Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: Gen.TDSS.Patched.1

  1. #1
    Junior Member
    Join Date
    Aug 2009
    Posts
    9

    Default Gen.TDSS.Patched.1

    BitDefender has found a virus Gen.TDSS.Patched.1
    Ad-Aware has found Win32TrojanTDss.
    SpybotS&D won't even run.
    Nothing removes this from my computer. Various programs won't open.
    When I google sites I am redirected to different sites.
    Ran HijackThis log. see below.

    Please help!


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:28:09 AM, on 07/08/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
    C:\Program Files\VBTUCopy\VBTUCopy.exe
    C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\BitDefender\BitDefender 2008\seccenter.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Documents and Settings\Laurie\Desktop\HiJackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe"
    O4 - HKLM\..\Run: [USB2Check] "RUNDLL32.EXE" "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CTCheck] "C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [VBTUCopy] "C:\Program Files\VBTUCopy\VBTUCopy.exe" /a /f
    O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
    O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
    O4 - HKCU\..\Run: [PhotoshopElementsSyncAgent] C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsSyncAgent.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.18\AMVConverter\grab.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/S...dObjSigned.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase1140.cab
    O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupda...01/CTSUEng.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1202843531562
    O16 - DPF: {7FE26BE2-B923-4B41-9834-E84DA1CC1F96} (Closet Control) - http://vsp.closetmaid.com/vsp/cmaidc...downloader.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...22/mcfscan.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupda...5106/CTPID.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll
    O18 - Protocol: intu-qt2008 - {05E53CE9-66C8-4A9E-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll
    O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 13120 bytes

  2. #2
    Emeritus- Malware Team
    Join Date
    Oct 2008
    Location
    Cornwall, UK
    Posts
    592

    Default

    STEP 1

    Download DDS

    Please download DDS by sUBs from one of the links below and save it to your desktop:


    Download DDS and save it to your desktop from:

    Link 1
    Link 2

    Please disable any anti-malware program that will block scripts from running before running DDS.


    • Double-Click on dds.scr and a command window will appear. This is normal.
    • Shortly after two logs will appear:
      • DDS.txt
      • Attach.txt

    • A window will open instructing you save & post the logs
    • Save the logs to a convenient place such as your desktop
    • Copy the contents of both logs & post in your next reply




    STEP 2


    RootRepeal - Rootkit Detector

    Download RootRepeal.zip and unzip it to your Desktop.


    • Double click RootRepeal.exe to start the program
    • Click on the Report tab at the bottom of the program window
    • Clickthe Scan button
    • In the Select Scan dialog, check:
      • Drivers
      • Files
      • Processes
      • SSDT
      • Stealth Objects
      • Hidden Services

    • Click the OK button
    • In the next dialog, select all drives showing
    • Click OK to start the scan

      The scan can take some time. DO NOT run any other programs while the scan is running
    • When the scan is complete, the Save Report button will become available
    • Click this and save the report to your Desktop as RootRepeal.txt
    • Go to File, then Exit to close the program




    Next Reply

    Please reply with:

    • DDS.txt
    • Attach.txt
    • RootRepeal.txt
    MRU Master of Malware Removal University

    Member of UNITE and ASAP

  3. #3
    Junior Member
    Join Date
    Aug 2009
    Posts
    9

    Default

    DDS (Ver_09-07-30.01) - NTFSx86
    Run by Laurie at 16:09:04.85 on 07/08/2009
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.2820 [GMT -4:00]

    AV: Bitdefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Internet Explorer\Iexplore.exe
    svchost.exe
    C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    C:\WINDOWS\System32\svchost.exe -kbdx
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
    C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Laurie\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uSearch Bar = hxxp://www.google.com/ie
    uStart Page = hxxp://www.google.ca/
    mSearchAssistant = hxxp://www.google.com/ie
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
    BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
    TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
    TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
    TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\program files\bitdefender\bitdefender 2008\IEToolbar.dll
    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
    uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"
    uRun: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\RegistryBooster.exe /S
    uRun: [PhotoshopElementsSyncAgent] c:\program files\adobe\photoshop elements 7.0\PhotoshopElementsSyncAgent.exe
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_03\bin\jusched.exe"
    mRun: [SigmatelSysTrayApp] stsystra.exe
    mRun: [DMXLauncher] "c:\program files\dell\media experience\DMXLauncher.exe"
    mRun: [USB2Check] "RUNDLL32.EXE" "c:\windows\system32\PCLECoInst.dll",CheckUSBController
    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
    mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
    mRun: [CTCheck] "c:\program files\creative\creative zen\zen media explorer\CTCheck.exe"
    mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2008\bdagent.exe"
    mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [VBTUCopy] "c:\program files\vbtucopy\VBTUCopy.exe" /a /f
    mRun: [USBToolTip] "c:\program files\pinnacle\shared files\\programs\usbtip\USBTip.exe"
    mRun: [PCLEPCI] c:\progra~1\pinnacle\ppe\PPE.EXE
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
    dRunOnce: [RunNarrator] Narrator.exe
    StartupFolder: c:\docume~1\laurie\startm~1\programs\startup\dropbox.lnk - c:\program files\dropbox\Dropbox.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkvmon~1.lnk - c:\program files\nikon\nkview6\NkvMon.exe
    IE: Add to AMV Converter... - c:\program files\mp3 player utilities 4.18\amvconverter\grab.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    Trusted Zone: akamai.net\a248.e
    Trusted Zone: bitdefender.com
    Trusted Zone: netflame.cc\ssl-hints
    Trusted Zone: musicmatch.com\online
    DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} - hxxp://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
    DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202843531562
    DPF: {7FE26BE2-B923-4B41-9834-E84DA1CC1F96} - hxxp://vsp.closetmaid.com/vsp/cmaidctl_vsp.closetmaid.com_downloader.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5222/mcfscan.cab
    DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/softwareupdate/su/ocx/15106/CTPID.cab
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
    Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\quicktax 2007\ic2007pp.dll
    Handler: intu-qt2008 - {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} - c:\program files\quicktax 2008\ic2008pp.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    LSA: Notification Packages = :\windows\syste

    ============= SERVICES / DRIVERS ===============


    =============== Created Last 30 ================


    ==================== Find3M ====================

    2006-09-12 14:38 88 -c-shr-- c:\windows\system32\07BE1FC234.sys
    2006-09-12 14:38 3,350 ac-sh--- c:\windows\system32\KGyGaAvL.sys

    ============= FINISH: 16:10:43.87 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-07-30.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 29/08/2006 7:39:58 PM
    System Uptime: 08/07/2009 3:58:45 PM (721 hours ago)

    Motherboard: Dell Inc. | | 0FJ030
    Processor: Intel(R) Pentium(R) D CPU 2.80GHz | Microprocessor | 2793/800mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 295 GiB total, 6.436 GiB free.
    D: is CDROM ()
    E: is CDROM ()
    F: is Removable
    G: is Removable
    H: is Removable
    I: is Removable

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP619: 01/08/2009 6:49:40 PM - Software Distribution Service 3.0
    RP620: 01/08/2009 6:49:40 PM - Software Distribution Service 3.0
    RP621: 01/08/2009 6:49:40 PM - System Checkpoint
    RP622: 01/08/2009 6:49:40 PM - Software Distribution Service 3.0
    RP623: 01/08/2009 6:49:40 PM - Software Distribution Service 3.0
    RP624: 01/08/2009 6:49:40 PM - System Checkpoint
    RP625: 01/08/2009 6:49:41 PM - System Checkpoint
    RP626: 01/08/2009 6:49:41 PM - Software Distribution Service 3.0
    RP627: 01/08/2009 6:49:41 PM - Software Distribution Service 3.0
    RP628: 01/08/2009 6:49:41 PM - Software Distribution Service 3.0
    RP629: 01/08/2009 6:49:41 PM - Software Distribution Service 3.0
    RP630: 01/08/2009 6:49:41 PM - Software Distribution Service 3.0
    RP631: 01/08/2009 6:49:42 PM - Software Distribution Service 3.0
    RP632: 01/08/2009 6:49:42 PM - System Checkpoint
    RP633: 01/08/2009 6:49:42 PM - Software Distribution Service 3.0
    RP634: 01/08/2009 6:49:42 PM - Software Distribution Service 3.0
    RP635: 01/08/2009 6:49:42 PM - Software Distribution Service 3.0
    RP636: 01/08/2009 6:49:43 PM - Software Distribution Service 3.0
    RP637: 01/08/2009 6:49:43 PM - Software Distribution Service 3.0
    RP638: 01/08/2009 6:49:43 PM - System Checkpoint
    RP639: 01/08/2009 6:49:43 PM - System Checkpoint
    RP640: 01/08/2009 6:49:44 PM - Software Distribution Service 3.0
    RP641: 01/08/2009 6:49:44 PM - System Checkpoint
    RP642: 01/08/2009 6:49:44 PM - Software Distribution Service 3.0
    RP643: 01/08/2009 6:49:44 PM - System Checkpoint
    RP644: 01/08/2009 6:49:44 PM - Software Distribution Service 3.0
    RP645: 01/08/2009 6:49:45 PM - Software Distribution Service 3.0
    RP646: 01/08/2009 6:49:45 PM - Software Distribution Service 3.0
    RP647: 01/08/2009 6:49:45 PM - Software Distribution Service 3.0
    RP648: 01/08/2009 6:49:45 PM - Software Distribution Service 3.0
    RP649: 01/08/2009 6:49:45 PM - Software Distribution Service 3.0

    ==== Installed Programs ======================


    ==== Event Viewer Messages From Past Week ========


    ==== End Of File ===========================



    ROOTREPEAL (c) AD, 2007-2009
    ==================================================
    Scan Start Time: 2009/08/07 16:15
    Program Version: Version 1.3.3.0
    Windows Version: Windows XP SP3
    ==================================================

    Drivers
    -------------------
    Name: dump_iastor.sys
    Image Path: C:\WINDOWS\System32\Drivers\dump_iastor.sys
    Address: 0xA89B3000 Size: 872448 File Visible: No Signed: -
    Status: -

    Name: rootrepeal.sys
    Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
    Address: 0xAD38C000 Size: 49152 File Visible: No Signed: -
    Status: -

    Hidden/Locked Files
    -------------------
    Path: C:\hiberfil.sys
    Status: Locked to the Windows API!

    Path: C:\WINDOWS\system32\UACbrsngngxid.db
    Status: Invisible to the Windows API!

    Path: C:\WINDOWS\system32\UACfaswwylmkr.dll
    Status: Invisible to the Windows API!

    Path: C:\WINDOWS\system32\uacinit.dll
    Status: Invisible to the Windows API!

    Path: C:\WINDOWS\system32\UAColaqpxmlib.dll
    Status: Invisible to the Windows API!

    Path: C:\WINDOWS\system32\UACthwmivkvcv.dll
    Status: Invisible to the Windows API!

    Path: C:\WINDOWS\system32\UACvjbnmttpqq.dll
    Status: Invisible to the Windows API!

    Path: C:\WINDOWS\system32\UACvnklqtmxai.dll
    Status: Invisible to the Windows API!

    Path: C:\WINDOWS\system32\UACxbiulyqaql.dat
    Status: Invisible to the Windows API!

    Path: c:\windows\temp\perflib_perfdata_694.dat
    Status: Allocation size mismatch (API: 16384, Raw: 0)

    Path: C:\WINDOWS\Temp\UACe629.tmp
    Status: Invisible to the Windows API!

    Path: C:\WINDOWS\system32\drivers\UACcrvmnukvjq.sys
    Status: Invisible to the Windows API!

    Path: c:\documents and settings\laurie\local settings\temp\~df7aac.tmp
    Status: Allocation size mismatch (API: 16384, Raw: 0)

    Path: c:\documents and settings\laurie\local settings\temp\~df909b.tmp
    Status: Allocation size mismatch (API: 65536, Raw: 16384)

    Path: c:\documents and settings\laurie\local settings\temp\~df9d6a.tmp
    Status: Allocation size mismatch (API: 16384, Raw: 0)

    Path: c:\documents and settings\laurie\local settings\temp\~df1d2a.tmp
    Status: Allocation size mismatch (API: 16384, Raw: 0)

    Path: c:\documents and settings\laurie\local settings\temp\~dfd92b.tmp
    Status: Allocation size mismatch (API: 16384, Raw: 0)

    Path: c:\documents and settings\laurie\local settings\temp\~dfec60.tmp
    Status: Allocation size mismatch (API: 16384, Raw: 0)

    Path: c:\documents and settings\laurie\local settings\temp\~df46f3.tmp
    Status: Allocation size mismatch (API: 16384, Raw: 0)

    Path: C:\Documents and Settings\Laurie\Local Settings\Temp\UACb817.tmp
    Status: Invisible to the Windows API!

    Path: c:\program files\logitech\desktop messenger\8876480\users\laurie\data\inuse.txt
    Status: Allocation size mismatch (API: 40, Raw: 0)

    Path: Volume K:\
    Status: MBR Rootkit Detected!

    Path: Volume K:\, Sector 1
    Status: Sector mismatch

    Path: Volume K:\, Sector 2
    Status: Sector mismatch

    Path: Volume K:\, Sector 3
    Status: Sector mismatch

    Path: Volume K:\, Sector 4
    Status: Sector mismatch

    Path: Volume K:\, Sector 5
    Status: Sector mismatch

    Path: Volume K:\, Sector 6
    Status: Sector mismatch

    Path: Volume K:\, Sector 7
    Status: Sector mismatch

    Path: Volume K:\, Sector 8
    Status: Sector mismatch

    Path: Volume K:\, Sector 9
    Status: Sector mismatch

    Path: Volume K:\, Sector 10
    Status: Sector mismatch

    Path: Volume K:\, Sector 11
    Status: Sector mismatch

    Path: Volume K:\, Sector 12
    Status: Sector mismatch

    Path: Volume K:\, Sector 13
    Status: Sector mismatch

    Path: Volume K:\, Sector 14
    Status: Sector mismatch

    Path: Volume K:\, Sector 15
    Status: Sector mismatch

    Path: Volume K:\, Sector 16
    Status: Sector mismatch

    Path: Volume K:\, Sector 17
    Status: Sector mismatch

    Path: Volume K:\, Sector 18
    Status: Sector mismatch

    Path: Volume K:\, Sector 19
    Status: Sector mismatch

    Path: Volume K:\, Sector 20
    Status: Sector mismatch

    Path: Volume K:\, Sector 21
    Status: Sector mismatch

    Path: Volume K:\, Sector 22
    Status: Sector mismatch

    Path: Volume K:\, Sector 23
    Status: Sector mismatch

    Path: Volume K:\, Sector 24
    Status: Sector mismatch

    Path: Volume K:\, Sector 25
    Status: Sector mismatch

    Path: Volume K:\, Sector 26
    Status: Sector mismatch

    Path: Volume K:\, Sector 27
    Status: Sector mismatch

    Path: Volume K:\, Sector 28
    Status: Sector mismatch

    Path: Volume K:\, Sector 29
    Status: Sector mismatch

    Path: Volume K:\, Sector 30
    Status: Sector mismatch

    Path: Volume K:\, Sector 31
    Status: Sector mismatch

    Path: Volume K:\, Sector 32
    Status: Sector mismatch

    Path: Volume K:\, Sector 33
    Status: Sector mismatch

    Path: Volume K:\, Sector 34
    Status: Sector mismatch

    Path: Volume K:\, Sector 35
    Status: Sector mismatch

    Path: Volume K:\, Sector 36
    Status: Sector mismatch

    Path: Volume K:\, Sector 37
    Status: Sector mismatch

    Path: Volume K:\, Sector 38
    Status: Sector mismatch

    Path: Volume K:\, Sector 39
    Status: Sector mismatch

    Path: Volume K:\, Sector 40
    Status: Sector mismatch

    Path: Volume K:\, Sector 41
    Status: Sector mismatch

    Path: Volume K:\, Sector 42
    Status: Sector mismatch

    Path: Volume K:\, Sector 43
    Status: Sector mismatch

    Path: Volume K:\, Sector 44
    Status: Sector mismatch

    Path: Volume K:\, Sector 45
    Status: Sector mismatch

    Path: Volume K:\, Sector 46
    Status: Sector mismatch

    Path: Volume K:\, Sector 47
    Status: Sector mismatch

    Path: Volume K:\, Sector 48
    Status: Sector mismatch

    Path: Volume K:\, Sector 49
    Status: Sector mismatch

    Path: Volume K:\, Sector 50
    Status: Sector mismatch

    Path: Volume K:\, Sector 51
    Status: Sector mismatch

    Path: Volume K:\, Sector 52
    Status: Sector mismatch

    Path: Volume K:\, Sector 53
    Status: Sector mismatch

    Path: Volume K:\, Sector 54
    Status: Sector mismatch

    Path: Volume K:\, Sector 55
    Status: Sector mismatch

    Path: Volume K:\, Sector 56
    Status: Sector mismatch

    Path: Volume K:\, Sector 57
    Status: Sector mismatch

    Path: Volume K:\, Sector 58
    Status: Sector mismatch

    Path: Volume K:\, Sector 59
    Status: Sector mismatch

    Path: Volume K:\, Sector 60
    Status: Sector mismatch

    Path: Volume K:\, Sector 61
    Status: Sector mismatch

    Path: Volume K:\, Sector 62
    Status: Sector mismatch

    Path: K:\catalog.buc
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Revised yB
    Status: Visible to the Windows API, but not on disk.

    Path: K:\save2pc
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Scrapbooking
    Status: Visible to the Windows API, but not on disk.

    Path: K:\System Volume Information
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Clients
    Status: Visible to the Windows API, but not on disk.

    Path: K:\My Videos
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Catalog 2000 to present
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Yearbook 2
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Catalog pre 2000
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Sears Family
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Ms.Daniel
    Status: Visible to the Windows API, but not on disk.

    Path: K:\JessicaSpragueScapbooking
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Cathy's Negs
    Status: Visible to the Windows API, but not on disk.

    Path: K:\sdsetup.exe
    Status: Visible to the Windows API, but not on disk.

    Path: K:\ZbThumbnail.info
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Pinnacle Studio
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Shutterfly
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Grad pages Finished
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Recycled
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Shutterfly Flordia Holiday
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Ben & Jack
    Status: Visible to the Windows API, but not on disk.

    Path: K:\shutterflyAnnXmas
    Status: Visible to the Windows API, but not on disk.

    Path: K:\ShutterflyMomXmas
    Status: Visible to the Windows API, but not on disk.

    Path: K:\64cKimInBathrobe.jpg
    Status: Visible to the Windows API, but not on disk.

    Path: K:\64cKim& LaurieOutside.jpg
    Status: Visible to the Windows API, but not on disk.

    Path: K:\64cKimHalloween.jpg
    Status: Visible to the Windows API, but not on disk.

    Path: K:\64cLaurieInCar.jpg
    Status: Visible to the Windows API, but not on disk.

    Path: K:\itunes
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Kitchen Computer 2009-01-19
    Status: Visible to the Windows API, but not on disk.

    Path: K:\Yearbook
    Status: Visible to the Windows API, but not on disk.

    Stealth Objects
    -------------------
    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: winlogon.exe (PID: 1068) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: winlogon.exe (PID: 1068) Address: 0x00980000 Size: 49152

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: services.exe (PID: 1116) Address: 0x00aa0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: services.exe (PID: 1116) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: lsass.exe (PID: 1128) Address: 0x00b10000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: lsass.exe (PID: 1128) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 1328) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 1328) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 1328) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACvnklqtmxai.dll]
    Process: svchost.exe (PID: 1328) Address: 0x00bc0000 Size: 73728

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 1328) Address: 0x00e60000 Size: 45056

    Object: Hidden Module [Name: UACthwmivkvcv.dll]
    Process: svchost.exe (PID: 1328) Address: 0x02bc0000 Size: 217088

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 1328) Address: 0x03250000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 1328) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 1420) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 1420) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 1420) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 1420) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 1544) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 1544) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 1544) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 1544) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 1616) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 1616) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 1616) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 1616) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 1800) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 1800) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 1800) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 1800) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 1872) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 1872) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 1872) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 1872) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: spoolsv.exe (PID: 300) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: spoolsv.exe (PID: 300) Address: 0x00d80000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: Explorer.EXE (PID: 440) Address: 0x00d50000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: Explorer.EXE (PID: 440) Address: 0x00e00000 Size: 49152

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: Explorer.EXE (PID: 440) Address: 0x10000000 Size: 77824

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 904) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 904) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 904) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 904) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: PhotoshopElementsFileAgent.exe (PID: 940) Address: 0x00700000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: PhotoshopElementsFileAgent.exe (PID: 940) Address: 0x00d70000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: PhotoshopElementsFileAgent.exe (PID: 984) Address: 0x00710000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: PhotoshopElementsFileAgent.exe (PID: 984) Address: 0x00d80000 Size: 49152

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: CTsvcCDA.exe (PID: 1024) Address: 0x00ba0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: CTsvcCDA.exe (PID: 1024) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: iaantmon.exe (PID: 1536) Address: 0x00bb0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: iaantmon.exe (PID: 1536) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: MDM.EXE (PID: 1576) Address: 0x00e70000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: MDM.EXE (PID: 1576) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: sqlservr.exe (PID: 1824) Address: 0x011f0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: sqlservr.exe (PID: 1824) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: nvsvc32.exe (PID: 2008) Address: 0x00bc0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: nvsvc32.exe (PID: 2008) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: sprtsvc.exe (PID: 536) Address: 0x00e60000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: sprtsvc.exe (PID: 536) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 680) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 680) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 680) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 680) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: UAService7.exe (PID: 716) Address: 0x00bb0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: UAService7.exe (PID: 716) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: xcommsvr.exe (PID: 844) Address: 0x00bc0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: xcommsvr.exe (PID: 844) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: livesrv.exe (PID: 1044) Address: 0x00830000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: livesrv.exe (PID: 1044) Address: 0x00ea0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: vsserv.exe (PID: 1496) Address: 0x00f20000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: vsserv.exe (PID: 1496) Address: 0x01220000 Size: 49152

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: CALMAIN.exe (PID: 2124) Address: 0x00bb0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: CALMAIN.exe (PID: 2124) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: pmshost.exe (PID: 2288) Address: 0x00c00000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: pmshost.exe (PID: 2288) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACvjbnmttpqq.dll]
    Process: svchost.exe (PID: 2860) Address: 0x00770000 Size: 77824

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: svchost.exe (PID: 2860) Address: 0x00a90000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: svchost.exe (PID: 2860) Address: 0x00b20000 Size: 49152

    Object: Hidden Module [Name: UACe629.tmpivkvcv.dll]
    Process: svchost.exe (PID: 2860) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: alg.exe (PID: 3128) Address: 0x00b30000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: alg.exe (PID: 3128) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: jusched.exe (PID: 3872) Address: 0x00e50000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: jusched.exe (PID: 3872) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: stsystra.exe (PID: 3928) Address: 0x009b0000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: stsystra.exe (PID: 3928) Address: 0x010f0000 Size: 49152

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: DMXLauncher.exe (PID: 3980) Address: 0x00e40000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: DMXLauncher.exe (PID: 3980) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: DLACTRLW.EXE (PID: 4056) Address: 0x00940000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: DLACTRLW.EXE (PID: 4056) Address: 0x00eb0000 Size: 49152

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: CTCheck.exe (PID: 4088) Address: 0x00e90000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: CTCheck.exe (PID: 4088) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: bdagent.exe (PID: 572) Address: 0x00c20000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: bdagent.exe (PID: 572) Address: 0x01290000 Size: 49152

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: USBTip.exe (PID: 2220) Address: 0x00ec0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: USBTip.exe (PID: 2220) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: iTunesHelper.exe (PID: 2396) Address: 0x00e70000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: iTunesHelper.exe (PID: 2396) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: issch.exe (PID: 2408) Address: 0x00e30000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: issch.exe (PID: 2408) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: sprtcmd.exe (PID: 2468) Address: 0x00e70000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: sprtcmd.exe (PID: 2468) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: iPodService.exe (PID: 2488) Address: 0x00c20000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: iPodService.exe (PID: 2488) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: LogitechDesktopMessenger.exe (PID: 3192) Address: 0x00e30000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: LogitechDesktopMessenger.exe (PID: 3192) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: NkvMon.exe (PID: 3204) Address: 0x00f00000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: NkvMon.exe (PID: 3204) Address: 0x10000000 Size: 45056

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: iexplore.exe (PID: 4428) Address: 0x00b70000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: iexplore.exe (PID: 4428) Address: 0x00fd0000 Size: 49152

    Object: Hidden Module [Name: UACthwmivkvcv.dll]
    Process: iexplore.exe (PID: 4428) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: iexplore.exe (PID: 4472) Address: 0x00b70000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: iexplore.exe (PID: 4472) Address: 0x01580000 Size: 49152

    Object: Hidden Module [Name: UACthwmivkvcv.dll]
    Process: iexplore.exe (PID: 4472) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: iexplore.exe (PID: 912) Address: 0x00b70000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: iexplore.exe (PID: 912) Address: 0x00fd0000 Size: 49152

    Object: Hidden Module [Name: UACthwmivkvcv.dll]
    Process: iexplore.exe (PID: 912) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: Iexplore.exe (PID: 3972) Address: 0x00b70000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: Iexplore.exe (PID: 3972) Address: 0x00ff0000 Size: 49152

    Object: Hidden Module [Name: UACthwmivkvcv.dll]
    Process: Iexplore.exe (PID: 3972) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: Iexplore.exe (PID: 2244) Address: 0x00b70000 Size: 45056

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: Iexplore.exe (PID: 2244) Address: 0x00fd0000 Size: 49152

    Object: Hidden Module [Name: UACthwmivkvcv.dll]
    Process: Iexplore.exe (PID: 2244) Address: 0x10000000 Size: 217088

    Object: Hidden Module [Name: UACfaswwylmkr.dll]
    Process: RootRepeal.exe (PID: 5536) Address: 0x00fc0000 Size: 49152

    Object: Hidden Module [Name: UAColaqpxmlib.dll]
    Process: RootRepeal.exe (PID: 5536) Address: 0x10000000 Size: 45056

    Hidden Services
    -------------------
    Service Name: UACd.sys
    Image Path: C:\WINDOWS\system32\drivers\UACcrvmnukvjq.sys

    ==EOF==

    Attachment 3531

    Attachment 3532

    Attachment 3533

    As per your request
    Last edited by Bio-Hazard; 2009-08-08 at 00:26.

  4. #4
    Emeritus- Malware Team
    Join Date
    Oct 2008
    Location
    Cornwall, UK
    Posts
    592

    Default

    Download and Run ComboFix


    • ComboFix SHOULD NOT be used unless requested by a forum helper.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. A guide to do this can be found HERE
    • Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

      Link 1
      Link 2




    • Double click on Combo-Fix.exe and follow the prompts.
    • When finished, it will produce a report for you (C:\ComboFix.txt )
    • Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
    • Combofix should never take more that 20 minutes including the reboot if malware is detected.



    IMPORTANT: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.This tool is not a toy and not for everyday use.


    Gmer's mbr.exe

    Please download mbr.exe from HERE and save it to your desktop.

    • Click the downloaded file to run the scan (a window will open briefly,then close).
    • The scan will create a mbr.log on your desktop
    • Please copy/paste those contents in your next reply.





    Rooter.exe

    Download Rooter.exe to your desktop.

    • Then double-click it to start the tool.
    • A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt.
    • Post the contents of Rooter.txt in your next reply.





    Logs/Information to Post in Next Reply

    Please post the following logs/Information in your reply:

    • Rooter log
    • mbr.log
    • ComboFix log (found at C:\Combofix.txt)
    • A fresh HijackThis Log ( after all the above has been done)
    • A description of how your computer is behaving
    MRU Master of Malware Removal University

    Member of UNITE and ASAP

  5. #5
    Junior Member
    Join Date
    Aug 2009
    Posts
    9

    Default

    Rooter.exe (v1.0.2) by Eric_71
    .
    SeDebugPrivilege granted successfully ...
    .
    Windows XP . (5.1.2600) Service Pack 3
    [32_bits] - x86 Family 15 Model 6 Stepping 4, GenuineIntel
    .
    [wscsvc] (Security Center) RUNNING (state:4)
    [SharedAccess] RUNNING (state:4)
    Windows Firewall -> Disabled !
    .
    Internet Explorer 8.0.6001.18702
    .
    C:\ [Fixed-NTFS] .. ( Total:294 Go - Free:6 Go )
    D:\ [CD_Rom]
    E:\ [CD_Rom]
    F:\ [Removable]
    G:\ [Removable]
    H:\ [Removable]
    I:\ [Removable]
    K:\ [Fixed-FAT32] .. ( Total:465 Go - Free:254 Go )
    .
    Scan : 22:33.27
    Path : C:\Documents and Settings\Laurie\Desktop\Rooter.exe
    User : Laurie ( Administrator -> YES )
    .
    ----------------------\\ Processes
    .
    Locked [System Process] (0)
    ______ System (4)
    ______ \SystemRoot\System32\smss.exe (984)
    ______ \??\C:\WINDOWS\system32\csrss.exe (1044)
    ______ \??\C:\WINDOWS\system32\winlogon.exe (1068)
    ______ C:\WINDOWS\system32\services.exe (1112)
    ______ C:\WINDOWS\system32\lsass.exe (1124)
    ______ C:\WINDOWS\system32\svchost.exe (1328)
    ______ C:\WINDOWS\system32\svchost.exe (1444)
    ______ C:\WINDOWS\System32\svchost.exe (1568)
    ______ C:\WINDOWS\system32\svchost.exe (1604)
    ______ C:\WINDOWS\system32\svchost.exe (1692)
    ______ C:\WINDOWS\system32\svchost.exe (1844)
    ______ C:\WINDOWS\system32\spoolsv.exe (2008)
    ______ C:\WINDOWS\system32\svchost.exe (1128)
    ______ C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe (1496)
    ______ C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (1532)
    ______ C:\WINDOWS\system32\CTsvcCDA.exe (1632)
    ______ C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe (1756)
    ______ C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (1776)
    ______ C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe (232)
    ______ C:\WINDOWS\system32\nvsvc32.exe (308)
    ______ C:\Program Files\Dell Support Center\bin\sprtsvc.exe (656)
    ______ C:\WINDOWS\system32\svchost.exe (708)
    ______ C:\WINDOWS\system32\UAService7.exe (744)
    Locked xcommsvr.exe (840)
    Locked livesrv.exe (928)
    ______ c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe (2140)
    Locked vsserv.exe (2240)
    ______ C:\Program Files\Canon\CAL\CALMAIN.exe (2524)
    Locked svchost.exe (3352)
    ______ C:\WINDOWS\System32\alg.exe (3388)
    ______ C:\WINDOWS\system32\wscntfy.exe (3492)
    ______ C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe (520)
    ______ C:\WINDOWS\stsystra.exe (624)
    ______ C:\Program Files\Dell\Media Experience\DMXLauncher.exe (1028)
    ______ C:\WINDOWS\System32\DLA\DLACTRLW.EXE (952)
    ______ C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe (2060)
    ______ C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe (2408)
    ______ C:\Program Files\VBTUCopy\VBTUCopy.exe (2692)
    ______ C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (2680)
    ______ C:\Program Files\iTunes\iTunesHelper.exe (2828)
    ______ C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (2848)
    ______ C:\Program Files\Dell Support Center\bin\sprtcmd.exe (2888)
    ______ C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe (1412)
    ______ C:\Program Files\iPod\bin\iPodService.exe (3444)
    ______ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (3576)
    ______ C:\Program Files\Nikon\NkView6\NkvMon.exe (3636)
    ______ C:\WINDOWS\explorer.exe (2396)
    ______ C:\WINDOWS\system32\notepad.exe (1956)
    ______ C:\Program Files\Internet Explorer\iexplore.exe (484)
    ______ C:\Program Files\Internet Explorer\iexplore.exe (3240)
    ______ C:\Program Files\Internet Explorer\iexplore.exe (796)
    ______ C:\Documents and Settings\Laurie\Desktop\Rooter.exe (660)
    .
    ----------------------\\ Device\Harddisk0\
    .
    \Device\Harddisk0 [Sectors : 63 x 512 Bytes]
    .
    \Device\Harddisk0\Partition1 (Start_Offset:32256 | Length:49319424)
    \Device\Harddisk0\Partition2 --[ MBR ]-- (Start_Offset:49351680 | Length:316681505280)
    \Device\Harddisk0\Partition3 (Start_Offset:316730856960 | Length:3339463680)
    .
    ----------------------\\ Scheduled Tasks
    .
    C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
    C:\WINDOWS\Tasks\desktop.ini
    C:\WINDOWS\Tasks\Disk Cleanup.job
    C:\WINDOWS\Tasks\SA.DAT
    C:\WINDOWS\Tasks\User_Feed_Synchronization-{E809416D-E002-49E5-93A4-43FF301DF5F5}.job
    .
    ----------------------\\ Registry
    .
    .
    ----------------------\\ Files & Folders
    .
    ----------------------\\ Scan completed at 22:35.32
    .
    C:\Rooter$\Rooter_1.txt - (07/08/2009 | 22:35.32)






    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    kernel: MBR read successfully
    user & kernel MBR OK




    ComboFix 09-08-07.07 - Laurie 07/08/2009 22:02.1.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.3083 [GMT -4:00]
    Running from: c:\documents and settings\Laurie\Desktop\Combo-Fix.exe
    AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\HCWemMON.exe
    c:\windows\Installer\132e1e3.msp
    c:\windows\Installer\132e1f9.msp
    c:\windows\Installer\138b9b76.msp
    c:\windows\Installer\138b9b7b.msp
    c:\windows\Installer\14099ca.msp
    c:\windows\Installer\15469f92.msp
    c:\windows\Installer\15469f97.msp
    c:\windows\Installer\1a54a38.msp
    c:\windows\Installer\1a54a3d.msp
    c:\windows\Installer\1c58d21.msp
    c:\windows\Installer\1c58d26.msp
    c:\windows\Installer\1d47ad8.msp
    c:\windows\Installer\1d47add.msp
    c:\windows\Installer\1f623.msp
    c:\windows\Installer\1f628.msp
    c:\windows\Installer\2178533.msp
    c:\windows\Installer\2178538.msp
    c:\windows\Installer\2289250.msp
    c:\windows\Installer\2289254.msp
    c:\windows\Installer\23b62d7.msp
    c:\windows\Installer\23b62dc.msp
    c:\windows\Installer\2454f2f.msp
    c:\windows\Installer\2454f34.msp
    c:\windows\Installer\24658cf.msp
    c:\windows\Installer\24658d4.msp
    c:\windows\Installer\2502fab.msp
    c:\windows\Installer\2502fb0.msp
    c:\windows\Installer\26743f0.msp
    c:\windows\Installer\26743f5.msp
    c:\windows\Installer\267d7e2.msp
    c:\windows\Installer\267d7e7.msp
    c:\windows\Installer\28d0900.msp
    c:\windows\Installer\28d0905.msp
    c:\windows\Installer\2a7019f.msp
    c:\windows\Installer\2a701a4.msp
    c:\windows\Installer\2d346b1.msp
    c:\windows\Installer\2d346b6.msp
    c:\windows\Installer\2ed8b3d.msp
    c:\windows\Installer\2ed8b43.msp
    c:\windows\Installer\2f41734.msp
    c:\windows\Installer\2f41739.msp
    c:\windows\Installer\2fde2e5.msp
    c:\windows\Installer\3269a1c.msp
    c:\windows\Installer\3269a21.msp
    c:\windows\Installer\33dae70.msp
    c:\windows\Installer\33dae75.msp
    c:\windows\Installer\34157a1.msp
    c:\windows\Installer\34157a7.msp
    c:\windows\Installer\349ca79.msp
    c:\windows\Installer\349ca7e.msp
    c:\windows\Installer\34d5d35.msp
    c:\windows\Installer\34d5d3a.msp
    c:\windows\Installer\356a7bf.msp
    c:\windows\Installer\356a7c4.msp
    c:\windows\Installer\3660a58.msp
    c:\windows\Installer\3660a5d.msp
    c:\windows\Installer\36d31f3.msp
    c:\windows\Installer\372c10b.msp
    c:\windows\Installer\372c110.msp
    c:\windows\Installer\3742658.msp
    c:\windows\Installer\374265d.msp
    c:\windows\Installer\3759e33.msp
    c:\windows\Installer\3759e38.msp
    c:\windows\Installer\382fc.msp
    c:\windows\Installer\38300.msp
    c:\windows\Installer\38ba27e.msp
    c:\windows\Installer\39123cb.msp
    c:\windows\Installer\39123d0.msp
    c:\windows\Installer\3aafab9.msp
    c:\windows\Installer\3e059bf.msp
    c:\windows\Installer\3e059c4.msp
    c:\windows\Installer\3f02f56.msp
    c:\windows\Installer\3f02f5b.msp
    c:\windows\Installer\400940d.msp
    c:\windows\Installer\4009412.msp
    c:\windows\Installer\40ceaed.msp
    c:\windows\Installer\40ceaf2.msp
    c:\windows\Installer\4100da9.msp
    c:\windows\Installer\4100dae.msp
    c:\windows\Installer\418ae28.msp
    c:\windows\Installer\418ae2d.msp
    c:\windows\Installer\4a81910.msp
    c:\windows\Installer\4a81915.msp
    c:\windows\Installer\5410c0.msp
    c:\windows\Installer\5410c5.msp
    c:\windows\Installer\63d1361.msp
    c:\windows\Installer\63d1366.msp
    c:\windows\Installer\7588ed.msp
    c:\windows\Installer\7588f2.msp
    c:\windows\Installer\7a7c04a.msp
    c:\windows\Installer\7a7c04f.msp
    c:\windows\Installer\7e54cc2.msp
    c:\windows\Installer\7e54cc7.msp
    c:\windows\Installer\82539ee.msp
    c:\windows\Installer\82539f3.msp
    c:\windows\Installer\8507475.msp
    c:\windows\Installer\850747a.msp
    c:\windows\Installer\8b7850b.msp
    c:\windows\Installer\8b78510.msp
    c:\windows\Installer\93ec0cb.msp
    c:\windows\Installer\93ec0d0.msp
    c:\windows\Installer\cebf008.msp
    c:\windows\Installer\cebf00d.msp
    c:\windows\Installer\cf9480.msp
    c:\windows\Installer\cf9485.msp
    c:\windows\Installer\d05000.msp
    c:\windows\Installer\d05005.msp
    c:\windows\Installer\e65112f.msp
    c:\windows\Installer\e65114d.msp
    c:\windows\run.log
    c:\windows\system32\_004631_.tmp.dll
    c:\windows\system32\_004632_.tmp.dll
    c:\windows\system32\_004633_.tmp.dll
    c:\windows\system32\_004634_.tmp.dll
    c:\windows\system32\_004641_.tmp.dll
    c:\windows\system32\_004642_.tmp.dll
    c:\windows\system32\_004643_.tmp.dll
    c:\windows\system32\_004644_.tmp.dll
    c:\windows\system32\_004646_.tmp.dll
    c:\windows\system32\_004647_.tmp.dll
    c:\windows\system32\_004650_.tmp.dll
    c:\windows\system32\_004651_.tmp.dll
    c:\windows\system32\_004653_.tmp.dll
    c:\windows\system32\_004654_.tmp.dll
    c:\windows\system32\_004655_.tmp.dll
    c:\windows\system32\_004657_.tmp.dll
    c:\windows\system32\_004660_.tmp.dll
    c:\windows\system32\_004661_.tmp.dll
    c:\windows\system32\_004665_.tmp.dll
    c:\windows\system32\_004666_.tmp.dll
    c:\windows\system32\_004668_.tmp.dll
    c:\windows\system32\_004671_.tmp.dll
    c:\windows\system32\_004673_.tmp.dll
    c:\windows\system32\_004675_.tmp.dll
    c:\windows\system32\_004676_.tmp.dll
    c:\windows\system32\_004677_.tmp.dll
    c:\windows\system32\_004680_.tmp.dll
    c:\windows\system32\_004681_.tmp.dll
    c:\windows\system32\_004682_.tmp.dll
    c:\windows\system32\_004683_.tmp.dll
    c:\windows\system32\_004684_.tmp.dll
    c:\windows\system32\_004689_.tmp.dll
    c:\windows\system32\_004691_.tmp.dll
    c:\windows\system32\_004692_.tmp.dll
    c:\windows\system32\drivers\UACcrvmnukvjq.sys
    c:\windows\system32\mdm.exe
    c:\windows\system32\net.net
    c:\windows\system32\UACbrsngngxid.db
    c:\windows\system32\UACfaswwylmkr.dll
    c:\windows\system32\uacinit.dll
    c:\windows\system32\UAColaqpxmlib.dll
    c:\windows\system32\UACthwmivkvcv.dll
    c:\windows\system32\UACvjbnmttpqq.dll
    c:\windows\system32\UACvnklqtmxai.dll
    c:\windows\system32\UACxbiulyqaql.dat
    c:\windows\winhelp.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_UACd.sys
    -------\Legacy_UACd.sys


    ((((((((((((((((((((((((( Files Created from 2009-07-08 to 2009-08-08 )))))))))))))))))))))))))))))))
    .

    2009-08-07 20:15 . 2009-08-07 20:15 0 ----a-w- c:\documents and settings\Laurie\settings.dat
    2009-08-07 12:22 . 2009-08-07 12:22 -------- d-----w- c:\program files\ERUNT
    2009-08-07 02:40 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2009-08-06 21:44 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2009-08-06 18:37 . 2009-08-06 18:37 -------- dc-h--w- c:\docume~1\ALLUSE~1\APPLIC~1\{EF63305C-BAD7-4144-9208-D65528260864}
    2009-08-06 18:37 . 2009-08-06 18:37 -------- d-----w- c:\program files\Lavasoft
    2009-08-06 18:37 . 2009-08-06 18:37 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Lavasoft
    2009-08-05 01:42 . 2009-08-05 01:43 -------- d-----w- c:\program files\Windows Live Safety Center
    2009-08-01 22:49 . 2009-08-01 22:49 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
    2009-07-26 20:09 . 2009-07-26 20:09 -------- d-----w- c:\program files\IKEA HomePlanner
    2009-07-26 20:09 . 2009-07-26 20:09 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-08 02:01 . 2008-04-11 13:28 81984 ----a-w- c:\windows\system32\bdod.bin
    2009-08-07 20:00 . 2009-03-30 23:49 -------- d-----w- c:\documents and settings\Laurie\Application Data\Dropbox
    2009-08-04 01:40 . 2008-06-17 11:14 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
    2009-08-04 01:38 . 2008-06-17 11:14 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2009-08-04 01:31 . 2009-03-30 23:49 -------- d-----w- c:\program files\Dropbox
    2009-07-09 01:43 . 2009-07-09 01:43 -------- d-----w- c:\program files\Pivot Stickfigure Animator
    2009-07-09 01:28 . 2009-07-08 23:51 -------- d-----w- c:\documents and settings\Laurie\Application Data\Any Video Converter
    2009-07-08 23:52 . 2009-07-08 23:51 -------- d-----w- c:\program files\Any Video Converter
    2009-07-08 23:51 . 2007-12-27 03:10 -------- d-----w- c:\program files\Common Files\AVSMedia
    2009-07-08 23:51 . 2009-07-08 23:43 -------- d-----w- c:\program files\AVS4YOU
    2009-07-08 23:44 . 2009-07-08 23:44 -------- d-----w- c:\documents and settings\Laurie\Application Data\AVS4YOU
    2009-07-08 22:34 . 2007-10-24 17:00 -------- d-----w- c:\documents and settings\Laurie\Application Data\U3
    2009-07-03 17:09 . 2004-08-11 22:00 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-06-16 14:36 . 2004-08-11 22:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-16 14:36 . 2004-08-11 22:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-14 15:22 . 2006-09-14 18:05 -------- d-----w- c:\documents and settings\Laurie\Application Data\Canon
    2009-06-10 17:56 . 2007-11-14 17:41 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\FLEXnet
    2009-06-03 19:09 . 2004-08-11 22:00 1291264 ----a-w- c:\windows\system32\quartz.dll
    2009-05-28 22:36 . 2009-05-28 22:35 34 ----a-w- c:\documents and settings\Laurie\jagex_runescape_preferences.dat
    2009-05-21 02:37 . 2006-08-30 00:19 54632 ----a-w- c:\documents and settings\Laurie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2006-09-12 18:38 . 2006-08-30 03:36 88 -csh--r- c:\windows\system32\07BE1FC234.sys
    2006-09-12 18:38 . 2006-08-30 03:36 3350 -csha-w- c:\windows\system32\KGyGaAvL.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
    "Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [2008-08-26 2019624]
    "PhotoshopElementsSyncAgent"="c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsSyncAgent.exe" [2009-04-07 1742176]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
    "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
    "USB2Check"="c:\windows\system32\PCLECoInst.dll" [2007-02-20 81920]
    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-11-07 122940]
    "CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
    "BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-15 368640]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "VBTUCopy"="c:\program files\VBTUCopy\VBTUCopy.exe" [2004-09-22 126976]
    "USBToolTip"="c:\program files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
    "PCLEPCI"="c:\progra~1\Pinnacle\PPE\PPE.EXE" [2004-02-03 49152]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
    "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
    "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-02-10 282624]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

    c:\documents and settings\Laurie\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\program files\Dropbox\Dropbox.exe [2008-9-26 24096981]

    c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
    Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-3-24 113664]
    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-12-6 67128]
    NkvMon.exe.lnk - c:\program files\Nikon\NkView6\NkvMon.exe [2006-8-29 241664]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [06/08/2009 5:44 PM 64160]
    R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [11/09/2007 1:45 AM 124832]
    R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [16/09/2008 1:03 PM 169312]
    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [30/07/2007 6:47 PM 86792]
    S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [03/07/2009 10:49 AM 1029456]
    S3 PinnacleMarvinAVS;Pinnacle AVStream Service for MovieBox Deluxe, 500-USB and 700-USB;c:\windows\system32\drivers\MarvinAVS.sys [25/03/2008 6:25 PM 434176]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    uSearch Bar = hxxp://www.google.com/ie
    mSearchAssistant = hxxp://www.google.com/ie
    IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.18\AMVConverter\grab.html
    Trusted Zone: akamai.net\a248.e
    Trusted Zone: bitdefender.com
    Trusted Zone: netflame.cc\ssl-hints
    Trusted Zone: musicmatch.com\online
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\QuickTax 2007\ic2007pp.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-07 22:17
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\docume~1\Laurie\LOCALS~1\Temp\_tf31.tmp

    scan completed successfully
    hidden files: 1

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\bdfsfltr]
    "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\bdfsfltr]
    "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-2084488568-3039290927-1473572071-1006\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,7f,72,18,73,b7,
    8e,1c,94,e2,63,26,f1,3f,c8,ff,68,d1,35,66,53,3b,da,a6,14,e2,63,26,f1,3f,c8,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,32,6c,b3,e2,b2,
    67,64,13,6a,9c,d6,61,af,45,84,18,aa,32,02,85,bc,c8,3d,65,6a,9c,d6,61,af,45,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,30,30,c2,c9,13,
    fd,85,64,ff,7c,85,e0,43,d4,0e,fe,c1,10,2b,dd,f8,7f,ab,2c,ff,7c,85,e0,43,d4,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,56,ec,32,f7,f7,
    f1,80,06,86,8c,21,01,be,91,eb,e7,d6,60,bb,c7,a1,69,55,65,86,8c,21,01,be,91,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,98,6c,be,9f,7f,
    43,d6,1a,f5,1d,4d,73,a8,13,5c,05,91,ae,ac,4d,04,6e,d0,04,f5,1d,4d,73,a8,13,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,27,c5,58,1f,83,
    99,d8,31,df,20,58,62,78,6b,cf,c8,85,ec,49,f2,2b,77,3e,1b,df,20,58,62,78,6b,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,df,ae,e5,80,79,
    b1,26,19,fb,a7,78,e6,12,2f,9a,ea,c7,91,21,83,a9,38,8d,9b,fb,a7,78,e6,12,2f,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,04,bc,3d,df,64,
    cc,c0,64,01,3a,48,fc,e8,04,4a,f1,2e,7c,c1,27,c4,cb,2c,d7,01,3a,48,fc,e8,04,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,9c,61,7c,d7,37,
    e8,29,3f,f6,0f,4e,58,98,5b,89,c9,b1,72,3c,84,2f,01,a0,23,f6,0f,4e,58,98,5b,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,78,68,59,55,5d,
    c4,3e,b1,3d,ce,ea,26,2d,45,aa,78,25,6d,4b,8e,4f,86,19,37,3d,ce,ea,26,2d,45,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,58,49,c1,64,32,
    96,0a,09,2a,b7,cc,b5,b9,7f,41,e7,51,ee,e9,e4,23,5a,64,a3,2a,b7,cc,b5,b9,7f,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,db,2d,2c,ec,bf,
    1c,76,71,6c,43,2d,1e,aa,22,2f,9c,93,f3,e5,ff,00,f9,de,33,6c,43,2d,1e,aa,22,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(2396)
    c:\windows\system32\WININET.dll
    c:\program files\Dropbox\DropboxExt.dll
    c:\windows\system32\wpdshext.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\windows\system32\Audiodev.dll
    c:\windows\system32\WMVCore.DLL
    c:\windows\system32\WMASF.DLL
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\CTSVCCDA.EXE
    c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    c:\windows\system32\nvsvc32.exe
    c:\program files\Dell Support Center\bin\sprtsvc.exe
    c:\windows\system32\UAService7.exe
    c:\program files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
    c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    c:\program files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
    c:\program files\BitDefender\BitDefender 2008\vsserv.exe
    c:\program files\Canon\CAL\CALMAIN.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2009-08-08 22:27 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-08-08 02:27

    Pre-Run: 6,827,745,280 bytes free
    Post-Run: 6,896,029,696 bytes free

    Current=3 Default=3 Failed=1 LastKnownGood=5 Sets=1,2,3,5
    420 --- E O F --- 2009-08-07 22:17






    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:36:58 PM, on 07/08/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
    C:\Program Files\VBTUCopy\VBTUCopy.exe
    C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Laurie\Desktop\HiJackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe"
    O4 - HKLM\..\Run: [USB2Check] "RUNDLL32.EXE" "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CTCheck] "C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [VBTUCopy] "C:\Program Files\VBTUCopy\VBTUCopy.exe" /a /f
    O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
    O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
    O4 - HKCU\..\Run: [PhotoshopElementsSyncAgent] C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsSyncAgent.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.18\AMVConverter\grab.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/S...dObjSigned.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase1140.cab
    O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupda...01/CTSUEng.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1202843531562
    O16 - DPF: {7FE26BE2-B923-4B41-9834-E84DA1CC1F96} (Closet Control) - http://vsp.closetmaid.com/vsp/cmaidc...downloader.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...22/mcfscan.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupda...5106/CTPID.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll
    O18 - Protocol: intu-qt2008 - {05E53CE9-66C8-4A9E-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll
    O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 12414 bytes


    My computer seems to be working a bit better, no redirects when I google a website. I will test it a bit more to make sure everythings okay.
    Thanks

  6. #6
    Emeritus- Malware Team
    Join Date
    Oct 2008
    Location
    Cornwall, UK
    Posts
    592

    Default

    Disable Teatimer

    Please disable Teatimer as it may interfere with the fix.

    • If you have version 1.6, right click the Spybot Icon in the system tray near the clock (looks like a blue/white calendar with a padlock symbol).
    • Click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
    • Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
    • Click on Mode > Advanced Mode. When it prompts you, click Yes.
    • On the left hand side, click on Tools.
    • Check this box if it is not yet ticked: Resident.
    • You will notice that Resident is now added under Tools. Click on Resident.
    • Uncheck this box: Resident "TeaTimer" (Protection of over-all system settings) active.
    • Exit Spybot Search & Destroy.
    • Reboot your machine for the changes to take effect.


    Once your log is clean you can re-enable those settings in TeaTimer.




    Install Recovery Console via Combofix

    IMPORTANT: combofix.exe MUST be on your Desktop for us to proceed.

    --------------------------------------------------------------------


    • With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.
    • The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
    • Go to Microsoft's website => http://support.microsoft.com/kb/310994
    • Select the download that's appropriate for your Operating System

    • Download the file & save it as it's originally named.


    ---------------------------------------------------------------------

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

    • Drag the setup package onto ComboFix.exe and drop it.
    • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.

    • At the next prompt, click 'Yes' to run the full ComboFix scan.
    • When the tool is finished, it will produce a report for you.



    Next Reply

    Please reply with:

    • ComboFix log (found at C:\Combofix.txt)
    • New HijackThis log
    MRU Master of Malware Removal University

    Member of UNITE and ASAP

  7. #7
    Junior Member
    Join Date
    Aug 2009
    Posts
    9

    Default

    ComboFix 09-08-07.09 - Laurie 08/08/2009 6:39.2.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.3042 [GMT -4:00]
    Running from: c:\documents and settings\Laurie\Desktop\Combo-Fix.exe
    Command switches used :: c:\documents and settings\Laurie\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
    * Created a new restore point
    .

    ((((((((((((((((((((((((( Files Created from 2009-07-08 to 2009-08-08 )))))))))))))))))))))))))))))))
    .

    2009-08-08 02:35 . 2009-08-08 02:35 -------- d-----w- C:\Rooter$
    2009-08-07 20:15 . 2009-08-07 20:15 0 ----a-w- c:\documents and settings\Laurie\settings.dat
    2009-08-07 12:22 . 2009-08-07 12:22 -------- d-----w- c:\program files\ERUNT
    2009-08-07 02:40 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2009-08-06 21:44 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2009-08-06 18:37 . 2009-08-06 18:37 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
    2009-08-06 18:37 . 2009-07-08 17:28 2920112 -c--a-w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
    2009-08-06 18:37 . 2009-08-06 18:37 -------- d-----w- c:\program files\Lavasoft
    2009-08-06 18:37 . 2009-08-06 18:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
    2009-08-05 01:42 . 2009-08-05 01:43 -------- d-----w- c:\program files\Windows Live Safety Center
    2009-08-01 22:49 . 2009-08-01 22:49 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
    2009-07-26 20:09 . 2009-07-26 20:09 -------- d-----w- c:\program files\IKEA HomePlanner
    2009-07-26 20:09 . 2009-07-26 20:09 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-08 10:46 . 2008-04-11 13:28 81984 ----a-w- c:\windows\system32\bdod.bin
    2009-08-08 10:20 . 2009-03-30 23:49 -------- d-----w- c:\documents and settings\Laurie\Application Data\Dropbox
    2009-08-08 10:12 . 2008-06-17 11:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-08-04 01:38 . 2008-06-17 11:14 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2009-08-04 01:31 . 2009-03-30 23:49 -------- d-----w- c:\program files\Dropbox
    2009-07-09 01:43 . 2009-07-09 01:43 -------- d-----w- c:\program files\Pivot Stickfigure Animator
    2009-07-09 01:28 . 2009-07-08 23:51 -------- d-----w- c:\documents and settings\Laurie\Application Data\Any Video Converter
    2009-07-08 23:52 . 2009-07-08 23:51 -------- d-----w- c:\program files\Any Video Converter
    2009-07-08 23:51 . 2007-12-27 03:10 -------- d-----w- c:\program files\Common Files\AVSMedia
    2009-07-08 23:51 . 2009-07-08 23:43 -------- d-----w- c:\program files\AVS4YOU
    2009-07-08 23:44 . 2009-07-08 23:44 -------- d-----w- c:\documents and settings\Laurie\Application Data\AVS4YOU
    2009-07-08 22:34 . 2007-10-24 17:00 -------- d-----w- c:\documents and settings\Laurie\Application Data\U3
    2009-07-03 17:09 . 2004-08-11 22:00 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-06-16 14:36 . 2004-08-11 22:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-16 14:36 . 2004-08-11 22:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-14 15:22 . 2006-09-14 18:05 -------- d-----w- c:\documents and settings\Laurie\Application Data\Canon
    2009-06-10 17:56 . 2007-11-14 17:41 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
    2009-06-03 19:09 . 2004-08-11 22:00 1291264 ----a-w- c:\windows\system32\quartz.dll
    2009-05-28 22:36 . 2009-05-28 22:35 34 ----a-w- c:\documents and settings\Laurie\jagex_runescape_preferences.dat
    2009-05-21 02:37 . 2006-08-30 00:19 54632 ----a-w- c:\documents and settings\Laurie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-05-12 20:08 . 2008-12-11 18:26 38208 ----a-w- c:\documents and settings\Laurie\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
    2006-09-12 18:38 . 2006-08-30 03:36 88 -csh--r- c:\windows\system32\07BE1FC234.sys
    2006-09-12 18:38 . 2006-08-30 03:36 3350 -csha-w- c:\windows\system32\KGyGaAvL.sys
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-08-08_02.17.33 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-08-08 10:19 . 2009-08-08 10:19 16384 c:\windows\Temp\Perflib_Perfdata_414.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]
    "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
    "Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [2008-08-26 2019624]
    "PhotoshopElementsSyncAgent"="c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsSyncAgent.exe" [2009-04-07 1742176]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
    "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
    "USB2Check"="c:\windows\system32\PCLECoInst.dll" [2007-02-20 81920]
    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-11-07 122940]
    "CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
    "BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-15 368640]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "USBToolTip"="c:\program files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
    "PCLEPCI"="c:\progra~1\Pinnacle\PPE\PPE.EXE" [2004-02-03 49152]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
    "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
    "VBTUCopy"="c:\program files\VBTUCopy\VBTUCopy.exe" [2004-09-22 126976]
    "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-02-10 282624]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

    c:\documents and settings\Laurie\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\program files\Dropbox\Dropbox.exe [2008-9-26 24096981]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-3-24 113664]
    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-12-6 67128]
    NkvMon.exe.lnk - c:\program files\Nikon\NkView6\NkvMon.exe [2006-8-29 241664]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [06/08/2009 5:44 PM 64160]
    R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [11/09/2007 1:45 AM 124832]
    R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [16/09/2008 1:03 PM 169312]
    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [30/07/2007 6:47 PM 86792]
    S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [03/07/2009 10:49 AM 1029456]
    S3 PinnacleMarvinAVS;Pinnacle AVStream Service for MovieBox Deluxe, 500-USB and 700-USB;c:\windows\system32\drivers\MarvinAVS.sys [25/03/2008 6:25 PM 434176]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]

    2009-08-02 c:\windows\Tasks\Disk Cleanup.job
    - c:\windows\system32\cleanmgr.exe [2004-08-11 00:12]

    2009-08-08 c:\windows\Tasks\User_Feed_Synchronization-{E809416D-E002-49E5-93A4-43FF301DF5F5}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.18\AMVConverter\grab.html
    Trusted Zone: akamai.net\a248.e
    Trusted Zone: bitdefender.com
    Trusted Zone: netflame.cc\ssl-hints
    Trusted Zone: musicmatch.com\online
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\QuickTax 2007\ic2007pp.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-08 06:46
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\bdfsfltr]
    "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\bdfsfltr]
    "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-2084488568-3039290927-1473572071-1006\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,7f,72,18,73,b7,
    8e,1c,94,e2,63,26,f1,3f,c8,ff,68,d1,35,66,53,3b,da,a6,14,e2,63,26,f1,3f,c8,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,32,6c,b3,e2,b2,
    67,64,13,6a,9c,d6,61,af,45,84,18,aa,32,02,85,bc,c8,3d,65,6a,9c,d6,61,af,45,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,30,30,c2,c9,13,
    fd,85,64,ff,7c,85,e0,43,d4,0e,fe,c1,10,2b,dd,f8,7f,ab,2c,ff,7c,85,e0,43,d4,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,56,ec,32,f7,f7,
    f1,80,06,86,8c,21,01,be,91,eb,e7,d6,60,bb,c7,a1,69,55,65,86,8c,21,01,be,91,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,98,6c,be,9f,7f,
    43,d6,1a,f5,1d,4d,73,a8,13,5c,05,91,ae,ac,4d,04,6e,d0,04,f5,1d,4d,73,a8,13,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,27,c5,58,1f,83,
    99,d8,31,df,20,58,62,78,6b,cf,c8,85,ec,49,f2,2b,77,3e,1b,df,20,58,62,78,6b,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,df,ae,e5,80,79,
    b1,26,19,fb,a7,78,e6,12,2f,9a,ea,c7,91,21,83,a9,38,8d,9b,fb,a7,78,e6,12,2f,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,04,bc,3d,df,64,
    cc,c0,64,01,3a,48,fc,e8,04,4a,f1,2e,7c,c1,27,c4,cb,2c,d7,01,3a,48,fc,e8,04,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,9c,61,7c,d7,37,
    e8,29,3f,f6,0f,4e,58,98,5b,89,c9,b1,72,3c,84,2f,01,a0,23,f6,0f,4e,58,98,5b,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,78,68,59,55,5d,
    c4,3e,b1,3d,ce,ea,26,2d,45,aa,78,25,6d,4b,8e,4f,86,19,37,3d,ce,ea,26,2d,45,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,58,49,c1,64,32,
    96,0a,09,2a,b7,cc,b5,b9,7f,41,e7,51,ee,e9,e4,23,5a,64,a3,2a,b7,cc,b5,b9,7f,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
    "ThreadingModel"="Apartment"
    @="c:\\WINDOWS\\system32\\OLE32.DLL"
    "8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,db,2d,2c,ec,bf,
    1c,76,71,6c,43,2d,1e,aa,22,2f,9c,93,f3,e5,ff,00,f9,de,33,6c,43,2d,1e,aa,22,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(1388)
    c:\windows\system32\WININET.dll
    c:\program files\Dropbox\DropboxExt.dll
    c:\windows\system32\wpdshext.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\windows\system32\Audiodev.dll
    c:\windows\system32\WMVCore.DLL
    c:\windows\system32\WMASF.DLL
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    .
    Completion time: 2009-08-08 6:50
    ComboFix-quarantined-files.txt 2009-08-08 10:50
    ComboFix2.txt 2009-08-08 02:27

    Pre-Run: 6,808,313,856 bytes free
    Post-Run: 6,762,479,616 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [Boot Loader]
    Timeout=2
    Default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [Operating Systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    c:\$win_nt$.~bt\BOOTSECT.DAT="Microsoft Windows XP Professional Setup"

    256 --- E O F --- 2009-08-08 03:12






    Logfile of Trend Micro HijackThis v2.0.2[/COLOR]Scan saved at 6:53:11 AM, on 08/08/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
    C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\VBTUCopy\VBTUCopy.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Laurie\Desktop\Virus Aug2009\HiJackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe"
    O4 - HKLM\..\Run: [USB2Check] "RUNDLL32.EXE" "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CTCheck] "C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
    O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [VBTUCopy] "C:\Program Files\VBTUCopy\VBTUCopy.exe" /a /f
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
    O4 - HKCU\..\Run: [PhotoshopElementsSyncAgent] C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsSyncAgent.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.18\AMVConverter\grab.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/S...dObjSigned.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase1140.cab
    O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupda...01/CTSUEng.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1202843531562
    O16 - DPF: {7FE26BE2-B923-4B41-9834-E84DA1CC1F96} (Closet Control) - http://vsp.closetmaid.com/vsp/cmaidc...downloader.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...22/mcfscan.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupda...5106/CTPID.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll
    O18 - Protocol: intu-qt2008 - {05E53CE9-66C8-4A9E-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll
    O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 12112 bytes



    2 reports as per your request....

  8. #8
    Emeritus- Malware Team
    Join Date
    Oct 2008
    Location
    Cornwall, UK
    Posts
    592

    Default

    Remove HijackThis entries


    • Run HijackThis
    • Click on the Scan button
    • Put a check beside all of the items listed below (if present):

      O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
      O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
    • Close all open windows and browsers/email etc...
    • Click on the Fix Checked button
    • When completed close the application.





    Uninstall list

    Make an uninstall list using HijackThis. To access the Uninstall Manager you would do the following:


    • Start HijackThis
    • Click on the Config button
    • Click on the Misc Tools button
    • Click on the Open Uninstall Manager button.
    • Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.





    ATF-Cleaner

    Please download ATF Cleaner by Atribune.


    • Save it to your desktop
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.

      If you use Firefox browser
    • Click Firefox at the top and choose: Select All
    • Click the Empty Selected button.

      NOTE: If you would like to keep your saved passwords please click No at the prompt.
    • Click Exit on the Main menu to close the program.





    Kaspersky Online Scan

    You can use either Internet Explorer or Mozilla FireFox for this scan.

    Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.


    • Please go to Kaspersky website and perform an online antivirus scan.
    • Read through the requirements and privacy statement and click on Accept button.
    • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    • When the downloads have finished, click on Settings.
    • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
      • Archives

    • Click on My Computer under Scan.
    • Once the scan is complete, it will display the results. Click on View Scan Report.
    • You will see a list of infected items there. Click on Save Report As....
    • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
    • Please post this log in your next reply along with a fresh HijackThis log.





    Logs/Information to Post in Next Reply

    Please post the following logs/Information in your reply:

    • HijackThis Uninstall list
    • Kaspersky Log
    • A fresh HijackThis Log ( after all the above has been done)
    • A description of how your computer is behaving
    MRU Master of Malware Removal University

    Member of UNITE and ASAP

  9. #9
    Junior Member
    Join Date
    Aug 2009
    Posts
    9

    Default

    HijackThis Uninstall List

    Acrobat.com
    Acrobat.com
    Ad-Aware
    Ad-Aware
    Adobe AIR
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Photoshop Elements 5.0.2 Patcher
    Adobe Photoshop Elements 6.0
    Adobe Photoshop Elements 7.0
    Adobe Photoshop.com Inspiration Browser
    Adobe Photoshop.com Uploader
    Adobe Reader 9.1.2
    Adobe Shockwave Player 11.5
    Adobe SVG Viewer
    AnswerWorks 5.0 English Runtime
    Any Video Converter 2.7.5
    Apple Software Update
    AudibleManager
    Beyond TV DVD Burning Foundation
    BitDefender Internet Security 2008
    Canon Camera Access Library
    Canon Camera Support Core Library
    Canon G.726 WMP-Decoder
    Canon IXY 320, PowerShot S230, IXUS v3 WIA Driver
    Canon MOV Decoder
    Canon MP Navigator 2.2
    Canon MP530
    Canon RAW Image Task for ZoomBrowser EX
    Canon Utilities CameraWindow
    Canon Utilities CameraWindow DC
    Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
    Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    Canon Utilities Digital Photo Professional 3.5
    Canon Utilities EOS Utility
    Canon Utilities FileViewerUtility 1.0
    Canon Utilities MyCamera
    Canon Utilities MyCamera DC
    Canon Utilities PhotoStitch
    Canon Utilities RemoteCapture 2.6
    Canon Utilities RemoteCapture DC
    Canon Utilities RemoteCapture Task for ZoomBrowser EX
    Canon Utilities ZoomBrowser EX
    Canon ZoomBrowser EX Memory Card Utility
    Compatibility Pack for the 2007 Office system
    Creative Software AutoUpdate
    Creative System Information
    Creative ZEN
    Critical Update for Windows Media Player 11 (KB959772)
    Dell CinePlayer
    Dell Digital Jukebox Driver
    Dell Driver Reset Tool
    Dell Resource CD
    Dell Support Center
    DellSupport
    Dropbox
    Easy-WebPrint
    Elements+ for Photoshop Elements 7.0
    ERUNT 1.1j
    Flash Video MX version 3.5.1.21
    getPlus(R)_ocx
    Hauppauge English Help Files and Resources
    Hauppauge WinTV
    Hauppauge WinTV Radio
    Hauppauge WinTV Scheduler
    Hauppauge WinTV2000
    High Definition Audio Driver Package - KB835221
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    IBM USB-to-Serial
    IKEA Home Planner
    ImageStream
    ImageStream_2008-09
    Intel Matrix Storage Manager
    Intel(R) PRO Network Connections Drivers
    Intel(R) PROSet for Wired Connections
    InterActual Player
    iSofter DVD Ripper Platinum 1.0.2006.912
    iTunes
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    J2SE Runtime Environment 5.0 Update 6
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3
    Java(TM) SE Runtime Environment 6 Update 1
    JpegSizer 6.0.5
    Learn2 Player (Uninstall Only)
    LimeWire 5.0.11
    Logitech Desktop Messenger
    Logitech Harmony Remote Software 7
    Math Resource Studio
    MCU
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft .NET Framework 3.0 Service Pack 1
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Basic Edition 2003
    Microsoft Plus! Digital Media Edition Installer
    Microsoft Plus! Photo Story 2 LE
    Microsoft Script Debugger
    Microsoft SQL Server Desktop Engine (PINNACLESYS)
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable
    MP3 Player Utilities 4.18
    MSN
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 6.0 Parser (KB933579)
    Musicmatch for Windows Media Player
    Musicmatch® Jukebox
    Nikon Scan
    Nikon View 6
    NVIDIA Drivers
    PhotoInPress BookDesigner
    PhotoshopdotcomInspirationBrowser
    Pinnacle Hollywood FX for Studio
    Pinnacle Instant DVD Recorder
    Pinnacle MediaServer
    Pinnacle PCI Performance Enhancer
    Pinnacle Systems USB-2 Device Drivers
    Pinnacle USB device drivers 2
    Pivot Stickfigure Animator
    Presto! PageManager 7.15.11
    Quicken 2009
    QuickTax 2006
    QuickTax 2007
    QuickTax 2008
    QuickTime
    RealPlayer
    Remote Control USB Driver
    Roxio DLA
    Roxio MyDVD LE
    Roxio RecordNow Audio
    Roxio RecordNow Copy
    Roxio RecordNow Data
    save2pc Light 3.37
    Search Assist
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB938127-v2)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB973346)
    SilverFast NikonM TWAIN 6.6.0r2
    SmartSound Quicktracks Plugin
    Sonic Activation Module
    Sonic Update Manager
    Spelling Dictionaries Support For Adobe Reader 8
    Spybot - Search & Destroy
    Uniblue ProcessScanner
    Uniblue RegistryBooster 2009
    Uniblue RegistryBooster 2009
    Uniblue System Tweaker
    Update for Windows Internet Explorer 8 (KB971930)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    URL Assistant
    VIA Platform Device Manager
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    Visual Studio 2005 Redist Package
    WebCyberCoach 3.2 Dell
    WinAVI Video Converter 5.8
    Windows Imaging Component
    Windows Installer Clean Up
    Windows Internet Explorer 8
    Windows Live OneCare safety scanner
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 10
    Windows Media Player 11
    Windows Media Player 11
    Windows Presentation Foundation
    Windows XP Service Pack 3
    YouSendIt Express
    YouSendIt Plug-in for Outlook
    ZEN Media Explorer
    ZENcast Organizer


    KASPERSKY LOG FAILED THIS IS THE MESSAGE I RECEIVED:



    Program is starting. Please wait...
    Update source selected: http://www.kaspersky.com
    Downloading file: packages/kos-extras.jar
    Program has started.

    Program database is being updated. Please wait...

    Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program. You must be online to update the Kaspersky Online Scanner 7.0 database. With the latest database updates, you can find new viruses and other threats. Please go online to use Kaspersky Online Scanner 7.0. [ERROR: Key is expired]

    I TRIED CLOSING THE PROGRAM AND RESTARTING IT BUT KEPT GETTING THE SAME MESSAGE. ALL MY ANTI VIRUS STUFF IS OFF. ANY SUGGESTIONS?

  10. #10
    Junior Member
    Join Date
    Aug 2009
    Posts
    9

    Default

    Forgot to included the HijackThis log after I ran Kaspersky. I also forgot to mention Kaspersky scan ran to 57% before it gave me the error message.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:51:14 PM, on 08/08/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
    C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\VBTUCopy\VBTUCopy.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Dropbox\Dropbox.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Laurie\Desktop\Virus Aug2009\HiJackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe"
    O4 - HKLM\..\Run: [USB2Check] "RUNDLL32.EXE" "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CTCheck] "C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe"
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
    O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [VBTUCopy] "C:\Program Files\VBTUCopy\VBTUCopy.exe" /a /f
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
    O4 - HKCU\..\Run: [PhotoshopElementsSyncAgent] C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsSyncAgent.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.18\AMVConverter\grab.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/S...dObjSigned.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase1140.cab
    O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupda...01/CTSUEng.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1202843531562
    O16 - DPF: {7FE26BE2-B923-4B41-9834-E84DA1CC1F96} (Closet Control) - http://vsp.closetmaid.com/vsp/cmaidc...downloader.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...22/mcfscan.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupda...5106/CTPID.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll
    O18 - Protocol: intu-qt2008 - {05E53CE9-66C8-4A9E-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll
    O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 12289 bytes

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •