\Google
2009-03-27 23:19 . 2009-03-27 23:19 84654 ----a-w c:\users\All Users\SPL47F7.tmp
2009-03-27 23:19 . 2009-03-27 23:19 84654 ----a-w c:\progra~2\SPL47F7.tmp
2009-03-27 23:03 . 2009-03-27 23:03 84654 ----a-w c:\users\All Users\SPLB0DB.tmp
2009-03-27 23:03 . 2009-03-27 23:03 84654 ----a-w c:\progra~2\SPLB0DB.tmp
2009-03-20 07:00 . 2009-03-20 07:00 -------- d-----w c:\program files\Common Files\supportsoft
2009-03-20 06:58 . 2009-03-20 06:53 -------- d-----w c:\progra~2\Intuit
2009-03-20 06:55 . 2009-03-20 06:53 -------- d-----w c:\program files\Common Files\Intuit
2009-03-20 06:54 . 2009-03-20 06:54 -------- d-----w c:\program files\Common Files\AnswerWorks 4.0
2009-03-20 06:53 . 2009-03-20 06:53 -------- d-----w c:\program files\Intuit
2009-03-20 06:51 . 2009-03-20 06:51 -------- d-----w c:\progra~2\COMMON FILES
2009-03-19 06:18 . 2008-12-07 22:59 -------- d-----w c:\program files\PeerGuardian2
2009-03-19 05:32 . 2007-09-03 01:52 -------- d-----w c:\program files\Microsoft SQL Server
2009-03-17 03:38 . 2009-04-18 04:13 40960 ----a-w c:\windows\AppPatch\apihex86.dll
2009-03-17 02:23 . 2007-02-26 22:31 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-17 01:44 . 2007-07-19 04:20 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-16 17:48 . 2007-06-24 01:01 -------- d-----w c:\program files\Common Files\Adobe
2009-03-14 00:53 . 2009-03-14 00:53 -------- d-----w c:\progra~2\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-14 00:49 . 2009-03-14 00:48 -------- d-----w c:\program files\QuickTime
2009-03-08 23:18 . 2007-06-27 04:26 -------- d-----w c:\program files\Call of Duty Game of the Year Edition
2009-03-08 19:19 . 2008-12-13 14:11 410984 ----a-w c:\windows\System32\deploytk.dll
2009-03-08 11:34 . 2009-03-31 07:22 914944 ----a-w c:\windows\System32\wininet.dll
2009-03-08 11:34 . 2009-03-31 07:22 43008 ----a-w c:\windows\System32\licmgr10.dll
2009-03-08 11:33 . 2009-03-31 07:22 18944 ----a-w c:\windows\System32\corpol.dll
2009-03-08 11:33 . 2009-03-31 07:22 109056 ----a-w c:\windows\System32\iesysprep.dll
2009-03-08 11:33 . 2009-03-31 07:22 109568 ----a-w c:\windows\System32\PDMSetup.exe
2009-03-08 11:33 . 2009-03-31 07:22 132608 ----a-w c:\windows\System32\ieUnatt.exe
2009-03-08 11:33 . 2009-03-31 07:22 107520 ----a-w c:\windows\System32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-03-31 07:22 107008 ----a-w c:\windows\System32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-03-31 07:22 103936 ----a-w c:\windows\System32\SetDepNx.exe
2009-03-08 11:33 . 2009-03-31 07:22 420352 ----a-w c:\windows\System32\vbscript.dll
2009-03-08 11:32 . 2009-03-31 07:22 72704 ----a-w c:\windows\System32\admparse.dll
2009-03-08 11:32 . 2009-03-31 07:22 71680 ----a-w c:\windows\System32\iesetup.dll
2009-03-08 11:32 . 2009-03-31 07:22 66560 ----a-w c:\windows\System32\wextract.exe
2009-03-08 11:32 . 2009-03-31 07:22 169472 ----a-w c:\windows\System32\iexpress.exe
2009-03-08 11:31 . 2009-03-31 07:22 34816 ----a-w c:\windows\System32\imgutil.dll
2009-03-08 11:31 . 2009-03-31 07:22 48128 ----a-w c:\windows\System32\mshtmler.dll
2009-03-08 11:31 . 2009-03-31 07:22 45568 ----a-w c:\windows\System32\mshta.exe
2009-03-08 11:22 . 2009-03-31 07:22 156160 ----a-w c:\windows\System32\msls31.dll
2009-03-04 10:51 . 2007-09-07 07:20 -------- d-----w c:\program files\DOOM 3
2009-03-04 00:56 . 2007-07-05 11:05 -------- d-----w c:\program files\Brownie
2009-03-04 00:56 . 2008-12-17 07:16 -------- d-----w c:\program files\Abbyy FineReader 6.0 Sprint
2009-03-04 00:55 . 2007-07-19 04:20 -------- d-----w c:\progra~2\Spybot - Search & Destroy
2009-03-04 00:55 . 2009-01-20 13:00 -------- d-----w c:\program files\PC Connectivity Solution
2009-03-04 00:55 . 2007-06-23 05:39 -------- d-----w c:\program files\Protector Suite QL
2009-03-04 00:55 . 2007-02-27 00:48 -------- d-----w c:\program files\Microsoft Works
2009-03-01 11:55 . 2008-11-20 07:11 -------- d-----w c:\users\Carl\AppData\Roaming\FrostWire
2009-02-09 03:10 . 2009-03-11 04:07 2033152 ----a-w c:\windows\System32\win32k.sys
2008-12-29 08:08 . 2008-12-29 08:08 34056 ----a-w c:\users\All Users\SPL1C47.tmp
2008-12-29 08:08 . 2008-12-29 08:08 34056 ----a-w c:\progra~2\SPL1C47.tmp
2008-12-29 08:06 . 2008-12-29 08:06 34056 ----a-w c:\users\All Users\SPL273.tmp
2008-12-29 08:06 . 2008-12-29 08:06 34056 ----a-w c:\progra~2\SPL273.tmp
2008-12-29 06:52 . 2008-12-29 06:52 129662 ----a-w c:\users\All Users\SPLA4C6.tmp
2008-12-29 06:52 . 2008-12-29 06:52 129662 ----a-w c:\progra~2\SPLA4C6.tmp
2008-12-28 22:37 . 2008-12-28 22:37 129662 ----a-w c:\users\All Users\SPL26E4.tmp
2008-12-28 22:37 . 2008-12-28 22:37 129662 ----a-w c:\progra~2\SPL26E4.tmp
2008-12-28 22:35 . 2008-12-28 22:35 129662 ----a-w c:\users\All Users\SPL9E9A.tmp
2008-12-28 22:35 . 2008-12-28 22:35 129662 ----a-w c:\progra~2\SPL9E9A.tmp
2008-05-27 04:35 . 2007-11-25 21:52 22328 ----a-w c:\users\Carl\AppData\Roaming\PnkBstrK.sys
2008-05-24 01:55 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
2007-11-25 22:02 . 2007-11-25 22:02 92 ----a-w c:\users\Carl\AppData\Local\fusioncache.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-04-24_10.28.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-02-26 21:31 . 2009-04-24 22:38 78690 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2007-02-26 21:31 . 2009-04-24 10:29 78690 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-04-24 22:38 78110 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-06-23 05:46 . 2009-04-24 22:38 22322 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1882435643-3835081554-1223697280-1000_UserData.bin
- 2007-06-23 20:58 . 2009-04-24 10:28 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-06-23 20:58 . 2009-04-24 22:52 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-06-23 20:58 . 2009-04-24 10:28 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-06-23 20:58 . 2009-04-24 22:52 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-04-24 22:49 . 2009-04-24 22:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-04-24 22:49 . 2009-04-24 22:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2007-06-23 21:32 . 2009-04-24 11:13 316180 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2007-06-23 20:58 . 2009-04-24 22:52 245760 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-06-23 20:58 . 2009-04-24 10:28 245760 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2006-11-02 12:47 . 2009-04-24 22:53 262144 c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2006-11-02 12:47 . 2009-04-24 10:28 262144 c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2006-11-02 12:47 . 2009-04-24 10:28 262144 c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2006-11-02 12:47 . 2009-04-24 22:53 262144 c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-11-28 01:36 . 2009-04-24 10:15 2332936 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2008-11-28 01:36 . 2009-04-24 22:48 2332936 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\kbdhe2d0]
@="{C2F2E748-E7D6-0E58-35E0-D780ABE07D4C}"
[HKEY_CLASSES_ROOT\CLSID\{C2F2E748-E7D6-0E58-35E0-D780ABE07D4C}]
2006-11-02 09:39 126976 ----a-w c:\windows\system32\KBDHE2D0.dIl

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-11-14 02:22 3186440 ----a-w c:\program files\Protector Suite QL\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-11-14 02:22 3186440 ----a-w c:\program files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2007-06-02 1457152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-07 34352]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-02-13 405504]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-20 411768]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-01-19 448632]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-01-17 534648]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-19 1316136]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-22 842584]
"PS121v2"="c:\program files\NETGEAR\PS121v2\PS121v2.exe" [2006-08-25 724992]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-07-26 204800]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2007-11-14 49416]
"lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136]
"lxdnamon"="c:\program files\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-12-17 320168]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-13 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-13 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-13 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-08 148888]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-01-18 4349952]
"NDSTray.exe"="NDSTray.exe" [BU]

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-2-2 2756608]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2007-8-16 118784]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-30 969792]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-11-14 02:07 96008 ----a-w c:\windows\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{22EFF41D-631D-40C9-989D-2712EF8D50A0}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= UDP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"UDP Query User{DAF6DF97-1477-4D7D-A48F-B853C976638A}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= TCP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"TCP Query User{F8658306-F07E-42BB-B00A-8D25053DA4E4}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{B08A1C9C-5466-4A99-83B5-B29606D574E9}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"TCP Query User{C262F8E5-9AD3-4FA5-81D3-D7AAA951F14A}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"= UDP:c:\windows\system32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"UDP Query User{FBA97FCB-AE9B-4A09-A619-C3C842206897}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"= TCP:c:\windows\system32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"TCP Query User{078EFE2F-F6A8-483B-BCEF-C6CC64A586B6}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= UDP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"UDP Query User{73C9C2C1-6022-49E7-810A-F7C36548FB22}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= TCP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"TCP Query User{596CF229-D0B6-4322-A74C-EB5EC1A616A2}c:\\users\\carl\\appdata\\local\\temp\\lmi6c0c.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi6c0c.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{D8F09C2A-6EAD-4CE8-9D25-25ABE7EED859}c:\\users\\carl\\appdata\\local\\temp\\lmi6c0c.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi6c0c.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{56EF1469-FCC7-4931-AF1A-BD2C1B92B8F1}c:\\users\\temp\\appdata\\local\\temp\\lmic5b0.tmp\\lmi_rescue.exe"= UDP:c:\users\temp\appdata\local\temp\lmic5b0.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{580923D4-ED9E-467C-9FEA-989B9276ED30}c:\\users\\temp\\appdata\\local\\temp\\lmic5b0.tmp\\lmi_rescue.exe"= TCP:c:\users\temp\appdata\local\temp\lmic5b0.tmp\lmi_rescue.exe:LogMeIn Rescue
"{C33BE070-A998-41CB-BACE-8C60A8A0EF51}"= UDP:c:\users\TEMP\AppData\Local\Temp\7zSCFB.tmp\SymNRT.exe:Norton Removal Tool
"{FA88B3A9-6139-42D9-B7A6-04C37DA5C339}"= TCP:c:\users\TEMP\AppData\Local\Temp\7zSCFB.tmp\SymNRT.exe:Norton Removal Tool
"TCP Query User{80264584-7F58-4ABF-B9C5-320A685B756C}c:\\users\\carl\\appdata\\local\\temp\\lmi83f0.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi83f0.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{4C564DC5-23E1-4372-80F8-01975EC8EBE0}c:\\users\\carl\\appdata\\local\\temp\\lmi83f0.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi83f0.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{868DF9FD-4144-4420-9CA6-3407D74B657B}c:\\users\\carl\\appdata\\local\\temp\\lmi67c9.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi67c9.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{79930D5F-60F2-44F1-BE6A-3E4DFF4EA24D}c:\\users\\carl\\appdata\\local\\temp\\lmi67c9.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi67c9.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{0983364B-1583-4A6B-8C0D-D7691316EEA4}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{4554DACF-6B06-4781-B56E-9B463BF38268}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"TCP Query User{712C9F86-FB44-4CDB-AE61-5E61471A71AD}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{AF6CD684-2B19-4C66-A844-DF67C48C555C}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{E5C44461-D1BC-4DD4-9BCE-97B59B2131F6}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B8349452-B959-44E6-B871-956E454EB8DC}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{225DADB3-12AE-4BDB-A386-A027B6F633F5}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{1941303B-DA35-4EBB-9A9E-A3DCAE43B1B9}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{3366980F-648C-4DE1-AC9F-1890073D4019}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{E66F7B7A-9FCD-416C-A009-9329CCFD157C}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F79F2373-27D2-4239-B302-D9034484898B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{0DA2CFD5-C10A-4F09-A2EF-553FC6DDF668}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2007-12-05 98984]
R3 MBAMSwissArmy;MBAMSwissArmy; [x]
R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
R3 NETGEARUCOMP;NETGEAR Network USB Composite Device;c:\windows\system32\DRIVERS\NETGEARUCOMP.sys [2006-08-17 11648]
R3 TpChoice;Touch Pad Detection Filter driver; [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SYMEFA.SYS [2009-03-29 310320]
S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [2009-03-29 258608]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\ccHPx86.sys [2009-03-29 482352]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090414.001\IDSvix86.sys [2009-03-29 292912]
S2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-11 30312]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-12-05 594600]
S2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [2009-03-29 115560]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-29 101936]
S3 NETGEARUHOST;NETGEAR Network USB Host Controller;c:\windows\system32\DRIVERS\NETGEARUHOST.sys [2006-08-17 10752]
S3 NETGEARUHUB;NETGEAR Network USB Root Hub;c:\windows\system32\DRIVERS\NETGEARUHUB.sys [2006-08-17 37120]
S3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\NAV\1005000.086\SYMNDISV.SYS [2009-03-29 39984]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{55f7c04d-a50f-11dc-b9b1-0016d4f956e8}]
\shell\1\Command - RUNAUT~1\autorun.pif
\shell\2\Command - RUNAUT~1\autorun.pif
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNAUT~1\autorun.pif

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-25 08:53
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(888)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infql2.dll

- - - - - - - > 'Explorer.exe'(5624)
c:\program files\Protector Suite QL\farchns.dll
c:\program files\Protector Suite QL\infql2.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\System32\audiodg.exe
c:\program files\Protector Suite QL\upeksvr.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\System32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Protector Suite QL\psqltray.exe
c:\program files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
c:\windows\System32\rundll32.exe
c:\program files\Lexmark 2600 Series\lxdnmsdmon.exe
c:\program files\Synaptics\SynTP\SynToshiba.exe
c:\program files\TOSHIBA\ConfigFree\CFSwMgr.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosAVRC.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosOBEX.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
.
**************************************************************************
.
Completion time: 2009-04-24 8:56 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-24 22:56
ComboFix2.txt 2009-04-24 10:35

Pre-Run: 123,795,996,672 bytes free
Post-Run: 123,721,744,384 bytes free

369 --- E O F --- 2009-04-23 19:00

[Shaba]

Open notepad and copy/paste the text in the codebox below into it:


File::
c:\windows\system32\winsetup66.exe
c:\windows\system32\winsetup63.exe

Folder::
c:\users\Carl\AppData\Roaming\FrostWire

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{55f7c04d-a50f-11dc-b9b1-0016d4f956e8}]


Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

[L5Brassco]

ComboFix offered a newer version of itself then ran ok
Here is the log

ComboFix 09-04-25.A1 - Carl 25/04/2009 22:51.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.61.1033.18.2045.1102 [GMT 10:00]
Running from: c:\users\Carl\Desktop\ComboFix.exe
Command switches used :: c:\users\Carl\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\system32\winsetup63.exe
c:\windows\system32\winsetup66.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Carl\AppData\Roaming\FrostWire
c:\users\Carl\AppData\Roaming\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe
c:\users\Carl\AppData\Roaming\FrostWire\checkandupdate.txt
c:\users\Carl\AppData\Roaming\FrostWire\createtimes.cache
c:\users\Carl\AppData\Roaming\FrostWire\downloads.dat
c:\users\Carl\AppData\Roaming\FrostWire\fileurns.bak
c:\users\Carl\AppData\Roaming\FrostWire\fileurns.cache
c:\users\Carl\AppData\Roaming\FrostWire\filters.props
c:\users\Carl\AppData\Roaming\FrostWire\frostwire.props
c:\users\Carl\AppData\Roaming\FrostWire\gnutella.net
c:\users\Carl\AppData\Roaming\FrostWire\installation.props
c:\users\Carl\AppData\Roaming\FrostWire\intent.props
c:\users\Carl\AppData\Roaming\FrostWire\library.dat
c:\users\Carl\AppData\Roaming\FrostWire\mojito.props
c:\users\Carl\AppData\Roaming\FrostWire\questions.props
c:\users\Carl\AppData\Roaming\FrostWire\responses.cache
c:\users\Carl\AppData\Roaming\FrostWire\simpp.xml
c:\users\Carl\AppData\Roaming\FrostWire\spam.dat
c:\users\Carl\AppData\Roaming\FrostWire\tables.props
c:\users\Carl\AppData\Roaming\FrostWire\themes\frostwirePro_theme.fwtp
c:\users\Carl\AppData\Roaming\FrostWire\themes\frostwirePro_theme\theme.txt
c:\users\Carl\AppData\Roaming\FrostWire\themes\frostwirePro_theme\version.txt
c:\users\Carl\AppData\Roaming\FrostWire\ttrees.cache
c:\users\Carl\AppData\Roaming\FrostWire\ttroot.cache
c:\users\Carl\AppData\Roaming\FrostWire\version.xml
c:\users\Carl\AppData\Roaming\FrostWire\xml\data\audio.sxml2
c:\users\Carl\AppData\Roaming\FrostWire\xml\data\image.sxml2
c:\users\Carl\AppData\Roaming\FrostWire\xml\data\video.sxml2
c:\windows\system32\winsetup63.exe
c:\windows\system32\winsetup66.exe

.
((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-4-25 )))))))))))))))))))))))))))))))
.

2009-04-24 10:12 . 2009-04-24 10:12 2999256 ----a-r C:\ComboFix.exe
2009-04-23 08:19 . 2009-04-23 09:25 -------- d-----w C:\Rooter$
2009-04-18 05:07 . 2009-04-18 05:07 118 ----a-w c:\windows\system32\MRT.INI
2009-04-18 05:01 . 2009-04-18 05:01 -------- d-sh--w c:\windows\system32\%APPDATA%
2009-04-18 04:23 . 2009-04-18 04:24 -------- d-----w C:\rsit
2009-04-18 04:15 . 2008-12-06 04:42 376832 ----a-w c:\windows\system32\winhttp.dll
2009-04-18 04:15 . 2008-06-06 03:27 38912 ----a-w c:\windows\system32\xolehlp.dll
2009-04-18 04:15 . 2008-06-06 03:27 562176 ----a-w c:\windows\system32\msdtcprx.dll
2009-04-18 04:15 . 2009-03-03 04:46 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-04-18 04:15 . 2009-03-03 04:39 551424 ----a-w c:\windows\system32\rpcss.dll
2009-04-18 04:15 . 2009-03-03 04:46 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-04-18 04:15 . 2009-03-03 04:39 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-04-18 04:15 . 2009-03-03 04:39 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-04-18 04:15 . 2009-03-03 04:37 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-04-18 04:15 . 2009-03-03 03:04 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-04-18 04:14 . 2009-03-03 04:37 54784 ----a-w c:\windows\system32\iasads.dll
2009-04-18 04:14 . 2009-03-03 04:37 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-04-18 04:14 . 2009-03-03 02:38 17408 ----a-w c:\windows\system32\iashost.exe
2009-04-18 04:13 . 2009-02-13 08:49 1255936 ----a-w c:\windows\system32\lsasrv.dll
2009-04-18 04:13 . 2009-02-13 08:49 72704 ----a-w c:\windows\system32\secur32.dll
2009-04-18 04:13 . 2009-03-17 03:38 13824 ----a-w c:\windows\system32\apilogen.dll
2009-04-18 04:13 . 2009-03-17 03:38 24064 ----a-w c:\windows\system32\amxread.dll
2009-04-12 03:03 . 2009-04-12 03:03 -------- d-----w c:\program files\Trend Micro
2009-04-11 06:29 . 2009-03-19 06:32 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-11 06:29 . 2008-04-17 02:12 107368 ----a-w c:\windows\system32\GEARAspi.dll
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\program files\iPod
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\users\All Users\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-11 06:28 . 2009-04-11 06:28 -------- d-----w c:\program files\iTunes
2009-04-11 06:26 . 2009-04-11 06:26 -------- d-----w c:\program files\Bonjour
2009-04-08 13:03 . 2009-04-08 13:03 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-08 13:00 . 2009-04-08 13:00 -------- d-----w c:\users\Carl\AppData\Roaming\InstallShield
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\waverspw.dat
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\pcadg.dat
2009-03-31 11:45 . 2009-03-31 12:57 66 ----a-w c:\windows\system32\ogldrcsg.dat
2009-03-31 11:45 . 2009-03-31 11:45 153 ----a-w c:\windows\system32\KBDHE2D0.dat
2009-03-31 11:45 . 2009-03-31 11:45 0 ----a-w c:\windows\system32\psbape.dat
2009-03-31 11:45 . 2009-03-31 11:45 139264 ----a-w c:\windows\system32\mfr532.exe
2009-03-29 00:45 . 2009-03-29 00:44 25136 ----a-r c:\windows\system32\drivers\SymIMV.sys
2009-03-29 00:45 . 2009-03-29 00:45 -------- d-----w c:\program files\Symantec
2009-03-29 00:45 . 2009-03-29 00:45 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-03-29 00:45 . 2009-03-29 00:45 7386 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-03-29 00:45 . 2009-03-29 00:45 124464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-03-29 00:44 . 2009-03-29 00:44 -------- d-----w c:\windows\system32\drivers\NAV
2009-03-29 00:43 . 2009-03-29 00:44 -------- d-----w c:\program files\Norton AntiVirus
2009-03-29 00:43 . 2009-03-29 00:46 -------- d-----w c:\users\All Users\Norton
2009-03-29 00:43 . 2009-03-29 00:46 -------- d-----w c:\programdata\Norton
2009-03-29 00:40 . 2009-03-29 00:40 -------- d-sh--w C:\$RECYCLE.BIN
2009-03-29 00:30 . 2009-03-29 00:41 -------- d-----w c:\users\All Users\NortonInstaller
2009-03-29 00:30 . 2009-03-29 00:41 -------- d-----w c:\programdata\NortonInstaller
2009-03-29 00:30 . 2009-03-29 00:30 -------- d-----w c:\program files\NortonInstaller
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\users\Carl\AppData\Roaming\Malwarebytes
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\users\All Users\Malwarebytes
2009-03-28 05:25 . 2009-03-28 05:25 -------- d-----w c:\programdata\Malwarebytes
2009-03-27 05:52 . 2009-03-27 05:52 -------- d-----w c:\program files\AVG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-25 12:39 . 2007-06-23 07:24 12978 ----a-w c:\users\Carl\AppData\Roaming\nvModes.dat
2009-04-23 09:06 . 2007-07-02 12:08 1356 ----a-w c:\users\Carl\AppData\Local\d3d9caps.dat
2009-04-21 13:56 . 2007-02-26 23:40 -------- d-----w c:\program files\Java
2009-04-18 05:26 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-18 05:05 . 2007-02-27 00:44 -------- d-----w c:\programdata\Microsoft Help
2009-04-12 00:35 . 2008-12-17 07:30 -------- d-----w c:\programdata\Lx_cats
2009-04-11 06:28 . 2007-07-03 06:45 -------- d-----w c:\program files\Common Files\Apple
2009-04-09 21:51 . 2009-04-09 21:51 271455 ----a-w c:\users\All Users\SPL3E76.tmp
2009-04-09 21:51 . 2009-04-09 21:51 271455 ----a-w c:\programdata\SPL3E76.tmp
2009-04-08 11:49 . 2008-06-03 02:49 -------- d-----w c:\users\Carl\AppData\Roaming\LimeWire
2009-04-07 11:03 . 2007-06-23 05:45 121112 ----a-w c:\users\Carl\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-07 10:51 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstor.dat
2009-04-07 10:51 . 2006-11-02 10:25 51200 ----a-w c:\windows\Inf\infpub.dat
2009-04-07 10:51 . 2006-11-02 10:25 143360 ----a-w c:\windows\Inf\infstrng.dat
2009-04-07 10:50 . 2009-01-23 12:23 -------- d-----w c:\program files\Common Files\Nokia
2009-04-01 21:33 . 2009-04-01 21:33 249997 ----a-w c:\users\All Users\SPLE44.tmp
2009-04-01 21:33 . 2009-04-01 21:33 249997 ----a-w c:\programdata\SPLE44.tmp
2009-03-29 06:47 . 2008-08-13 09:00 -------- d-----w c:\programdata\Symantec
2009-03-29 00:52 . 2007-06-23 06:00 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-28 08:37 . 2007-08-23 00:59 -------- d-----w c:\program files\Google
2009-03-27 23:19 . 2009-03-27 23:19 84654 ----a-w c:\users\All Users\SPL47F7.tmp
2009-03-27 23:19 . 2009-03-27 23:19 84654 ----a-w c:\programdata\SPL47F7.tmp
2009-03-27 23:03 . 2009-03-27 23:03 84654 ----a-w c:\users\All Users\SPLB0DB.tmp
2009-03-27 23:03 . 2009-03-27 23:03 84654 ----a-w c:\programdata\SPLB0DB.tmp
2009-03-20 07:00 . 2009-03-20 07:00 -------- d-----w c:\program files\Common Files\supportsoft
2009-03-20 06:58 . 2009-03-20 06:53 -------- d-----w c:\programdata\Intuit
2009-03-20 06:55 . 2009-03-20 06:53 -------- d-----w c:\program files\Common Files\Intuit
2009-03-20 06:54 . 2009-03-20 06:54 -------- d-----w c:\program files\Common Files\AnswerWorks 4.0
2009-03-20 06:53 . 2009-03-20 06:53 -------- d-----w c:\program files\Intuit
2009-03-20 06:51 . 2009-03-20 06:51 -------- d-----w c:\programdata\COMMON FILES
2009-03-19 06:18 . 2008-12-07 22:59 -------- d-----w c:\program files\PeerGuardian2
2009-03-19 05:32 . 2007-09-03 01:52 -------- d-----w c:\program files\Microsoft SQL Server
2009-03-17 03:38 . 2009-04-18 04:13 40960 ----a-w c:\windows\AppPatch\apihex86.dll
2009-03-17 02:23 . 2007-02-26 22:31 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-17 01:44 . 2007-07-19 04:20 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-16 17:48 . 2007-06-24 01:01 -------- d-----w c:\program files\Common Files\Adobe
2009-03-14 00:53 . 2009-03-14 00:53 -------- d-----w c:\programdata\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-14 00:49 . 2009-03-14 00:48 -------- d-----w c:\program files\QuickTime
2009-03-08 23:18 . 2007-06-27 04:26 -------- d-----w c:\program files\Call of Duty Game of the Year Edition
2009-03-08 19:19 . 2008-12-13 14:11 410984 ----a-w c:\windows\System32\deploytk.dll
2009-03-08 11:34 . 2009-03-31 07:22 914944 ----a-w c:\windows\System32\wininet.dll
2009-03-08 11:34 . 2009-03-31 07:22 43008 ----a-w c:\windows\System32\licmgr10.dll
2009-03-08 11:33 . 2009-03-31 07:22 18944 ----a-w c:\windows\System32\corpol.dll
2009-03-08 11:33 . 2009-03-31 07:22 109056 ----a-w c:\windows\System32\iesysprep.dll
2009-03-08 11:33 . 2009-03-31 07:22 109568 ----a-w c:\windows\System32\PDMSetup.exe
2009-03-08 11:33 . 2009-03-31 07:22 132608 ----a-w c:\windows\System32\ieUnatt.exe
2009-03-08 11:33 . 2009-03-31 07:22 107520 ----a-w c:\windows\System32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-03-31 07:22 107008 ----a-w c:\windows\System32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-03-31 07:22 103936 ----a-w c:\windows\System32\SetDepNx.exe
2009-03-08 11:33 . 2009-03-31 07:22 420352 ----a-w c:\windows\System32\vbscript.dll
2009-03-08 11:32 . 2009-03-31 07:22 72704 ----a-w c:\windows\System32\admparse.dll
2009-03-08 11:32 . 2009-03-31 07:22 71680 ----a-w c:\windows\System32\iesetup.dll
2009-03-08 11:32 . 2009-03-31 07:22 66560 ----a-w c:\windows\System32\wextract.exe
2009-03-08 11:32 . 2009-03-31 07:22 169472 ----a-w c:\windows\System32\iexpress.exe
2009-03-08 11:31 . 2009-03-31 07:22 34816 ----a-w c:\windows\System32\imgutil.dll
2009-03-08 11:31 . 2009-03-31 07:22 48128 ----a-w c:\windows\System32\mshtmler.dll
2009-03-08 11:31 . 2009-03-31 07:22 45568 ----a-w c:\windows\System32\mshta.exe
2009-03-08 11:22 . 2009-03-31 07:22 156160 ----a-w c:\windows\System32\msls31.dll
2009-03-04 10:51 . 2007-09-07 07:20 -------- d-----w c:\program files\DOOM 3
2009-03-04 00:56 . 2007-07-05 11:05 -------- d-----w c:\program files\Brownie
2009-03-04 00:56 . 2008-12-17 07:16 -------- d-----w c:\program files\Abbyy FineReader 6.0 Sprint
2009-03-04 00:55 . 2007-07-19 04:20 -------- d-----w c:\programdata\Spybot - Search & Destroy
2009-03-04 00:55 . 2009-01-20 13:00 -------- d-----w c:\program files\PC Connectivity Solution
2009-03-04 00:55 . 2007-06-23 05:39 -------- d-----w c:\program files\Protector Suite QL
2009-03-04 00:55 . 2007-02-27 00:48 -------- d-----w c:\program files\Microsoft Works
2009-02-09 03:10 . 2009-03-11 04:07 2033152 ----a-w c:\windows\System32\win32k.sys
2008-12-29 08:08 . 2008-12-29 08:08 34056 ----a-w c:\users\All Users\SPL1C47.tmp
2008-12-29 08:08 . 2008-12-29 08:08 34056 ----a-w c:\programdata\SPL1C47.tmp
2008-12-29 08:06 . 2008-12-29 08:06 34056 ----a-w c:\users\All Users\SPL273.tmp
2008-12-29 08:06 . 2008-12-29 08:06 34056 ----a-w c:\programdata\SPL273.tmp
2008-12-29 06:52 . 2008-12-29 06:52 129662 ----a-w c:\users\All Users\SPLA4C6.tmp
2008-12-29 06:52 . 2008-12-29 06:52 129662 ----a-w c:\programdata\SPLA4C6.tmp
2008-12-28 22:37 . 2008-12-28 22:37 129662 ----a-w c:\users\All Users\SPL26E4.tmp
2008-12-28 22:37 . 2008-12-28 22:37 129662 ----a-w c:\programdata\SPL26E4.tmp
2008-12-28 22:35 . 2008-12-28 22:35 129662 ----a-w c:\users\All Users\SPL9E9A.tmp
2008-12-28 22:35 . 2008-12-28 22:35 129662 ----a-w c:\programdata\SPL9E9A.tmp
2008-05-27 04:35 . 2007-11-25 21:52 22328 ----a-w c:\users\Carl\AppData\Roaming\PnkBstrK.sys
2008-05-24 01:55 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
2007-11-25 22:02 . 2007-11-25 22:02 92 ----a-w c:\users\Carl\AppData\Local\fusioncache.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-04-24_10.28.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-02-26 21:31 . 2009-04-25 12:30 78690 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2007-02-26 21:31 . 2009-04-24 10:29 78690 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-04-25 13:00 78158 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-06-23 05:46 . 2009-04-25 12:30 22354 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1882435643-3835081554-1223697280-1000_UserData.bin
- 2007-06-23 20:58 . 2009-04-24 10:28 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-06-23 20:58 . 2009-04-25 12:59 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-06-23 20:58 . 2009-04-24 10:28 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-06-23 20:58 . 2009-04-25 12:59 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-04-25 12:56 . 2009-04-25 12:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-04-25 12:56 . 2009-04-25 12:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2007-06-23 21:32 . 2009-04-24 11:13 316180 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2006-11-02 12:43 . 2007-06-23 20:52 262144 c:\windows\System32\config\systemprofile\ntuser.dat
+ 2006-11-02 12:43 . 2009-04-25 12:50 262144 c:\windows\System32\config\systemprofile\ntuser.dat
- 2009-03-31 07:33 . 2009-04-24 10:02 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-03-31 07:33 . 2009-04-25 01:11 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2007-06-23 20:58 . 2009-04-24 10:28 245760 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-06-23 20:58 . 2009-04-25 12:59 245760 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2006-11-02 12:47 . 2009-04-24 10:28 262144 c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2006-11-02 12:47 . 2009-04-25 12:59 262144 c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2006-11-02 12:47 . 2009-04-24 10:28 262144 c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2006-11-02 12:47 . 2009-04-25 12:59 262144 c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-11-28 01:36 . 2009-04-24 10:15 2332936 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2008-11-28 01:36 . 2009-04-25 12:55 2332936 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\kbdhe2d0]
@="{C2F2E748-E7D6-0E58-35E0-D780ABE07D4C}"
[HKEY_CLASSES_ROOT\CLSID\{C2F2E748-E7D6-0E58-35E0-D780ABE07D4C}]
2006-11-02 09:39 126976 ----a-w c:\windows\system32\KBDHE2D0.dIl

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-11-14 02:22 3186440 ----a-w c:\program files\Protector Suite QL\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-11-14 02:22 3186440 ----a-w c:\program files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2007-06-02 1457152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-07 34352]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-02-13 405504]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-20 411768]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-01-19 448632]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-01-17 534648]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-19 1316136]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-22 842584]
"PS121v2"="c:\program files\NETGEAR\PS121v2\PS121v2.exe" [2006-08-25 724992]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-07-26 204800]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2007-11-14 49416]
"lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136]
"lxdnamon"="c:\program files\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-12-17 320168]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-13 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-13 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-13 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-08 148888]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-01-18 4349952]
"NDSTray.exe"="NDSTray.exe" [BU]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-2-2 2756608]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2007-8-16 118784]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-30 969792]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-11-14 02:07 96008 ----a-w c:\windows\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{22EFF41D-631D-40C9-989D-2712EF8D50A0}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= UDP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"UDP Query User{DAF6DF97-1477-4D7D-A48F-B853C976638A}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= TCP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"TCP Query User{F8658306-F07E-42BB-B00A-8D25053DA4E4}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{B08A1C9C-5466-4A99-83B5-B29606D574E9}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"TCP Query User{C262F8E5-9AD3-4FA5-81D3-D7AAA951F14A}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"= UDP:c:\windows\system32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"UDP Query User{FBA97FCB-AE9B-4A09-A619-C3C842206897}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"= TCP:c:\windows\system32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"TCP Query User{078EFE2F-F6A8-483B-BCEF-C6CC64A586B6}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= UDP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"UDP Query User{73C9C2C1-6022-49E7-810A-F7C36548FB22}c:\\program files\\lexmark 2600 series\\lxdnmon.exe"= TCP:c:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"TCP Query User{596CF229-D0B6-4322-A74C-EB5EC1A616A2}c:\\users\\carl\\appdata\\local\\temp\\lmi6c0c.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi6c0c.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{D8F09C2A-6EAD-4CE8-9D25-25ABE7EED859}c:\\users\\carl\\appdata\\local\\temp\\lmi6c0c.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi6c0c.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{56EF1469-FCC7-4931-AF1A-BD2C1B92B8F1}c:\\users\\temp\\appdata\\local\\temp\\lmic5b0.tmp\\lmi_rescue.exe"= UDP:c:\users\temp\appdata\local\temp\lmic5b0.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{580923D4-ED9E-467C-9FEA-989B9276ED30}c:\\users\\temp\\appdata\\local\\temp\\lmic5b0.tmp\\lmi_rescue.exe"= TCP:c:\users\temp\appdata\local\temp\lmic5b0.tmp\lmi_rescue.exe:LogMeIn Rescue
"{C33BE070-A998-41CB-BACE-8C60A8A0EF51}"= UDP:c:\users\TEMP\AppData\Local\Temp\7zSCFB.tmp\SymNRT.exe:Norton Removal Tool
"{FA88B3A9-6139-42D9-B7A6-04C37DA5C339}"= TCP:c:\users\TEMP\AppData\Local\Temp\7zSCFB.tmp\SymNRT.exe:Norton Removal Tool
"TCP Query User{80264584-7F58-4ABF-B9C5-320A685B756C}c:\\users\\carl\\appdata\\local\\temp\\lmi83f0.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi83f0.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{4C564DC5-23E1-4372-80F8-01975EC8EBE0}c:\\users\\carl\\appdata\\local\\temp\\lmi83f0.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi83f0.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{868DF9FD-4144-4420-9CA6-3407D74B657B}c:\\users\\carl\\appdata\\local\\temp\\lmi67c9.tmp\\lmi_rescue.exe"= UDP:c:\users\carl\appdata\local\temp\lmi67c9.tmp\lmi_rescue.exe:LogMeIn Rescue
"UDP Query User{79930D5F-60F2-44F1-BE6A-3E4DFF4EA24D}c:\\users\\carl\\appdata\\local\\temp\\lmi67c9.tmp\\lmi_rescue.exe"= TCP:c:\users\carl\appdata\local\temp\lmi67c9.tmp\lmi_rescue.exe:LogMeIn Rescue
"TCP Query User{0983364B-1583-4A6B-8C0D-D7691316EEA4}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{4554DACF-6B06-4781-B56E-9B463BF38268}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"TCP Query User{712C9F86-FB44-4CDB-AE61-5E61471A71AD}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{AF6CD684-2B19-4C66-A844-DF67C48C555C}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{E5C44461-D1BC-4DD4-9BCE-97B59B2131F6}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B8349452-B959-44E6-B871-956E454EB8DC}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{225DADB3-12AE-4BDB-A386-A027B6F633F5}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{1941303B-DA35-4EBB-9A9E-A3DCAE43B1B9}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{3366980F-648C-4DE1-AC9F-1890073D4019}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{E66F7B7A-9FCD-416C-A009-9329CCFD157C}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F79F2373-27D2-4239-B302-D9034484898B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{0DA2CFD5-C10A-4F09-A2EF-553FC6DDF668}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2007-12-05 98984]
R3 MBAMSwissArmy;MBAMSwissArmy; [x]
R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
R3 NETGEARUCOMP;NETGEAR Network USB Composite Device;c:\windows\system32\DRIVERS\NETGEARUCOMP.sys [2006-08-17 11648]
R3 TpChoice;Touch Pad Detection Filter driver; [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SYMEFA.SYS [2009-03-29 310320]
S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [2009-03-29 258608]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\ccHPx86.sys [2009-03-29 482352]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090420.001\IDSvix86.sys [2009-03-29 292912]
S2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-11 30312]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-12-05 594600]
S2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [2009-03-29 115560]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-29 101936]
S3 NETGEARUHOST;NETGEAR Network USB Host Controller;c:\windows\system32\DRIVERS\NETGEARUHOST.sys [2006-08-17 10752]
S3 NETGEARUHUB;NETGEAR Network USB Root Hub;c:\windows\system32\DRIVERS\NETGEARUHUB.sys [2006-08-17 37120]
S3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\NAV\1005000.086\SYMNDISV.SYS [2009-03-29 39984]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-04-25 c:\windows\Tasks\User_Feed_Synchronization-{339872FA-415A-41ED-B597-6C343709253E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-31 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-25 22:59
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(884)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infql2.dll

- - - - - - - > 'Explorer.exe'(4348)
c:\program files\Protector Suite QL\farchns.dll
c:\program files\Protector Suite QL\infql2.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\System32\audiodg.exe
c:\program files\Protector Suite QL\upeksvr.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\System32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Protector Suite QL\psqltray.exe
c:\program files\Lexmark 2600 Series\lxdnmsdmon.exe
c:\program files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
c:\windows\System32\rundll32.exe
c:\program files\Synaptics\SynTP\SynToshiba.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\TOSHIBA\ConfigFree\CFSwMgr.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosAVRC.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosOBEX.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
.
**************************************************************************
.
Completion time: 2009-04-25 23:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-25 13:05
ComboFix2.txt 2009-04-24 22:56
ComboFix3.txt 2009-04-24 10:35

Pre-Run: 123,390,238,720 bytes free
Post-Run: 123,257,839,616 bytes free

408 --- E O F --- 2009-04-23 19:00

[L5Brassco]

And the Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:25:16 PM, on 25/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Lexmark 2600 Series\lxdnmon.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [PS121v2] "C:\Program Files\NETGEAR\PS121v2\PS121v2.exe" /hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.terrace.qld.edu.au/dwa7W.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe
O23 - Service: lxdn_device - - C:\Windows\system32\lxdncoms.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: QuickBooks Database Manager Service (QBCFMonitorService) - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7723 bytes

[Shaba]

Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select ''Run as administrator'' to perform this scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

If you need a tutorial, see here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif)

[L5Brassco]

Ran Kaspersky twice.
There was nothing on the report it created.
I hope this is good
Below is the hijack this log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:12 AM, on 27/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\NETGEAR\PS121v2\PS121v2.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Lexmark 2600 Series\lxdnmon.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [PS121v2] "C:\Program Files\NETGEAR\PS121v2\PS121v2.exe" /hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.terrace.qld.edu.au/dwa7W.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe
O23 - Service: lxdn_device - - C:\Windows\system32\lxdncoms.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: QuickBooks Database Manager Service (QBCFMonitorService) - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 8272 bytes

[Shaba]

Yes it is :)

Still problems?

[L5Brassco]

Spybot says all ok
Norton says all ok

Kiitos

You guys rock!

[Shaba]

Great :)

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Looking over your log, it seems you don't have any evidence of a third party firewall.

As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:

1) Comodo (http://www.personalfirewall.comodo.com/download_firewall.html) (Uncheck during installation "Install COMODO Antivirus (Recommended)"!, "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage")
2) Online Armor (http://www.tallemu.com/online_armor_free.html)
3) PC Tools (http://www.pctools.com/firewall/download/)
4) Sunbelt/Kerio (http://www.sunbelt-software.com/Kerio-Download.cfm)
5) ZoneAlarm (http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=12bms&ctry=US&lang=en&lid=nav_za) (uncheck ZoneAlarm Spy Blocker during installation if you choose this one)

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

Next we remove all used tools.

Please download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) and save it to desktop.

Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.


Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

Disable and Enable System Restore. - If you are using Windows Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Windows Vista System Restore Guide (http://www.bleepingcomputer.com/tutorials/tutorial143.html)

Re-enable system restore with instructions from tutorial above

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt

Change the Download unsigned ActiveX controls to Disable

Change the Initialize and script ActiveX controls not marked as safe to Disable

Change the Installation of desktop items to Prompt

Change the Launching programs and files in an IFRAME to Prompt

Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.

If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector (http://secunia.com/software_inspector/)
F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install Malwarebytes' Anti-Malware - Malwarebytes''Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:

Malwarebytes' Anti-Malware Setup Guide (http://www.lognrock.com/forum/index.php?showtopic=6926)

Malwarebytes' Anti-Malware Scanning Guide (http://www.lognrock.com/forum/index.php?showtopic=6913)

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)

Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://castlecops.com/postlite7736-.html)

Happy surfing and stay clean! :bigthumb:

[L5Brassco]

Shaba
All cleaned up
Thank you
L5

[L5Brassco]

PS The Tony Klein article is a dead link

L5

[Shaba]

Thanks for letting me know, I will fix it :)

This (http://forums.spybot.info/showthread.php?t=279) one works.

[Shaba]

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Note: If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.