Page 1 of 2 12 LastLast
Results 1 to 10 of 18

Thread: infected by apnwkyytssd.exe

  1. #1
    Member
    Join Date
    Dec 2008
    Posts
    57

    Default infected by apnwkyytssd.exe

    This weird "antivirus" program popped up when I started my computer. I went in to msconfig and turned off apnwkyytssd.exe and restarted. The "antivirus" program did not start, but now IE can't find the internet. Firefox is OK. The PC is running uber slow right now. Please help!!

    Here are my two DDS Logs:

    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Steve at 17:22:04.65 on Wed 08/04/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.639.209 [GMT -4:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\DSentry.exe
    C:\PROGRA~1\AVG\AVG9\avgtray.exe
    C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
    C:\WINDOWS\system32\ctfmon.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\runservice.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Steve\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.yahoo.com/
    mSearch Bar =
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = <local>
    uInternet Settings,ProxyServer = http=127.0.0.1:6522
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: {fdd3b846-8d59-4ffb-8758-209b6ad74acc} - c:\program files\microsoft money\system\mnyviewer.dll
    TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
    TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    TB: {C7768536-96F8-4001-B1A2-90EE21279187} - No File
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [PopUpStopperFreeEdition] "c:\progra~1\panicw~1\pop-up~2\PSFree.exe"
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [UpdReg] c:\windows\UpdReg.EXE
    mRun: [DVDSentry] c:\windows\system32\DSentry.exe
    mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [DLCJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCJtime.dll,_RunDLLEntry@16
    mPolicies-explorer: <NO NAME> =
    IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\PartyPoker.exe
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} - c:\program files\microsoft money\system\mnyviewer.dll
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: turbotax.com
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB
    DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab
    DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
    DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
    DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} - hxxp://download.mcafee.com/molbin/Shared/MGBrwFld.cab
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} - hxxps://email.health.state.ny.us/go/Notes.health.state.ny.us/iNotes.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
    DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
    DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} - hxxps://support.microsoft.com/OAS/ActiveX/odc.cab
    DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv9dmo.cab
    DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} - hxxps://email.health.state.ny.us/go/notes.health.state.ny.us/iNotes6W.cab
    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www1.snapfish.com/SnapfishActivia.cab
    DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1408.g.akamai.net/7/1408/9955/20031218/akamai.info.apple.com/iTunes4/WW/win/019-0123.20031218.zes4d/iTunesSetup.exe
    DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - hxxp://aolcc.aol.com/computercheckup/qdiagcc.cab
    DPF: {4B48D5DF-9021-45F7-A240-60304302A215} - hxxp://download.microsoft.com/download/b/d/b/bdb4e4ee-63b2-45ff-9d84-33205bf43143/WebCleaner.cab
    DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,77/mcinsctl.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229634899468
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} - hxxp://cs7b.instantservice.com/jars/customerxsigned34.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.5713078704
    DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,18/mcgdmgr.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/CLUE%20Classic/Images/armhelper.ocx
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
    DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - hxxp://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
    DPF: {D9EA64B2-B966-E177-332C-78B69886526D} - hxxp://download.newaol.com/bkpromo/download/PerformerSetup.cab
    DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} - hxxp://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
    DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} - hxxps://email.health.state.ny.us/go/notes.health.state.ny.us/dwa7W.cab
    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} - hxxp://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
    DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://fdl.msn.com/public/chat/msnchat45.cab
    DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: avgrsstarter - avgrsstx.dll
    STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows\system32\ieframe.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\steve\applic~1\mozilla\firefox\profiles\73an031c.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - plugin: c:\documents and settings\steve\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-2 216400]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-2 29584]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-27 243024]
    R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-15 308136]
    R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2003-6-16 2560]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-4 136176]
    S3 CoachVid;CoachVid;c:\windows\system32\drivers\CoachVid.sys [2010-3-14 45344]
    S3 XIRLINK;IBM PC Camera;c:\windows\system32\drivers\C-itNT.sys [2003-5-23 899884]

    =============== Created Last 30 ================


    ==================== Find3M ====================

    2010-08-04 20:47:16 5209 --sha-w- c:\windows\system32\mmf.sys
    2010-07-15 20:28:04 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2010-07-15 20:26:26 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2010-05-18 20:35:16 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-05-18 20:35:16 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2010-05-18 20:35:16 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2010-05-18 20:35:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2008-05-29 13:59:20 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052920080530\index.dat

    ============= FINISH: 17:23:31.67 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 5/23/2003 6:57:51 PM
    System Uptime: 8/4/2010 4:46:25 PM (1 hours ago)

    Motherboard: Dell Computer Corp. | | 0M0321
    Processor: Intel(R) Pentium(R) 4 CPU 2.53GHz | Microprocessor | 2524/533mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 56 GiB total, 26.565 GiB free.
    D: is CDROM ()
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP527: 5/6/2010 3:35:56 PM - Avg Update
    RP528: 5/7/2010 4:43:11 PM - System Checkpoint
    RP529: 5/8/2010 5:43:26 PM - System Checkpoint
    RP530: 5/9/2010 6:47:14 PM - System Checkpoint
    RP531: 5/11/2010 6:58:53 PM - System Checkpoint
    RP532: 5/13/2010 7:02:05 PM - System Checkpoint
    RP533: 5/14/2010 7:18:53 PM - System Checkpoint
    RP534: 5/15/2010 12:21:51 PM - Software Distribution Service 3.0
    RP535: 5/16/2010 1:19:27 PM - System Checkpoint
    RP536: 5/18/2010 5:26:47 PM - System Checkpoint
    RP537: 5/19/2010 5:31:40 PM - System Checkpoint
    RP538: 5/20/2010 6:06:01 PM - System Checkpoint
    RP539: 5/21/2010 7:05:17 PM - System Checkpoint
    RP540: 5/22/2010 7:28:42 PM - System Checkpoint
    RP541: 5/23/2010 7:47:05 PM - System Checkpoint
    RP542: 5/24/2010 8:13:13 PM - System Checkpoint
    RP543: 5/25/2010 9:15:23 PM - System Checkpoint
    RP544: 5/26/2010 10:10:33 PM - System Checkpoint
    RP545: 5/27/2010 10:29:06 PM - System Checkpoint
    RP546: 5/29/2010 6:21:32 AM - System Checkpoint
    RP547: 5/30/2010 7:18:21 AM - System Checkpoint
    RP548: 5/31/2010 6:48:38 AM - Software Distribution Service 3.0
    RP549: 6/1/2010 3:48:37 PM - System Checkpoint
    RP550: 6/2/2010 10:13:18 PM - Avg Update
    RP551: 6/4/2010 6:28:47 PM - System Checkpoint
    RP552: 6/5/2010 6:41:13 PM - System Checkpoint
    RP553: 6/6/2010 7:54:11 PM - System Checkpoint
    RP554: 6/7/2010 7:56:31 PM - System Checkpoint
    RP555: 6/8/2010 8:04:07 PM - System Checkpoint
    RP556: 6/9/2010 5:12:40 PM - Software Distribution Service 3.0
    RP557: 6/10/2010 6:07:25 PM - System Checkpoint
    RP558: 6/11/2010 6:55:24 PM - System Checkpoint
    RP559: 6/12/2010 8:29:40 PM - System Checkpoint
    RP560: 6/14/2010 4:46:14 PM - System Checkpoint
    RP561: 6/15/2010 5:41:44 PM - System Checkpoint
    RP562: 6/15/2010 9:09:52 PM - Removed LeapFrog Connect
    RP563: 6/16/2010 9:24:57 PM - System Checkpoint
    RP564: 6/17/2010 9:37:03 PM - System Checkpoint
    RP565: 6/19/2010 9:00:36 AM - System Checkpoint
    RP566: 6/20/2010 9:03:19 AM - System Checkpoint
    RP567: 6/21/2010 6:45:40 PM - System Checkpoint
    RP568: 6/22/2010 6:54:40 PM - System Checkpoint
    RP569: 6/24/2010 10:31:47 AM - System Checkpoint
    RP570: 6/25/2010 4:21:11 PM - Avg Update
    RP571: 6/25/2010 4:43:33 PM - Software Distribution Service 3.0
    RP572: 6/26/2010 5:39:51 PM - System Checkpoint
    RP573: 6/27/2010 6:33:48 PM - System Checkpoint
    RP574: 6/28/2010 6:44:59 PM - System Checkpoint
    RP575: 6/29/2010 7:43:23 PM - System Checkpoint
    RP576: 6/30/2010 8:38:08 PM - System Checkpoint
    RP577: 7/1/2010 9:04:11 PM - System Checkpoint
    RP578: 7/2/2010 9:54:32 PM - System Checkpoint
    RP579: 7/3/2010 9:58:38 PM - System Checkpoint
    RP580: 7/4/2010 10:51:41 PM - System Checkpoint
    RP581: 7/6/2010 9:51:35 AM - System Checkpoint
    RP582: 7/7/2010 7:52:32 PM - System Checkpoint
    RP583: 7/8/2010 8:49:49 PM - System Checkpoint
    RP584: 7/9/2010 6:10:22 AM - Removed Cisco Network Magic
    RP585: 7/9/2010 6:12:00 AM - Removed Pure Networks Platform
    RP586: 7/10/2010 6:42:00 AM - System Checkpoint
    RP587: 7/11/2010 8:42:41 AM - System Checkpoint
    RP588: 7/12/2010 3:41:43 PM - System Checkpoint
    RP589: 7/13/2010 5:51:26 PM - System Checkpoint
    RP590: 7/14/2010 6:45:41 PM - System Checkpoint
    RP591: 7/15/2010 4:25:31 PM - Avg Update
    RP592: 7/15/2010 4:28:17 PM - Avg Update
    RP593: 7/16/2010 8:19:30 PM - System Checkpoint
    RP594: 7/17/2010 8:57:12 PM - System Checkpoint
    RP595: 7/18/2010 9:32:29 AM - Software Distribution Service 3.0
    RP596: 7/19/2010 12:18:45 PM - System Checkpoint
    RP597: 7/20/2010 12:20:33 PM - Avg Update
    RP598: 7/20/2010 11:01:46 PM - Removed Safari
    RP599: 7/22/2010 5:58:26 PM - System Checkpoint
    RP600: 7/23/2010 6:46:24 PM - System Checkpoint
    RP601: 7/24/2010 7:34:23 PM - System Checkpoint
    RP602: 7/25/2010 8:15:14 PM - System Checkpoint
    RP603: 7/26/2010 8:55:18 PM - System Checkpoint
    RP604: 7/27/2010 9:13:40 PM - System Checkpoint
    RP605: 7/29/2010 1:30:31 PM - System Checkpoint
    RP606: 7/30/2010 5:16:42 PM - System Checkpoint
    RP607: 7/31/2010 6:08:59 PM - System Checkpoint
    RP608: 8/1/2010 6:28:19 PM - System Checkpoint
    RP609: 8/2/2010 6:42:30 PM - System Checkpoint
    RP610: 8/3/2010 6:58:04 PM - System Checkpoint

    ==== Installed Programs ======================

    Adobe AIR
    Adobe Atmosphere Player for Acrobat and Adobe Reader
    Adobe Download Manager 1.2 (Remove Only)
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Photoshop Album 2.0 Starter Edition
    Adobe Reader 9.1
    Adobe Shockwave Player
    AnswerWorks 4.0 Runtime - English
    AOL Coach Version 2.0(Build:20041026.5 en)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AVG Free 9.0
    Bonjour
    Canon Camera Access Library
    Canon Camera Support Core Library
    Canon G.726 WMP-Decoder
    CANON iMAGE GATEWAY Task for ZoomBrowser EX
    Canon Internet Library for ZoomBrowser EX
    Canon MovieEdit Task for ZoomBrowser EX
    Canon RAW Image Task for ZoomBrowser EX
    Canon Utilities CameraWindow
    Canon Utilities CameraWindow DC
    Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
    Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    Canon Utilities EOS Utility
    Canon Utilities MyCamera
    Canon Utilities MyCamera DC
    Canon Utilities PhotoStitch
    Canon Utilities RemoteCapture DC
    Canon Utilities RemoteCapture Task for ZoomBrowser EX
    Canon Utilities ZoomBrowser EX
    Canon ZoomBrowser EX Memory Card Utility
    Conexant SmartHSFi V92 56K DF PCI Modem
    Data Lifeguard Diagnostic for Windows
    Dell Digital Jukebox Driver
    Dell Photo AIO Printer 964
    Dell Picture Studio - Dell Image Expert
    Dell Solution Center
    Dell Support
    Digital Line Detect
    Disney Flix 3.0
    DVDSentry
    ERUNT 1.1j
    Google Earth Plug-in
    Google Update Helper
    GradeQuick
    Help and Support Customization
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HyperLoad
    IE Host
    Intel(R) PRO Ethernet Adapter and Software
    Intel(R) PROSet II
    iPod for Windows 2006-03-23
    iTunes
    Java(TM) 6 Update 15
    Macromedia Flash Player
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework (English)
    Microsoft .NET Framework (English) v1.0.3705
    Microsoft .NET Framework 1.0 Hotfix (KB928367)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Data Access Components KB870669
    Microsoft Interactive Training
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Money 2002
    Microsoft Money 2002 System Pack
    Microsoft National Language Support Downlevel APIs
    Microsoft Office XP Media Content
    Microsoft Office XP Small Business
    Microsoft Silverlight
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Windows Media Video 9 VCM
    Microsoft XML Parser
    Modem Helper
    Mozilla Firefox (3.0.5)
    MSN Music Assistant
    NetWaiting
    NVIDIA Display Driver
    NVIDIA Windows 2000/XP Display Drivers
    Paint Shop Pro 7
    Pop-Up Stopper Free Edition
    PowerDVD
    PrimoPDF
    PrimoPDF Redistribution Package
    Qualxserve Service Agreement
    QuickTime
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Shockwave
    Skype™ 4.2
    Sound Blaster Live!
    TurboTax 2009
    TurboTax 2009 WinPerFedFormset
    TurboTax 2009 WinPerReleaseEngine
    TurboTax 2009 WinPerTaxSupport
    TurboTax 2009 wnyiper
    TurboTax 2009 wrapper
    Unity Web Player
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB969497)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Viewpoint Media Player
    WebEx Support Manager for Internet Explorer
    WebFldrs XP
    WexTech AnswerWorks
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage v1.3.0254.0
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format Runtime
    Windows Media Player 10
    Windows XP Service Pack 3
    WinPatrol

    ==== Event Viewer Messages From Past Week ========

    8/4/2010 4:42:56 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
    8/4/2010 4:42:47 PM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
    8/3/2010 3:53:31 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 0007E9893EEE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

    ==== End Of File ===========================

  2. #2
    Emeritus
    Join Date
    Aug 2007
    Posts
    1,875

    Default

    Hello and welcome to Safer Networking.

    My name is km2357 and I will be helping you to remove any infection(s) that you may have.

    I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

    If for any reason you do not understand an instruction or are just unsure then please do not guess, simply post back with your questions/concerns and we will go through it again.

    Please do not start another thread or topic, I will assist you at this thread until we solve your problems.

    Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.

    Sorry for the delay in replying, the forum is very busy. If you still need help, please do the following:


    Step # 1 Download and run DDS

    Download DDS and save it to your desktop from here or here.
    Disable any script blocker, and then double click dds.scr to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop. Post them back to your topic.




    Step # 2: Download and Run Gmer

    Please download gmer.zip from Gmer and save it to your desktop.

    ***Please close any open programs ***

    Double-click gmer.exe. The program will begin to run.

    **Caution**
    These types of scans can produce false positives. Do NOT take any action on any "<--- ROOTKIT" entries unless advised by a trained Security Analyst


    If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No.

    If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure that the 'Sections' button is ticked and the 'Show All' button is unticked.
    • Click the Scan button and let the program do its work. GMER will produce a log.
    • Once the scan is complete, you may receive another notice about rootkit activity.
    • Click OK.
    • GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.


    DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

    Please post the results from the GMER scan in your reply.


    In your next post/reply, I need to see the following:

    1. The two DDS Logs (DDS and Attach.txt)
    2. The GMER Log

    Use multiple posts if you can't fit everything into one post
    Malware Removal University Master
    Member of ASAP & UNITE

  3. #3
    Member
    Join Date
    Dec 2008
    Posts
    57

    Default

    Thanks for the help, km2357. The logs are below (sorry it took so long to reply but GMER's scan took over an hour).


    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Steve at 17:00:44.65 on Tue 08/10/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.639.441 [GMT -4:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    svchost.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DSentry.exe
    C:\PROGRA~1\AVG\AVG9\avgtray.exe
    C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
    C:\WINDOWS\system32\ctfmon.exe
    svchost.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\runservice.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Documents and Settings\Steve\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.yahoo.com/
    mSearch Bar =
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = <local>
    uInternet Settings,ProxyServer = http=127.0.0.1:6522
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: {fdd3b846-8d59-4ffb-8758-209b6ad74acc} - c:\program files\microsoft money\system\mnyviewer.dll
    TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
    TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    TB: {C7768536-96F8-4001-B1A2-90EE21279187} - No File
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [PopUpStopperFreeEdition] "c:\progra~1\panicw~1\pop-up~2\PSFree.exe"
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [UpdReg] c:\windows\UpdReg.EXE
    mRun: [DVDSentry] c:\windows\system32\DSentry.exe
    mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [DLCJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCJtime.dll,_RunDLLEntry@16
    mPolicies-explorer: <NO NAME> =
    IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\PartyPoker.exe
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} - c:\program files\microsoft money\system\mnyviewer.dll
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: turbotax.com
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB
    DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab
    DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
    DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
    DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} - hxxp://download.mcafee.com/molbin/Shared/MGBrwFld.cab
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} - hxxps://email.health.state.ny.us/go/Notes.health.state.ny.us/iNotes.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
    DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
    DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} - hxxps://support.microsoft.com/OAS/ActiveX/odc.cab
    DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv9dmo.cab
    DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} - hxxps://email.health.state.ny.us/go/notes.health.state.ny.us/iNotes6W.cab
    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www1.snapfish.com/SnapfishActivia.cab
    DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1408.g.akamai.net/7/1408/9955/20031218/akamai.info.apple.com/iTunes4/WW/win/019-0123.20031218.zes4d/iTunesSetup.exe
    DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - hxxp://aolcc.aol.com/computercheckup/qdiagcc.cab
    DPF: {4B48D5DF-9021-45F7-A240-60304302A215} - hxxp://download.microsoft.com/download/b/d/b/bdb4e4ee-63b2-45ff-9d84-33205bf43143/WebCleaner.cab
    DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,77/mcinsctl.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229634899468
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} - hxxp://cs7b.instantservice.com/jars/customerxsigned34.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.5713078704
    DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,18/mcgdmgr.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/CLUE%20Classic/Images/armhelper.ocx
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
    DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - hxxp://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
    DPF: {D9EA64B2-B966-E177-332C-78B69886526D} - hxxp://download.newaol.com/bkpromo/download/PerformerSetup.cab
    DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} - hxxp://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
    DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} - hxxps://email.health.state.ny.us/go/notes.health.state.ny.us/dwa7W.cab
    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} - hxxp://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
    DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://fdl.msn.com/public/chat/msnchat45.cab
    DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: avgrsstarter - avgrsstx.dll
    STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows\system32\ieframe.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\steve\applic~1\mozilla\firefox\profiles\73an031c.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - plugin: c:\documents and settings\steve\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-2 216400]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-2 29584]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-27 243024]
    R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-15 308136]
    R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2003-6-16 2560]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-4 136176]
    S3 CoachVid;CoachVid;c:\windows\system32\drivers\CoachVid.sys [2010-3-14 45344]
    S3 XIRLINK;IBM PC Camera;c:\windows\system32\drivers\C-itNT.sys [2003-5-23 899884]

    =============== Created Last 30 ================

    2010-07-20 16:46:09 0 d-----w- c:\program files\iTunes
    2010-07-20 16:46:09 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2010-07-20 16:37:15 0 d-----w- c:\program files\Bonjour
    2010-07-18 13:32:06 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
    2010-07-15 20:28:00 12536 ----a-w- c:\windows\system32\avgrsstx.dll

    ==================== Find3M ====================

    2010-08-10 20:40:23 5209 --sha-w- c:\windows\system32\mmf.sys
    2010-07-15 20:28:04 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2010-07-15 20:26:26 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2010-05-18 20:35:16 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-05-18 20:35:16 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2010-05-18 20:35:16 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2010-05-18 20:35:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2008-05-29 13:59:20 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052920080530\index.dat

    ============= FINISH: 17:02:01.20 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 5/23/2003 6:57:51 PM
    System Uptime: 8/10/2010 4:39:28 PM (1 hours ago)

    Motherboard: Dell Computer Corp. | | 0M0321
    Processor: Intel(R) Pentium(R) 4 CPU 2.53GHz | Microprocessor | 2524/533mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 56 GiB total, 26.359 GiB free.
    D: is CDROM ()
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP532: 5/13/2010 7:02:05 PM - System Checkpoint
    RP533: 5/14/2010 7:18:53 PM - System Checkpoint
    RP534: 5/15/2010 12:21:51 PM - Software Distribution Service 3.0
    RP535: 5/16/2010 1:19:27 PM - System Checkpoint
    RP536: 5/18/2010 5:26:47 PM - System Checkpoint
    RP537: 5/19/2010 5:31:40 PM - System Checkpoint
    RP538: 5/20/2010 6:06:01 PM - System Checkpoint
    RP539: 5/21/2010 7:05:17 PM - System Checkpoint
    RP540: 5/22/2010 7:28:42 PM - System Checkpoint
    RP541: 5/23/2010 7:47:05 PM - System Checkpoint
    RP542: 5/24/2010 8:13:13 PM - System Checkpoint
    RP543: 5/25/2010 9:15:23 PM - System Checkpoint
    RP544: 5/26/2010 10:10:33 PM - System Checkpoint
    RP545: 5/27/2010 10:29:06 PM - System Checkpoint
    RP546: 5/29/2010 6:21:32 AM - System Checkpoint
    RP547: 5/30/2010 7:18:21 AM - System Checkpoint
    RP548: 5/31/2010 6:48:38 AM - Software Distribution Service 3.0
    RP549: 6/1/2010 3:48:37 PM - System Checkpoint
    RP550: 6/2/2010 10:13:18 PM - Avg Update
    RP551: 6/4/2010 6:28:47 PM - System Checkpoint
    RP552: 6/5/2010 6:41:13 PM - System Checkpoint
    RP553: 6/6/2010 7:54:11 PM - System Checkpoint
    RP554: 6/7/2010 7:56:31 PM - System Checkpoint
    RP555: 6/8/2010 8:04:07 PM - System Checkpoint
    RP556: 6/9/2010 5:12:40 PM - Software Distribution Service 3.0
    RP557: 6/10/2010 6:07:25 PM - System Checkpoint
    RP558: 6/11/2010 6:55:24 PM - System Checkpoint
    RP559: 6/12/2010 8:29:40 PM - System Checkpoint
    RP560: 6/14/2010 4:46:14 PM - System Checkpoint
    RP561: 6/15/2010 5:41:44 PM - System Checkpoint
    RP562: 6/15/2010 9:09:52 PM - Removed LeapFrog Connect
    RP563: 6/16/2010 9:24:57 PM - System Checkpoint
    RP564: 6/17/2010 9:37:03 PM - System Checkpoint
    RP565: 6/19/2010 9:00:36 AM - System Checkpoint
    RP566: 6/20/2010 9:03:19 AM - System Checkpoint
    RP567: 6/21/2010 6:45:40 PM - System Checkpoint
    RP568: 6/22/2010 6:54:40 PM - System Checkpoint
    RP569: 6/24/2010 10:31:47 AM - System Checkpoint
    RP570: 6/25/2010 4:21:11 PM - Avg Update
    RP571: 6/25/2010 4:43:33 PM - Software Distribution Service 3.0
    RP572: 6/26/2010 5:39:51 PM - System Checkpoint
    RP573: 6/27/2010 6:33:48 PM - System Checkpoint
    RP574: 6/28/2010 6:44:59 PM - System Checkpoint
    RP575: 6/29/2010 7:43:23 PM - System Checkpoint
    RP576: 6/30/2010 8:38:08 PM - System Checkpoint
    RP577: 7/1/2010 9:04:11 PM - System Checkpoint
    RP578: 7/2/2010 9:54:32 PM - System Checkpoint
    RP579: 7/3/2010 9:58:38 PM - System Checkpoint
    RP580: 7/4/2010 10:51:41 PM - System Checkpoint
    RP581: 7/6/2010 9:51:35 AM - System Checkpoint
    RP582: 7/7/2010 7:52:32 PM - System Checkpoint
    RP583: 7/8/2010 8:49:49 PM - System Checkpoint
    RP584: 7/9/2010 6:10:22 AM - Removed Cisco Network Magic
    RP585: 7/9/2010 6:12:00 AM - Removed Pure Networks Platform
    RP586: 7/10/2010 6:42:00 AM - System Checkpoint
    RP587: 7/11/2010 8:42:41 AM - System Checkpoint
    RP588: 7/12/2010 3:41:43 PM - System Checkpoint
    RP589: 7/13/2010 5:51:26 PM - System Checkpoint
    RP590: 7/14/2010 6:45:41 PM - System Checkpoint
    RP591: 7/15/2010 4:25:31 PM - Avg Update
    RP592: 7/15/2010 4:28:17 PM - Avg Update
    RP593: 7/16/2010 8:19:30 PM - System Checkpoint
    RP594: 7/17/2010 8:57:12 PM - System Checkpoint
    RP595: 7/18/2010 9:32:29 AM - Software Distribution Service 3.0
    RP596: 7/19/2010 12:18:45 PM - System Checkpoint
    RP597: 7/20/2010 12:20:33 PM - Avg Update
    RP598: 7/20/2010 11:01:46 PM - Removed Safari
    RP599: 7/22/2010 5:58:26 PM - System Checkpoint
    RP600: 7/23/2010 6:46:24 PM - System Checkpoint
    RP601: 7/24/2010 7:34:23 PM - System Checkpoint
    RP602: 7/25/2010 8:15:14 PM - System Checkpoint
    RP603: 7/26/2010 8:55:18 PM - System Checkpoint
    RP604: 7/27/2010 9:13:40 PM - System Checkpoint
    RP605: 7/29/2010 1:30:31 PM - System Checkpoint
    RP606: 7/30/2010 5:16:42 PM - System Checkpoint
    RP607: 7/31/2010 6:08:59 PM - System Checkpoint
    RP608: 8/1/2010 6:28:19 PM - System Checkpoint
    RP609: 8/2/2010 6:42:30 PM - System Checkpoint
    RP610: 8/3/2010 6:58:04 PM - System Checkpoint
    RP611: 8/4/2010 7:50:57 PM - System Checkpoint
    RP612: 8/5/2010 8:37:51 PM - System Checkpoint
    RP613: 8/6/2010 9:19:15 PM - System Checkpoint
    RP614: 8/9/2010 5:51:15 PM - System Checkpoint

    ==== Installed Programs ======================

    Adobe AIR
    Adobe Atmosphere Player for Acrobat and Adobe Reader
    Adobe Download Manager 1.2 (Remove Only)
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Photoshop Album 2.0 Starter Edition
    Adobe Reader 9.1
    Adobe Shockwave Player
    AnswerWorks 4.0 Runtime - English
    AOL Coach Version 2.0(Build:20041026.5 en)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AVG Free 9.0
    Bonjour
    Canon Camera Access Library
    Canon Camera Support Core Library
    Canon G.726 WMP-Decoder
    CANON iMAGE GATEWAY Task for ZoomBrowser EX
    Canon Internet Library for ZoomBrowser EX
    Canon MovieEdit Task for ZoomBrowser EX
    Canon RAW Image Task for ZoomBrowser EX
    Canon Utilities CameraWindow
    Canon Utilities CameraWindow DC
    Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
    Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    Canon Utilities EOS Utility
    Canon Utilities MyCamera
    Canon Utilities MyCamera DC
    Canon Utilities PhotoStitch
    Canon Utilities RemoteCapture DC
    Canon Utilities RemoteCapture Task for ZoomBrowser EX
    Canon Utilities ZoomBrowser EX
    Canon ZoomBrowser EX Memory Card Utility
    Conexant SmartHSFi V92 56K DF PCI Modem
    Data Lifeguard Diagnostic for Windows
    Dell Digital Jukebox Driver
    Dell Photo AIO Printer 964
    Dell Picture Studio - Dell Image Expert
    Dell Solution Center
    Dell Support
    Digital Line Detect
    Disney Flix 3.0
    DVDSentry
    ERUNT 1.1j
    Google Earth Plug-in
    Google Update Helper
    GradeQuick
    Help and Support Customization
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HyperLoad
    IE Host
    Intel(R) PRO Ethernet Adapter and Software
    Intel(R) PROSet II
    iPod for Windows 2006-03-23
    iTunes
    Java(TM) 6 Update 15
    Macromedia Flash Player
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework (English)
    Microsoft .NET Framework (English) v1.0.3705
    Microsoft .NET Framework 1.0 Hotfix (KB928367)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Data Access Components KB870669
    Microsoft Interactive Training
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Money 2002
    Microsoft Money 2002 System Pack
    Microsoft National Language Support Downlevel APIs
    Microsoft Office XP Media Content
    Microsoft Office XP Small Business
    Microsoft Silverlight
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Windows Media Video 9 VCM
    Microsoft XML Parser
    Modem Helper
    Mozilla Firefox (3.0.5)
    MSN Music Assistant
    NetWaiting
    NVIDIA Display Driver
    NVIDIA Windows 2000/XP Display Drivers
    Paint Shop Pro 7
    Pop-Up Stopper Free Edition
    PowerDVD
    PrimoPDF
    PrimoPDF Redistribution Package
    Qualxserve Service Agreement
    QuickTime
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Shockwave
    Skype™ 4.2
    Sound Blaster Live!
    TurboTax 2009
    TurboTax 2009 WinPerFedFormset
    TurboTax 2009 WinPerReleaseEngine
    TurboTax 2009 WinPerTaxSupport
    TurboTax 2009 wnyiper
    TurboTax 2009 wrapper
    Unity Web Player
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB969497)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Viewpoint Media Player
    WebEx Support Manager for Internet Explorer
    WebFldrs XP
    WexTech AnswerWorks
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage v1.3.0254.0
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format Runtime
    Windows Media Player 10
    Windows XP Service Pack 3
    WinPatrol

    ==== Event Viewer Messages From Past Week ========

    8/8/2010 11:53:33 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    8/8/2010 11:52:29 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    8/6/2010 4:09:25 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    8/6/2010 4:09:18 PM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).
    8/4/2010 4:59:58 PM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
    8/4/2010 4:59:55 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
    8/4/2010 4:50:47 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 0007E9893EEE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

    ==== End Of File ===========================



    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-08-10 18:47:52
    Windows 5.1.2600 Service Pack 3
    Running: gmer.exe; Driver: C:\DOCUME~1\Steve\LOCALS~1\Temp\fwtiipoc.sys


    ---- Kernel code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF7C96340, 0x121A5F, 0xF8000020]
    .text C:\WINDOWS\System32\nv4_disp.dll section is writeable [0xBF012380, 0x25BA81, 0xF8000020]

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----

  4. #4
    Emeritus
    Join Date
    Aug 2007
    Posts
    1,875

    Default

    Step # 1: Download and Run ComboFix

    We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    *Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    When finished, it shall produce a log for you. Please post C:\ComboFix.txt in your next reply.
    Malware Removal University Master
    Member of ASAP & UNITE

  5. #5
    Member
    Join Date
    Dec 2008
    Posts
    57

    Default

    ComboFix 10-08-10.03 - Steve 08/10/2010 20:18:48.2.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.639.305 [GMT -4:00]
    Running from: c:\documents and settings\Steve\Desktop\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\Steve\LOCALS~1\Temp\svchost.exe
    c:\documents and settings\All Users\invokesi.exe
    c:\documents and settings\Steve\Local Settings\Application Data\bfyupraig
    c:\documents and settings\Steve\Local Settings\Application Data\bfyupraig\apnwkyytssd.exe
    c:\documents and settings\Steve\Local Settings\Application Data\dhidxiqjs
    c:\documents and settings\Steve\Local Settings\Application Data\dhidxiqjs\flosvhstssd.exe
    c:\windows\desktop
    c:\windows\desktop\BARBIE.LNK
    c:\windows\Downloaded Program Files\Install.dll
    c:\windows\jestertb.dll
    c:\windows\system32\Data

    .
    ((((((((((((((((((((((((( Files Created from 2010-07-11 to 2010-08-11 )))))))))))))))))))))))))))))))
    .

    2010-08-04 21:17 . 2010-08-04 21:17 -------- d-----w- c:\program files\ERUNT
    2010-07-20 16:46 . 2010-07-20 16:47 -------- d-----w- c:\program files\iTunes
    2010-07-20 16:46 . 2010-07-20 16:47 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2010-07-20 16:41 . 2010-07-20 16:42 -------- d-----w- c:\program files\QuickTime
    2010-07-20 16:37 . 2010-07-20 16:37 -------- d-----w- c:\program files\Bonjour
    2010-07-20 16:35 . 2010-07-20 16:35 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe
    2010-07-20 16:21 . 2010-07-20 16:21 1615200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
    2010-07-20 16:21 . 2010-07-20 16:21 4368224 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
    2010-07-20 16:21 . 2010-07-20 16:21 1373536 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
    2010-07-20 16:21 . 2010-07-20 16:21 1107296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
    2010-07-18 13:32 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
    2010-07-15 20:28 . 2010-07-15 20:28 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
    2010-07-15 20:28 . 2010-07-15 20:28 216200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
    2010-07-15 20:28 . 2010-07-15 20:28 12536 ----a-w- c:\windows\system32\avgrsstx.dll
    2010-07-15 20:25 . 2010-07-15 20:25 1038688 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
    2010-07-15 20:25 . 2010-07-15 20:25 813336 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
    2010-07-15 20:25 . 2010-07-15 20:25 624920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
    2010-07-15 20:25 . 2010-07-15 20:25 1690464 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-08-10 20:40 . 2003-06-17 00:09 5209 --sha-w- c:\windows\system32\mmf.sys
    2010-08-10 00:38 . 2008-12-17 02:04 -------- d-----w- c:\documents and settings\Steve\Application Data\ZoomBrowser EX
    2010-08-10 00:37 . 2008-12-17 02:03 -------- d-----w- c:\documents and settings\Steve\Application Data\CameraWindowDC
    2010-07-29 17:03 . 2006-05-21 20:27 -------- d-----w- c:\program files\Dl_cats
    2010-07-21 03:00 . 2004-03-14 14:57 -------- d-----w- c:\documents and settings\Steve\Application Data\Apple Computer
    2010-07-20 16:46 . 2005-08-25 19:58 -------- d-----w- c:\program files\iPod
    2010-07-20 16:46 . 2008-02-02 20:20 -------- d-----w- c:\program files\Common Files\Apple
    2010-07-15 20:28 . 2010-02-27 10:47 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2010-07-15 20:26 . 2009-02-02 22:36 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2010-07-09 17:00 . 2003-05-23 22:59 106424 ----a-w- c:\documents and settings\Steve\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-07-09 10:10 . 2004-06-05 11:32 -------- d-----w- c:\program files\Pure Networks
    2010-07-08 19:53 . 2010-07-08 19:53 -------- d-----w- c:\program files\Linksys
    2010-07-08 19:50 . 2010-07-08 19:50 -------- d-----w- c:\program files\WebEx
    2010-07-08 19:50 . 2010-07-08 19:50 8673792 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi
    2010-06-16 01:11 . 2008-12-21 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Leapfrog
    2010-06-16 01:11 . 2008-12-21 22:51 -------- d-----w- c:\program files\LeapFrog
    2010-06-14 14:31 . 2002-08-29 10:00 744448 ----a-w- c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
    2010-06-03 02:12 . 2009-02-02 22:36 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2010-05-18 20:35 . 2010-05-18 20:35 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-05-18 20:35 . 2010-05-18 20:35 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2010-05-18 20:35 . 2010-05-18 20:35 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2010-05-18 20:35 . 2010-05-18 20:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~2\PSFree.exe" [2003-10-29 524288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
    "DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2004-05-28 323584]
    "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
    "DLCJCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCJtime.dll" [2005-08-15 73728]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2010-07-15 20:28 12536 ----a-w- c:\windows\SYSTEM32\avgrsstx.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
    backup=c:\windows\pss\America Online 8.0 Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
    backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Steve^Start Menu^Programs^Startup^Warner Bros.lnk]
    path=c:\documents and settings\Steve\Start Menu\Programs\Startup\Warner Bros.lnk
    backup=c:\windows\pss\Warner Bros.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Slvfj]
    c:\windows\system32\d?dplay.exe [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xheluhe]
    c:\windows\system32\w?auboot.exe [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2009-02-27 21:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent]
    2002-04-03 06:01 135264 ----a-w- c:\program files\Creative\SBLive\Diagnostics\diagent.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcjmon.exe]
    2005-09-30 13:51 430080 ----a-w- c:\program files\Dell Photo AIO Printer 964\dlcjmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-07-16 11:41 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp10.0]
    2001-07-25 15:00 241714 ----a-w- c:\program files\Microsoft Money\System\Activation.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [2/2/2009 6:36 PM 216400]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [2/27/2010 6:47 AM 243024]
    R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 4:27 PM 308136]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/4/2010 5:17 PM 136176]
    S2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [6/16/2003 8:09 PM 2560]
    S3 CoachVid;CoachVid;c:\windows\SYSTEM32\DRIVERS\CoachVid.sys [3/14/2010 11:09 AM 45344]
    S3 XIRLINK;IBM PC Camera;c:\windows\SYSTEM32\DRIVERS\C-itNT.sys [5/23/2003 9:06 PM 899884]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - FWTIIPOC
    *Deregistered* - fwtiipoc
    .
    Contents of the 'Scheduled Tasks' folder

    2010-08-03 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

    2010-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-04 21:16]

    2010-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-04 21:16]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    mSearch Bar =
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = <local>
    uInternet Settings,ProxyServer = http=127.0.0.1:6522
    IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: turbotax.com
    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: {D9EA64B2-B966-E177-332C-78B69886526D} - hxxp://download.newaol.com/bkpromo/download/PerformerSetup.cab
    FF - ProfilePath - c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\73an031c.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
    FF - plugin: c:\documents and settings\Steve\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .
    - - - - ORPHANS REMOVED - - - -

    MSConfigStartUp-AOLDialer - c:\program files\Common Files\AOL\ACS\AOLDial.exe
    MSConfigStartUp-HostManager - c:\program files\Common Files\AOL\1100971500\ee\AOLSoftware.exe
    MSConfigStartUp-mmtask - c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    MSConfigStartUp-mnrtbfur - c:\documents and settings\Steve\Local Settings\Application Data\dhidxiqjs\flosvhstssd.exe
    MSConfigStartUp-Monitor - c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe
    MSConfigStartUp-rerxmykm - c:\documents and settings\Steve\Local Settings\Application Data\bfyupraig\apnwkyytssd.exe
    MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
    MSConfigStartUp-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
    AddRemove-ff8d4479581e - c:\windows\system32\CDMODEM1.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-08-10 20:26
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????
    DLCJCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCJtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
    "1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,c9,e0,20,43,a1,23,f2,
    e3
    "2"=hex:f1,df,16,de,80,08,0e,2a,78,a4,28,cb,d2,56,ff,58,a6,09,d8,fb,43,e9,d5,
    e7,16,83,71,61,5d,be,d8,25
    "3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,2b,92,4b,0d,22,14,9d,
    cb,e3,f8,73,90,7d,a4,36,0d,7e,db,3a,16,4c,1a,45,81,b1,a5,77,31,f5,50,d6,e8

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\B144CCE307E78EB6EE53CA2196E4D0A2]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,36,d7,56,53,fe,9f,3d,f9
    "2"=hex:c8,8f,7e,e1,28,bb,79,e1
    "3"=hex:4d,f8,1f,c8,95,ae,73,01,33,42,4d,73,3a,61,7d,eb,13,0b,9e,9c,5a,c5,a9,
    35,78,f1,46,b2,69,67,81,c4,e9,bc,bf,8e,41,c9,43,24,e0,08,41,af,71,19,39,da,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
    51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
    "7"=hex:6b,96,68,24,0f,2f,9e,94,e8,ce,54,f3,3b,80,63,3a,1b,c3,e7,ed,44,3a,1d,
    97,9f,f9,03,77,68,81,1b,0c,47,9b,87,b8,63,74,7d,34
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,73,7e,45,c6,9f,9e,10,
    63,a0,2f,06,c2,a3,e9,62,70,90,4c,ec,d6,92,e1,28,ba,e5,5d,0d,25,ef,fb,b7,21,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:70,56,26,33,e3,20,f8,ab
    "10"=hex:ef,01,3f,48,b8,d3,ab,86
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:81,20,8f,ab,28,6a,52,9c
    "13"=hex:81,20,8f,ab,28,6a,52,9c
    "14"=hex:81,20,8f,ab,28,6a,52,9c
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:81,20,8f,ab,28,6a,52,9c
    "22"=hex:81,20,8f,ab,28,6a,52,9c

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,c2,97,86,6a,a5,82,f8,
    d5,42,54,3b,7e,24,3e,19,f8
    "2"=hex:f1,df,16,de,80,08,0e,2a,d1,38,b5,6f,94,ca,dc,d2,b3,e8,d2,40,6c,6f,61,
    5e,d2,5e,7f,21,14,b5,b2,29
    "3"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,c2,97,86,6a,a5,82,f8,
    d5,f2,55,76,c8,bc,53,92,25,3f,d1,b6,bc,00,35,73,43,96,90,79,f6,5b,97,35,47,\

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\37539B6D352ECF5C006214859EC1AF0C]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,c8,c9,f6,99,f8,a7,b9,da
    "2"=hex:76,4e,1c,cc,2e,81,b8,f3
    "3"=hex:b0,6a,ce,52,90,e6,2e,1f,b9,8f,de,36,d0,fd,27,29,4e,c4,e1,84,65,85,b8,
    b9,2c,aa,11,98,61,63,04,3e,e0,a0,3b,14,b4,ab,a5,04,c8,61,dd,0b,13,c1,24,cb,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
    51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
    "7"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,f5,de,1e,04,6d,6b,1c,69
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,6b,8d,dd,0b,84,72,f6,
    f2,3d,a6,3c,a0,07,7d,db,f3,88,a8,6c,3f,5c,60,94,94,89,77,0c,65,96,1c,ff,8e,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:70,56,26,33,e3,20,f8,ab
    "10"=hex:70,78,9a,0e,0e,b6,0b,80
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:81,20,8f,ab,28,6a,52,9c
    "13"=hex:81,20,8f,ab,28,6a,52,9c
    "14"=hex:81,20,8f,ab,28,6a,52,9c
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:81,20,8f,ab,28,6a,52,9c
    "22"=hex:81,20,8f,ab,28,6a,52,9c

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\A28FC91DA48F2E633FEBC5F75796F7EE]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,50,94,16,01,b2,17,1a,42
    "2"=hex:36,a1,83,10,ca,9e,e0,63
    "3"=hex:36,c8,1a,52,cb,a0,bc,5d,96,45,5c,a9,e3,0b,38,30,85,91,a5,5b,8d,5d,1b,
    f9,f2,0e,26,2e,d8,2f,01,60,e2,aa,18,dd,37,1b,d4,1a,6d,7f,66,f8,77,cc,a3,b3,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,7a,a8,00,2b,5a,66,a9,58,4e,b4,3d,8d,91,76,bb,96,13,03,45,50,83,49,1c,85,\
    "7"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,fc,f4,86,ed,7d,07,89,29,2f,7f,fa,55,aa,50,20,7e,7c,e5,f7,a8,05,d7,35,13,\
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,6b,8d,dd,0b,84,72,f6,
    f2,3d,a6,3c,a0,07,7d,db,f3,88,a8,6c,3f,5c,60,94,94,89,77,0c,65,96,1c,ff,8e,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:4b,72,8f,bc,6c,3f,e4,15
    "10"=hex:81,20,8f,ab,28,6a,52,9c
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:4c,84,f4,9a,e3,cc,1a,df,40,16,e1,0f,95,53,f2,3e,d5,8d,46,19,a6,05,c9,
    c0,dc,f1,8b,bb,28,df,19,0a,59,8f,02,cc,bc,9e,0f,27,da,86,8b,ac,d1,e2,b0,98,\
    "13"=hex:89,21,6e,35,d8,f6,cf,5f,18,9f,8f,c1,a2,7a,b2,db,0d,39,56,75,bb,ae,b8,
    8d
    "14"=hex:3b,71,c6,44,4a,52,dd,47
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:06,d9,1b,04,8b,d4,5e,45,32,52,7c,7b,13,04,a9,cc
    "22"=hex:81,20,8f,ab,28,6a,52,9c
    "15"=hex:2f,1b,d7,bf,71,50,0d,b3,2e,2d,be,8c,93,70,e9,f2,12,97,77,40,3b,f8,ea,
    12,4f,d4,65,20,e9,31,b5,24,94,2b,97,b5,bb,db,de,b9,d4,1e,16,4b,1a,f4,d1,c0,\

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\D580A8CFDA60E9362F91B6F863D46379]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,50,94,16,01,b2,17,1a,42
    "2"=hex:56,f3,50,11,98,55,25,42
    "3"=hex:50,bb,c2,90,16,ea,54,f2,89,ca,01,b1,47,e7,59,bc,5f,82,8c,83,5a,87,fb,
    bd,53,87,ab,58,3c,e3,10,15,2c,12,29,36,69,a2,21,45,ea,4a,58,c0,f4,97,17,0d,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,e0,d5,40,60,64,c9,b0,05,bd,46,f0,d0,93,ce,14,c4,82,49,ea,8d,8c,92,89,1e,\
    "7"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,04,de,29,1c,d1,59,b3,b5,1c,3a,e8,07,ed,d8,08,6e,a7,52,c4,be,fd,58,1e,61,\
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,6b,8d,dd,0b,84,72,f6,
    f2,3d,a6,3c,a0,07,7d,db,f3,88,a8,6c,3f,5c,60,94,94,89,77,0c,65,96,1c,ff,8e,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:4b,72,8f,bc,6c,3f,e4,15
    "10"=hex:81,20,8f,ab,28,6a,52,9c
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:4d,54,d7,63,b6,3c,42,8d,da,47,70,cd,a4,7b,44,85,34,0f,06,14,5a,c7,8d,
    a9,34,17,6b,c9,41,4b,0c,ac,ff,42,69,98,2f,fd,76,14,98,01,70,52,07,2a,fd,ca,\
    "13"=hex:ff,8d,95,64,41,73,9c,01,66,5e,3e,bf,b1,7d,fd,92,e6,a1,c8,ba,6d,98,9b,
    85
    "14"=hex:6b,51,bd,2b,8f,5b,c4,81
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:12,ce,a2,66,5b,58,91,f7,bb,40,f5,a9,d0,bc,d2,22
    "22"=hex:81,20,8f,ab,28,6a,52,9c
    "15"=hex:80,ea,10,34,d2,a0,63,12,68,8b,46,64,90,11,43,e8,af,48,31,39,97,56,25,
    39,bc,ac,7f,59,aa,c0,2e,94,ed,be,d3,70,5e,c0,10,20,e4,11,41,61,40,38,f7,21,\

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\F44BF0AB240E9E780096D1A73A6118C0]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,50,94,16,01,b2,17,1a,42
    "2"=hex:0a,01,74,b1,ac,0e,66,b3
    "3"=hex:bd,54,15,a4,81,39,34,20,b6,52,78,5f,53,f1,37,dd,9e,85,f4,e7,81,5e,12,
    f8,05,2e,d5,27,8e,d7,e8,69,b7,47,d8,5e,d8,5a,4a,2b,76,3a,e1,fc,58,05,5e,5c,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,ea,dc,2e,9d,47,fd,9a,c3,76,2d,4b,d6,9a,24,e3,1a,2f,29,5d,51,8a,46,f1,00,\
    "7"=hex:85,bb,69,ad,52,49,47,61,18,6f,83,12,84,bf,a1,8f,a6,89,53,89,8a,e7,03,
    61,fb,94,40,8f,53,69,7f,f8,30,91,51,0f,b9,02,8d,ff,b7,76,ef,d9,a5,0e,6d,f9,\
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,ee,d2,fa,7b,a3,47,0c,
    f0,56,6c,46,7d,96,cf,aa,69,23,01,cb,bc,1d,e0,3e,00,b9,3c,b9,80,24,5b,fa,f5,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:4b,72,8f,bc,6c,3f,e4,15
    "10"=hex:81,20,8f,ab,28,6a,52,9c
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:02,a0,5d,27,ec,ac,ed,fa,31,63,e0,87,e4,f2,c5,f6,ca,d3,cc,7f,9a,cc,99,
    ac,a2,e0,b6,ff,7a,da,da,d9,ab,cf,33,7c,2a,3c,7d,88,5c,2e,70,da,d8,a8,09,92,\
    "13"=hex:2c,cd,49,cd,14,6a,75,4b,0e,a7,07,7a,27,9a,d3,85,b6,98,b2,bb,8d,33,e2,
    08
    "14"=hex:70,91,ca,53,ff,e9,05,24
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:1f,9f,ef,89,af,05,b8,90,c0,9d,ce,ec,5f,9e,47,5f
    "22"=hex:81,20,8f,ab,28,6a,52,9c
    "15"=hex:50,c9,2a,e1,e7,ef,cf,4c,e3,bb,60,22,f5,00,d7,fd,29,91,ef,ff,94,4e,a9,
    1e,e4,1d,0d,9f,f6,70,6a,54,0d,8f,10,0a,0e,38,3c,d5,b2,bf,e3,86,6f,18,31,99,\
    .
    Completion time: 2010-08-10 20:34:01
    ComboFix-quarantined-files.txt 2010-08-11 00:33
    ComboFix2.txt 2008-12-31 21:44

    Pre-Run: 28,187,881,472 bytes free
    Post-Run: 28,315,959,296 bytes free

    - - End Of File - - D9608DE2EAFE09EEE0A5824555C58F5A

  6. #6
    Emeritus
    Join Date
    Aug 2007
    Posts
    1,875

    Default

    Step # 1: Run CFScript

    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      Code:
      KILLALL::
      
      DDS::
      
      uInternet Settings,ProxyServer = http=127.0.0.1:6522
      uInternet Settings,ProxyOverride = <local>
      TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
      TB: {C7768536-96F8-4001-B1A2-90EE21279187} - No File
      EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
      
      Registry::
      
      [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Slvfj]
      [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xheluhe]
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.







      Note: This CFScript is for use on ssmarsh's computer only! Do not use it on your computer.

    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.


    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


    Step # 2: Restore Proxy Settings

    In Internet Explorer: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" and check to "Automatically detect settings".


    In your next post/reply, I need to see the following:

    1. The ComboFix Log that appears after Step 1 has been completed.
    2. A fresh DDS Log taken after Step 2 has been completed.
    Last edited by km2357; 2010-08-11 at 20:50.
    Malware Removal University Master
    Member of ASAP & UNITE

  7. #7
    Member
    Join Date
    Dec 2008
    Posts
    57

    Default

    ComboFix 10-08-10.03 - Steve 08/11/2010 14:48:52.3.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.639.384 [GMT -4:00]
    Running from: c:\documents and settings\Steve\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Steve\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((( Files Created from 2010-07-11 to 2010-08-11 )))))))))))))))))))))))))))))))
    .

    2010-08-04 21:17 . 2010-08-04 21:17 -------- d-----w- c:\program files\ERUNT
    2010-07-20 16:46 . 2010-07-20 16:47 -------- d-----w- c:\program files\iTunes
    2010-07-20 16:46 . 2010-07-20 16:47 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2010-07-20 16:41 . 2010-07-20 16:42 -------- d-----w- c:\program files\QuickTime
    2010-07-20 16:37 . 2010-07-20 16:37 -------- d-----w- c:\program files\Bonjour
    2010-07-18 13:32 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
    2010-07-15 20:28 . 2010-07-15 20:28 12536 ----a-w- c:\windows\system32\avgrsstx.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-08-11 18:59 . 2003-06-17 00:09 5209 --sha-w- c:\windows\system32\mmf.sys
    2010-08-10 00:38 . 2008-12-17 02:04 -------- d-----w- c:\documents and settings\Steve\Application Data\ZoomBrowser EX
    2010-08-10 00:37 . 2008-12-17 02:03 -------- d-----w- c:\documents and settings\Steve\Application Data\CameraWindowDC
    2010-07-29 17:03 . 2006-05-21 20:27 -------- d-----w- c:\program files\Dl_cats
    2010-07-21 03:00 . 2004-03-14 14:57 -------- d-----w- c:\documents and settings\Steve\Application Data\Apple Computer
    2010-07-20 16:46 . 2005-08-25 19:58 -------- d-----w- c:\program files\iPod
    2010-07-20 16:46 . 2008-02-02 20:20 -------- d-----w- c:\program files\Common Files\Apple
    2010-07-20 16:35 . 2010-07-20 16:35 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe
    2010-07-20 16:21 . 2010-07-20 16:21 1615200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
    2010-07-20 16:21 . 2010-07-20 16:21 4368224 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
    2010-07-20 16:21 . 2010-07-20 16:21 1373536 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
    2010-07-20 16:21 . 2010-07-20 16:21 1107296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
    2010-07-15 20:28 . 2010-07-15 20:28 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
    2010-07-15 20:28 . 2010-07-15 20:28 216200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
    2010-07-15 20:28 . 2010-02-27 10:47 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2010-07-15 20:26 . 2009-02-02 22:36 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2010-07-15 20:25 . 2010-07-15 20:25 1038688 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
    2010-07-15 20:25 . 2010-07-15 20:25 813336 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
    2010-07-15 20:25 . 2010-07-15 20:25 624920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
    2010-07-15 20:25 . 2010-07-15 20:25 1690464 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
    2010-07-09 17:00 . 2003-05-23 22:59 106424 ----a-w- c:\documents and settings\Steve\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-07-09 10:10 . 2004-06-05 11:32 -------- d-----w- c:\program files\Pure Networks
    2010-07-08 19:53 . 2010-07-08 19:53 -------- d-----w- c:\program files\Linksys
    2010-07-08 19:50 . 2010-07-08 19:50 -------- d-----w- c:\program files\WebEx
    2010-07-08 19:50 . 2010-07-08 19:50 8673792 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi
    2010-06-16 01:11 . 2008-12-21 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Leapfrog
    2010-06-16 01:11 . 2008-12-21 22:51 -------- d-----w- c:\program files\LeapFrog
    2010-06-03 02:12 . 2009-02-02 22:36 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2010-05-18 20:35 . 2010-05-18 20:35 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-05-18 20:35 . 2010-05-18 20:35 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2010-05-18 20:35 . 2010-05-18 20:35 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2010-05-18 20:35 . 2010-05-18 20:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~2\PSFree.exe" [2003-10-29 524288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
    "DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2004-05-28 323584]
    "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
    "DLCJCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCJtime.dll" [2005-08-15 73728]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2010-07-15 20:28 12536 ----a-w- c:\windows\SYSTEM32\avgrsstx.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
    backup=c:\windows\pss\America Online 8.0 Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
    backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Steve^Start Menu^Programs^Startup^Warner Bros.lnk]
    path=c:\documents and settings\Steve\Start Menu\Programs\Startup\Warner Bros.lnk
    backup=c:\windows\pss\Warner Bros.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2009-02-27 21:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent]
    2002-04-03 06:01 135264 ----a-w- c:\program files\Creative\SBLive\Diagnostics\diagent.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcjmon.exe]
    2005-09-30 13:51 430080 ----a-w- c:\program files\Dell Photo AIO Printer 964\dlcjmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-07-16 11:41 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp10.0]
    2001-07-25 15:00 241714 ----a-w- c:\program files\Microsoft Money\System\Activation.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [2/2/2009 6:36 PM 216400]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [2/27/2010 6:47 AM 243024]
    R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 4:27 PM 308136]
    S3 CoachVid;CoachVid;c:\windows\SYSTEM32\DRIVERS\CoachVid.sys [3/14/2010 11:09 AM 45344]
    S3 XIRLINK;IBM PC Camera;c:\windows\SYSTEM32\DRIVERS\C-itNT.sys [5/23/2003 9:06 PM 899884]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-08-03 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

    2010-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-04 21:16]

    2010-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-04 21:16]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    mSearch Bar =
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = <local>
    IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: turbotax.com
    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: {D9EA64B2-B966-E177-332C-78B69886526D} - hxxp://download.newaol.com/bkpromo/download/PerformerSetup.cab
    FF - ProfilePath - c:\documents and settings\Steve\Application Data\Mozilla\Firefox\Profiles\73an031c.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
    FF - plugin: c:\documents and settings\Steve\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-08-11 15:01
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???????X:??????x??? ???X??? ??????? ???P???? ?w? ?w)??p????????(???u????U?w????????????0??????w, ?w?M?wW??w???w)??p????????x'@?????????X????????"@?e?????
    DLCJCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCJtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
    "1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,c9,e0,20,43,a1,23,f2,
    e3
    "2"=hex:f1,df,16,de,80,08,0e,2a,78,a4,28,cb,d2,56,ff,58,a6,09,d8,fb,43,e9,d5,
    e7,16,83,71,61,5d,be,d8,25
    "3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,2b,92,4b,0d,22,14,9d,
    cb,e3,f8,73,90,7d,a4,36,0d,7e,db,3a,16,4c,1a,45,81,b1,a5,77,31,f5,50,d6,e8

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\B144CCE307E78EB6EE53CA2196E4D0A2]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,36,d7,56,53,fe,9f,3d,f9
    "2"=hex:c8,8f,7e,e1,28,bb,79,e1
    "3"=hex:4d,f8,1f,c8,95,ae,73,01,33,42,4d,73,3a,61,7d,eb,13,0b,9e,9c,5a,c5,a9,
    35,78,f1,46,b2,69,67,81,c4,e9,bc,bf,8e,41,c9,43,24,e0,08,41,af,71,19,39,da,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
    51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
    "7"=hex:6b,96,68,24,0f,2f,9e,94,e8,ce,54,f3,3b,80,63,3a,1b,c3,e7,ed,44,3a,1d,
    97,9f,f9,03,77,68,81,1b,0c,47,9b,87,b8,63,74,7d,34
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,73,7e,45,c6,9f,9e,10,
    63,a0,2f,06,c2,a3,e9,62,70,90,4c,ec,d6,92,e1,28,ba,e5,5d,0d,25,ef,fb,b7,21,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:70,56,26,33,e3,20,f8,ab
    "10"=hex:ef,01,3f,48,b8,d3,ab,86
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:81,20,8f,ab,28,6a,52,9c
    "13"=hex:81,20,8f,ab,28,6a,52,9c
    "14"=hex:81,20,8f,ab,28,6a,52,9c
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:81,20,8f,ab,28,6a,52,9c
    "22"=hex:81,20,8f,ab,28,6a,52,9c

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,c2,97,86,6a,a5,82,f8,
    d5,42,54,3b,7e,24,3e,19,f8
    "2"=hex:f1,df,16,de,80,08,0e,2a,d1,38,b5,6f,94,ca,dc,d2,b3,e8,d2,40,6c,6f,61,
    5e,d2,5e,7f,21,14,b5,b2,29
    "3"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,c2,97,86,6a,a5,82,f8,
    d5,f2,55,76,c8,bc,53,92,25,3f,d1,b6,bc,00,35,73,43,96,90,79,f6,5b,97,35,47,\

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\37539B6D352ECF5C006214859EC1AF0C]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,c8,c9,f6,99,f8,a7,b9,da
    "2"=hex:76,4e,1c,cc,2e,81,b8,f3
    "3"=hex:b0,6a,ce,52,90,e6,2e,1f,b9,8f,de,36,d0,fd,27,29,4e,c4,e1,84,65,85,b8,
    b9,2c,aa,11,98,61,63,04,3e,e0,a0,3b,14,b4,ab,a5,04,c8,61,dd,0b,13,c1,24,cb,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
    51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
    "7"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,f5,de,1e,04,6d,6b,1c,69
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,6b,8d,dd,0b,84,72,f6,
    f2,3d,a6,3c,a0,07,7d,db,f3,88,a8,6c,3f,5c,60,94,94,89,77,0c,65,96,1c,ff,8e,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:70,56,26,33,e3,20,f8,ab
    "10"=hex:70,78,9a,0e,0e,b6,0b,80
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:81,20,8f,ab,28,6a,52,9c
    "13"=hex:81,20,8f,ab,28,6a,52,9c
    "14"=hex:81,20,8f,ab,28,6a,52,9c
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:81,20,8f,ab,28,6a,52,9c
    "22"=hex:81,20,8f,ab,28,6a,52,9c

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\A28FC91DA48F2E633FEBC5F75796F7EE]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,50,94,16,01,b2,17,1a,42
    "2"=hex:36,a1,83,10,ca,9e,e0,63
    "3"=hex:36,c8,1a,52,cb,a0,bc,5d,96,45,5c,a9,e3,0b,38,30,85,91,a5,5b,8d,5d,1b,
    f9,f2,0e,26,2e,d8,2f,01,60,e2,aa,18,dd,37,1b,d4,1a,6d,7f,66,f8,77,cc,a3,b3,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,7a,a8,00,2b,5a,66,a9,58,4e,b4,3d,8d,91,76,bb,96,13,03,45,50,83,49,1c,85,\
    "7"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,fc,f4,86,ed,7d,07,89,29,2f,7f,fa,55,aa,50,20,7e,7c,e5,f7,a8,05,d7,35,13,\
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,6b,8d,dd,0b,84,72,f6,
    f2,3d,a6,3c,a0,07,7d,db,f3,88,a8,6c,3f,5c,60,94,94,89,77,0c,65,96,1c,ff,8e,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:4b,72,8f,bc,6c,3f,e4,15
    "10"=hex:81,20,8f,ab,28,6a,52,9c
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:4c,84,f4,9a,e3,cc,1a,df,40,16,e1,0f,95,53,f2,3e,d5,8d,46,19,a6,05,c9,
    c0,dc,f1,8b,bb,28,df,19,0a,59,8f,02,cc,bc,9e,0f,27,da,86,8b,ac,d1,e2,b0,98,\
    "13"=hex:89,21,6e,35,d8,f6,cf,5f,18,9f,8f,c1,a2,7a,b2,db,0d,39,56,75,bb,ae,b8,
    8d
    "14"=hex:3b,71,c6,44,4a,52,dd,47
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:06,d9,1b,04,8b,d4,5e,45,32,52,7c,7b,13,04,a9,cc
    "22"=hex:81,20,8f,ab,28,6a,52,9c
    "15"=hex:2f,1b,d7,bf,71,50,0d,b3,2e,2d,be,8c,93,70,e9,f2,12,97,77,40,3b,f8,ea,
    12,4f,d4,65,20,e9,31,b5,24,94,2b,97,b5,bb,db,de,b9,d4,1e,16,4b,1a,f4,d1,c0,\

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\D580A8CFDA60E9362F91B6F863D46379]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,50,94,16,01,b2,17,1a,42
    "2"=hex:56,f3,50,11,98,55,25,42
    "3"=hex:50,bb,c2,90,16,ea,54,f2,89,ca,01,b1,47,e7,59,bc,5f,82,8c,83,5a,87,fb,
    bd,53,87,ab,58,3c,e3,10,15,2c,12,29,36,69,a2,21,45,ea,4a,58,c0,f4,97,17,0d,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,e0,d5,40,60,64,c9,b0,05,bd,46,f0,d0,93,ce,14,c4,82,49,ea,8d,8c,92,89,1e,\
    "7"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,04,de,29,1c,d1,59,b3,b5,1c,3a,e8,07,ed,d8,08,6e,a7,52,c4,be,fd,58,1e,61,\
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,6b,8d,dd,0b,84,72,f6,
    f2,3d,a6,3c,a0,07,7d,db,f3,88,a8,6c,3f,5c,60,94,94,89,77,0c,65,96,1c,ff,8e,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:4b,72,8f,bc,6c,3f,e4,15
    "10"=hex:81,20,8f,ab,28,6a,52,9c
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:4d,54,d7,63,b6,3c,42,8d,da,47,70,cd,a4,7b,44,85,34,0f,06,14,5a,c7,8d,
    a9,34,17,6b,c9,41,4b,0c,ac,ff,42,69,98,2f,fd,76,14,98,01,70,52,07,2a,fd,ca,\
    "13"=hex:ff,8d,95,64,41,73,9c,01,66,5e,3e,bf,b1,7d,fd,92,e6,a1,c8,ba,6d,98,9b,
    85
    "14"=hex:6b,51,bd,2b,8f,5b,c4,81
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:12,ce,a2,66,5b,58,91,f7,bb,40,f5,a9,d0,bc,d2,22
    "22"=hex:81,20,8f,ab,28,6a,52,9c
    "15"=hex:80,ea,10,34,d2,a0,63,12,68,8b,46,64,90,11,43,e8,af,48,31,39,97,56,25,
    39,bc,ac,7f,59,aa,c0,2e,94,ed,be,d3,70,5e,c0,10,20,e4,11,41,61,40,38,f7,21,\

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\F44BF0AB240E9E780096D1A73A6118C0]
    "1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,50,94,16,01,b2,17,1a,42
    "2"=hex:0a,01,74,b1,ac,0e,66,b3
    "3"=hex:bd,54,15,a4,81,39,34,20,b6,52,78,5f,53,f1,37,dd,9e,85,f4,e7,81,5e,12,
    f8,05,2e,d5,27,8e,d7,e8,69,b7,47,d8,5e,d8,5a,4a,2b,76,3a,e1,fc,58,05,5e,5c,\
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
    b0,ea,dc,2e,9d,47,fd,9a,c3,76,2d,4b,d6,9a,24,e3,1a,2f,29,5d,51,8a,46,f1,00,\
    "7"=hex:85,bb,69,ad,52,49,47,61,18,6f,83,12,84,bf,a1,8f,a6,89,53,89,8a,e7,03,
    61,fb,94,40,8f,53,69,7f,f8,30,91,51,0f,b9,02,8d,ff,b7,76,ef,d9,a5,0e,6d,f9,\
    "8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,ee,d2,fa,7b,a3,47,0c,
    f0,56,6c,46,7d,96,cf,aa,69,23,01,cb,bc,1d,e0,3e,00,b9,3c,b9,80,24,5b,fa,f5,\
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:4b,72,8f,bc,6c,3f,e4,15
    "10"=hex:81,20,8f,ab,28,6a,52,9c
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:02,a0,5d,27,ec,ac,ed,fa,31,63,e0,87,e4,f2,c5,f6,ca,d3,cc,7f,9a,cc,99,
    ac,a2,e0,b6,ff,7a,da,da,d9,ab,cf,33,7c,2a,3c,7d,88,5c,2e,70,da,d8,a8,09,92,\
    "13"=hex:2c,cd,49,cd,14,6a,75,4b,0e,a7,07,7a,27,9a,d3,85,b6,98,b2,bb,8d,33,e2,
    08
    "14"=hex:70,91,ca,53,ff,e9,05,24
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:1f,9f,ef,89,af,05,b8,90,c0,9d,ce,ec,5f,9e,47,5f
    "22"=hex:81,20,8f,ab,28,6a,52,9c
    "15"=hex:50,c9,2a,e1,e7,ef,cf,4c,e3,bb,60,22,f5,00,d7,fd,29,91,ef,ff,94,4e,a9,
    1e,e4,1d,0d,9f,f6,70,6a,54,0d,8f,10,0a,0e,38,3c,d5,b2,bf,e3,86,6f,18,31,99,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(2852)
    c:\windows\system32\WININET.dll
    c:\progra~1\PANICW~1\POP-UP~2\XAHook.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\AVG\AVG9\avgchsvx.exe
    c:\program files\AVG\AVG9\avgrsx.exe
    c:\program files\AVG\AVG9\avgcsrvx.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\System32\CTsvcCDA.exe
    c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\runservice.exe
    c:\windows\System32\nvsvc32.exe
    c:\windows\System32\wdfmgr.exe
    c:\program files\AVG\AVG9\avgnsx.exe
    c:\windows\System32\MsPMSPSv.exe
    c:\program files\Canon\CAL\CALMAIN.exe
    c:\program files\Dell\Support\Alert\bin\NotifyAlert.exe
    .
    **************************************************************************
    .
    Completion time: 2010-08-11 15:14:10 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-08-11 19:14
    ComboFix2.txt 2010-08-11 00:34
    ComboFix3.txt 2008-12-31 21:44

    Pre-Run: 28,341,325,824 bytes free
    Post-Run: 28,344,610,816 bytes free

    - - End Of File - - EDD6DAABE913AD7F789DDD882902487B


    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Steve at 15:19:31.98 on Wed 08/11/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.639.245 [GMT -4:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    svchost.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\runservice.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\System32\DSentry.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\PROGRA~1\AVG\AVG9\avgtray.exe
    C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
    C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Steve\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.yahoo.com/
    mSearch Bar =
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = <local>
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: {fdd3b846-8d59-4ffb-8758-209b6ad74acc} - c:\program files\microsoft money\system\mnyviewer.dll
    TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    uRun: [PopUpStopperFreeEdition] "c:\progra~1\panicw~1\pop-up~2\PSFree.exe"
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [UpdReg] c:\windows\UpdReg.EXE
    mRun: [DVDSentry] c:\windows\system32\DSentry.exe
    mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [DLCJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCJtime.dll,_RunDLLEntry@16
    mPolicies-explorer: <NO NAME> =
    IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\PartyPoker.exe
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} - c:\program files\microsoft money\system\mnyviewer.dll
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: turbotax.com
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB
    DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab
    DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
    DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
    DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} - hxxp://download.mcafee.com/molbin/Shared/MGBrwFld.cab
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} - hxxps://email.health.state.ny.us/go/Notes.health.state.ny.us/iNotes.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
    DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
    DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} - hxxps://support.microsoft.com/OAS/ActiveX/odc.cab
    DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv9dmo.cab
    DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} - hxxps://email.health.state.ny.us/go/notes.health.state.ny.us/iNotes6W.cab
    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www1.snapfish.com/SnapfishActivia.cab
    DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1408.g.akamai.net/7/1408/9955/20031218/akamai.info.apple.com/iTunes4/WW/win/019-0123.20031218.zes4d/iTunesSetup.exe
    DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - hxxp://aolcc.aol.com/computercheckup/qdiagcc.cab
    DPF: {4B48D5DF-9021-45F7-A240-60304302A215} - hxxp://download.microsoft.com/download/b/d/b/bdb4e4ee-63b2-45ff-9d84-33205bf43143/WebCleaner.cab
    DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,77/mcinsctl.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229634899468
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} - hxxp://cs7b.instantservice.com/jars/customerxsigned34.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.5713078704
    DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,18/mcgdmgr.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/CLUE%20Classic/Images/armhelper.ocx
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
    DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - hxxp://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
    DPF: {D9EA64B2-B966-E177-332C-78B69886526D} - hxxp://download.newaol.com/bkpromo/download/PerformerSetup.cab
    DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} - hxxp://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
    DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} - hxxps://email.health.state.ny.us/go/notes.health.state.ny.us/dwa7W.cab
    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} - hxxp://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
    DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://fdl.msn.com/public/chat/msnchat45.cab
    DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: avgrsstarter - avgrsstx.dll
    STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows\system32\ieframe.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\steve\applic~1\mozilla\firefox\profiles\73an031c.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - plugin: c:\documents and settings\steve\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-2 216400]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-2 29584]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-27 243024]
    R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-15 308136]
    R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2003-6-16 2560]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-4 136176]
    S3 CoachVid;CoachVid;c:\windows\system32\drivers\CoachVid.sys [2010-3-14 45344]
    S3 XIRLINK;IBM PC Camera;c:\windows\system32\drivers\C-itNT.sys [2003-5-23 899884]

    =============== Created Last 30 ================

    2010-08-11 00:15:17 98816 ----a-w- c:\windows\sed.exe
    2010-08-11 00:15:17 77312 ----a-w- c:\windows\MBR.exe
    2010-08-11 00:15:17 256512 ----a-w- c:\windows\PEV.exe
    2010-08-11 00:15:17 161792 ----a-w- c:\windows\SWREG.exe
    2010-07-20 16:46:09 0 d-----w- c:\program files\iTunes
    2010-07-20 16:46:09 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2010-07-20 16:37:15 0 d-----w- c:\program files\Bonjour
    2010-07-18 13:32:06 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
    2010-07-15 20:28:00 12536 ----a-w- c:\windows\system32\avgrsstx.dll

    ==================== Find3M ====================

    2010-08-11 18:59:35 5209 --sha-w- c:\windows\system32\mmf.sys
    2010-07-15 20:28:04 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2010-07-15 20:26:26 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2010-05-18 20:35:16 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-05-18 20:35:16 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2010-05-18 20:35:16 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2010-05-18 20:35:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2008-05-29 13:59:20 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052920080530\index.dat

    ============= FINISH: 15:20:15.03 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 5/23/2003 6:57:51 PM
    System Uptime: 8/11/2010 2:58:42 PM (1 hours ago)

    Motherboard: Dell Computer Corp. | | 0M0321
    Processor: Intel(R) Pentium(R) 4 CPU 2.53GHz | Microprocessor | 2525/533mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 56 GiB total, 26.42 GiB free.
    D: is CDROM ()
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP532: 5/13/2010 7:02:05 PM - System Checkpoint
    RP533: 5/14/2010 7:18:53 PM - System Checkpoint
    RP534: 5/15/2010 12:21:51 PM - Software Distribution Service 3.0
    RP535: 5/16/2010 1:19:27 PM - System Checkpoint
    RP536: 5/18/2010 5:26:47 PM - System Checkpoint
    RP537: 5/19/2010 5:31:40 PM - System Checkpoint
    RP538: 5/20/2010 6:06:01 PM - System Checkpoint
    RP539: 5/21/2010 7:05:17 PM - System Checkpoint
    RP540: 5/22/2010 7:28:42 PM - System Checkpoint
    RP541: 5/23/2010 7:47:05 PM - System Checkpoint
    RP542: 5/24/2010 8:13:13 PM - System Checkpoint
    RP543: 5/25/2010 9:15:23 PM - System Checkpoint
    RP544: 5/26/2010 10:10:33 PM - System Checkpoint
    RP545: 5/27/2010 10:29:06 PM - System Checkpoint
    RP546: 5/29/2010 6:21:32 AM - System Checkpoint
    RP547: 5/30/2010 7:18:21 AM - System Checkpoint
    RP548: 5/31/2010 6:48:38 AM - Software Distribution Service 3.0
    RP549: 6/1/2010 3:48:37 PM - System Checkpoint
    RP550: 6/2/2010 10:13:18 PM - Avg Update
    RP551: 6/4/2010 6:28:47 PM - System Checkpoint
    RP552: 6/5/2010 6:41:13 PM - System Checkpoint
    RP553: 6/6/2010 7:54:11 PM - System Checkpoint
    RP554: 6/7/2010 7:56:31 PM - System Checkpoint
    RP555: 6/8/2010 8:04:07 PM - System Checkpoint
    RP556: 6/9/2010 5:12:40 PM - Software Distribution Service 3.0
    RP557: 6/10/2010 6:07:25 PM - System Checkpoint
    RP558: 6/11/2010 6:55:24 PM - System Checkpoint
    RP559: 6/12/2010 8:29:40 PM - System Checkpoint
    RP560: 6/14/2010 4:46:14 PM - System Checkpoint
    RP561: 6/15/2010 5:41:44 PM - System Checkpoint
    RP562: 6/15/2010 9:09:52 PM - Removed LeapFrog Connect
    RP563: 6/16/2010 9:24:57 PM - System Checkpoint
    RP564: 6/17/2010 9:37:03 PM - System Checkpoint
    RP565: 6/19/2010 9:00:36 AM - System Checkpoint
    RP566: 6/20/2010 9:03:19 AM - System Checkpoint
    RP567: 6/21/2010 6:45:40 PM - System Checkpoint
    RP568: 6/22/2010 6:54:40 PM - System Checkpoint
    RP569: 6/24/2010 10:31:47 AM - System Checkpoint
    RP570: 6/25/2010 4:21:11 PM - Avg Update
    RP571: 6/25/2010 4:43:33 PM - Software Distribution Service 3.0
    RP572: 6/26/2010 5:39:51 PM - System Checkpoint
    RP573: 6/27/2010 6:33:48 PM - System Checkpoint
    RP574: 6/28/2010 6:44:59 PM - System Checkpoint
    RP575: 6/29/2010 7:43:23 PM - System Checkpoint
    RP576: 6/30/2010 8:38:08 PM - System Checkpoint
    RP577: 7/1/2010 9:04:11 PM - System Checkpoint
    RP578: 7/2/2010 9:54:32 PM - System Checkpoint
    RP579: 7/3/2010 9:58:38 PM - System Checkpoint
    RP580: 7/4/2010 10:51:41 PM - System Checkpoint
    RP581: 7/6/2010 9:51:35 AM - System Checkpoint
    RP582: 7/7/2010 7:52:32 PM - System Checkpoint
    RP583: 7/8/2010 8:49:49 PM - System Checkpoint
    RP584: 7/9/2010 6:10:22 AM - Removed Cisco Network Magic
    RP585: 7/9/2010 6:12:00 AM - Removed Pure Networks Platform
    RP586: 7/10/2010 6:42:00 AM - System Checkpoint
    RP587: 7/11/2010 8:42:41 AM - System Checkpoint
    RP588: 7/12/2010 3:41:43 PM - System Checkpoint
    RP589: 7/13/2010 5:51:26 PM - System Checkpoint
    RP590: 7/14/2010 6:45:41 PM - System Checkpoint
    RP591: 7/15/2010 4:25:31 PM - Avg Update
    RP592: 7/15/2010 4:28:17 PM - Avg Update
    RP593: 7/16/2010 8:19:30 PM - System Checkpoint
    RP594: 7/17/2010 8:57:12 PM - System Checkpoint
    RP595: 7/18/2010 9:32:29 AM - Software Distribution Service 3.0
    RP596: 7/19/2010 12:18:45 PM - System Checkpoint
    RP597: 7/20/2010 12:20:33 PM - Avg Update
    RP598: 7/20/2010 11:01:46 PM - Removed Safari
    RP599: 7/22/2010 5:58:26 PM - System Checkpoint
    RP600: 7/23/2010 6:46:24 PM - System Checkpoint
    RP601: 7/24/2010 7:34:23 PM - System Checkpoint
    RP602: 7/25/2010 8:15:14 PM - System Checkpoint
    RP603: 7/26/2010 8:55:18 PM - System Checkpoint
    RP604: 7/27/2010 9:13:40 PM - System Checkpoint
    RP605: 7/29/2010 1:30:31 PM - System Checkpoint
    RP606: 7/30/2010 5:16:42 PM - System Checkpoint
    RP607: 7/31/2010 6:08:59 PM - System Checkpoint
    RP608: 8/1/2010 6:28:19 PM - System Checkpoint
    RP609: 8/2/2010 6:42:30 PM - System Checkpoint
    RP610: 8/3/2010 6:58:04 PM - System Checkpoint
    RP611: 8/4/2010 7:50:57 PM - System Checkpoint
    RP612: 8/5/2010 8:37:51 PM - System Checkpoint
    RP613: 8/6/2010 9:19:15 PM - System Checkpoint
    RP614: 8/9/2010 5:51:15 PM - System Checkpoint
    RP615: 8/10/2010 6:45:11 PM - System Checkpoint

    ==== Installed Programs ======================

    Adobe AIR
    Adobe Atmosphere Player for Acrobat and Adobe Reader
    Adobe Download Manager 1.2 (Remove Only)
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Photoshop Album 2.0 Starter Edition
    Adobe Reader 9.1
    Adobe Shockwave Player
    AnswerWorks 4.0 Runtime - English
    AOL Coach Version 2.0(Build:20041026.5 en)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AVG Free 9.0
    Bonjour
    Canon Camera Access Library
    Canon Camera Support Core Library
    Canon G.726 WMP-Decoder
    CANON iMAGE GATEWAY Task for ZoomBrowser EX
    Canon Internet Library for ZoomBrowser EX
    Canon MovieEdit Task for ZoomBrowser EX
    Canon RAW Image Task for ZoomBrowser EX
    Canon Utilities CameraWindow
    Canon Utilities CameraWindow DC
    Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
    Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    Canon Utilities EOS Utility
    Canon Utilities MyCamera
    Canon Utilities MyCamera DC
    Canon Utilities PhotoStitch
    Canon Utilities RemoteCapture DC
    Canon Utilities RemoteCapture Task for ZoomBrowser EX
    Canon Utilities ZoomBrowser EX
    Canon ZoomBrowser EX Memory Card Utility
    Conexant SmartHSFi V92 56K DF PCI Modem
    Data Lifeguard Diagnostic for Windows
    Dell Digital Jukebox Driver
    Dell Photo AIO Printer 964
    Dell Picture Studio - Dell Image Expert
    Dell Solution Center
    Dell Support
    Digital Line Detect
    Disney Flix 3.0
    DVDSentry
    ERUNT 1.1j
    Google Earth Plug-in
    Google Update Helper
    GradeQuick
    Help and Support Customization
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HyperLoad
    Intel(R) PRO Ethernet Adapter and Software
    Intel(R) PROSet II
    iPod for Windows 2006-03-23
    iTunes
    Java(TM) 6 Update 15
    Macromedia Flash Player
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework (English)
    Microsoft .NET Framework (English) v1.0.3705
    Microsoft .NET Framework 1.0 Hotfix (KB928367)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Data Access Components KB870669
    Microsoft Interactive Training
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Money 2002
    Microsoft Money 2002 System Pack
    Microsoft National Language Support Downlevel APIs
    Microsoft Office XP Media Content
    Microsoft Office XP Small Business
    Microsoft Silverlight
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Windows Media Video 9 VCM
    Microsoft XML Parser
    Modem Helper
    Mozilla Firefox (3.0.5)
    MSN Music Assistant
    NetWaiting
    NVIDIA Display Driver
    NVIDIA Windows 2000/XP Display Drivers
    Paint Shop Pro 7
    Pop-Up Stopper Free Edition
    PowerDVD
    PrimoPDF
    PrimoPDF Redistribution Package
    Qualxserve Service Agreement
    QuickTime
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Shockwave
    Skype™ 4.2
    Sound Blaster Live!
    TurboTax 2009
    TurboTax 2009 WinPerFedFormset
    TurboTax 2009 WinPerReleaseEngine
    TurboTax 2009 WinPerTaxSupport
    TurboTax 2009 wnyiper
    TurboTax 2009 wrapper
    Unity Web Player
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB969497)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Viewpoint Media Player
    WebEx Support Manager for Internet Explorer
    WebFldrs XP
    WexTech AnswerWorks
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage v1.3.0254.0
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format Runtime
    Windows Media Player 10
    Windows XP Service Pack 3
    WinPatrol

    ==== Event Viewer Messages From Past Week ========

    8/8/2010 11:53:33 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    8/8/2010 11:52:29 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    8/6/2010 6:49:39 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 0007E9893EEE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    8/6/2010 4:09:25 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    8/6/2010 4:09:18 PM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).
    8/6/2010 4:09:17 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
    8/6/2010 4:09:17 PM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
    8/11/2010 2:48:38 PM, error: Service Control Manager [7031] - The AVG Free WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    8/11/2010 2:48:37 PM, error: Service Control Manager [7034] - The WMDM PMSP Service service terminated unexpectedly. It has done this 1 time(s).
    8/11/2010 2:48:37 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    8/11/2010 2:48:37 PM, error: Service Control Manager [7034] - The Canon Camera Access Library 8 service terminated unexpectedly. It has done this 1 time(s).
    8/11/2010 2:48:36 PM, error: Service Control Manager [7034] - The Windows User Mode Driver Framework service terminated unexpectedly. It has done this 1 time(s).
    8/11/2010 2:48:36 PM, error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s).
    8/11/2010 2:48:36 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
    8/11/2010 2:48:36 PM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
    8/10/2010 8:18:08 PM, error: Service Control Manager [7034] - The LicCtrl Service service terminated unexpectedly. It has done this 1 time(s).

    ==== End Of File ===========================

  8. #8
    Emeritus
    Join Date
    Aug 2007
    Posts
    1,875

    Default

    Step # 1 Update Java

    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

    Please follow these steps to remove older version Java components and update.

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6u21.
    • Click on the link to download Windows Offline Installation and save to your desktop. Do NOT use the Sun Download Manager.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Remove the following old versions of Java:

    • Java(TM) 6 Update 15

    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • From your desktop double-click on the download to install the newest version.




    Step # 2: Download and Run ATF Cleaner
    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it.

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Temporary Internet Files
    Prefetch
    Java Cache

    *The other boxes are optional*
    Then click the Empty Selected button.

    Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    Step # 3 Run Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware.
    • Before running a scan, click the Update tab, next click Check for Updates to download any updates, if available.
    • Next click the Scanner tab and select Perform Quick Scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. Please save it to a convenient location.
    • You can also access the log by doing the following:
    • Click on the Malwarebytes' Anti-Malware icon to launch the program.
    • Click on the Logs tab.
    • Click on the log at the bottom of those listed to highlight it.
    • Click Open.



    Post the MalwareBytes' Log in your next post/reply.
    Malware Removal University Master
    Member of ASAP & UNITE

  9. #9
    Member
    Join Date
    Dec 2008
    Posts
    57

    Default

    Continued thanks for all your help! A few things before the log:

    1. IE can now connect to the internet.
    2. Since my last post, AVG has popped up a few windows identifying infected files. I had the program take care of them.
    3. During the ATF step, I couldn't click on Opera (it was shaded grey).
    4. The MAM version I had on my computer wouldn't update so I removed it via the control panel, downloaded the current version, updated it and ran it. The log is below:

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4420

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    8/11/2010 10:46:14 PM
    mbam-log-2010-08-11 (22-46-14).txt

    Scan type: Quick scan
    Objects scanned: 145620
    Time elapsed: 9 minute(s), 57 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\Software\SolutionAV (Rogue.AntivirSolutionPro) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

  10. #10
    Emeritus
    Join Date
    Aug 2007
    Posts
    1,875

    Default

    3. During the ATF step, I couldn't click on Opera (it was shaded grey).
    That's fine. It was greyed out because you don't have Opera installed on your computer.


    Your version of Adobe Reader is out of date. Open up Adobe Reader, click Help then click Check for Updates. Once Adobe Reader is done checking for updates, have it download and install the update for Adobe Reader 9.3.3


    Step # 1: Run Kaspersky Online Scan

    Please go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases
    5. Click on My Computer under Scan.
    6. Once the scan is complete, it will display the results. Click on View Scan Report.
    7. You will see a list of infected items there. Click on Save Report As....
    8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
    9. Please post this log in your next reply.



    In your next post/reply, I need to see the following:

    1. Kaspersky Log
    2. A fresh DDS Log
    3. How is your computer doing, any problems?
    Malware Removal University Master
    Member of ASAP & UNITE

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •