Page 1 of 4 1234 LastLast
Results 1 to 10 of 32

Thread: personal internet security 2011

  1. #1
    Junior Member
    Join Date
    Feb 2011
    Posts
    19

    Default personal internet security 2011

    My computer was recently infected with "personal internet security 2011" virus, constant popups I could not access security programs,no restore points. I ran something called rkill and scanned three times with malwarebytes. I also ran a registry repair program, dont remember which one.Computer is running better but still having problems, forward and back buttons dont work properly , search results sometimes jump websites, google preferences says cookies disabled, right click doesnt work properly, other problems.
    I recently scanned with spybot in safe mode and got some results i couldnt fix
    Fraud.WindowsProtectionSuite
    Microsoft.Windows.RedirectedHosts, several entries on both
    the message i get when I try to fix these problems is Cannot create file "C:\windows\system32\drivers\etc\hosts" access denied
    Can anyone please help me with this? I really dont want to reload my operating system.( Windows Vista Home Edition) Thanks in advance.
    My computer knowledge is very limited so please be understanding.

    I have downloaded and ran erunt, here is the dds.txt and attach.txt

    DDS (Ver_10-12-12.02) - NTFSx86
    Run by The Sizers at 19:40:18.82 on Wed 02/02/2011
    Internet Explorer: 9.0.7930.16406 BrowserJavaVersion: 1.6.0_20
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2046.1133 [GMT -6:00]

    AV: AVG Anti-Virus Free *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    SP: AVG Anti-Virus Free *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\Windows\system32\lsm.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\Dwm.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\Windows\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    C:\Windows\System32\wpcumi.exe
    C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
    C:\Program Files\AVG\AVG9\avgtray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\Program Files\AVG\AVG9\avgemc.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Windows\system32\schtasks.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\jusched.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\System32\alg.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Internet Explorer\iexplore.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\The Sizers\Downloads\dds.scr
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uSearch Bar = Preserve
    uStart Page = hxxp://www.yahoo.com/
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
    TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe
    mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
    dRunOnce: [SpybotDeletingB950] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\dynamic\1.sdf"
    dRunOnce: [SpybotDeletingD3768] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\dynamic\1.sdf"
    dRunOnce: [SpybotDeletingB3134] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\dynamic\domains.txt"
    dRunOnce: [SpybotDeletingD4922] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\dynamic\domains.txt"
    dRunOnce: [SpybotDeletingB1416] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\buttondir.txt"
    dRunOnce: [SpybotDeletingD8036] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\buttondir.txt"
    dRunOnce: [SpybotDeletingB2740] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\linkpathlegal.txt"
    dRunOnce: [SpybotDeletingD8921] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\linkpathlegal.txt"
    dRunOnce: [SpybotDeletingB4957] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\cursors.res"
    dRunOnce: [SpybotDeletingD7578] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\cursors.res"
    dRunOnce: [SpybotDeletingB9864] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_1000.res"
    dRunOnce: [SpybotDeletingD550] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_1000.res"
    dRunOnce: [SpybotDeletingB2399] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_2000.res"
    dRunOnce: [SpybotDeletingD4213] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_2000.res"
    dRunOnce: [SpybotDeletingB6923] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_3000.res"
    dRunOnce: [SpybotDeletingD2566] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_3000.res"
    dRunOnce: [SpybotDeletingB5313] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_bar.res"
    dRunOnce: [SpybotDeletingD6224] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_bar.res"
    dRunOnce: [SpybotDeletingB9423] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_bbar1.res"
    dRunOnce: [SpybotDeletingD2131] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_bbar1.res"
    dRunOnce: [SpybotDeletingB7754] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_logos.res"
    dRunOnce: [SpybotDeletingD2634] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_logos.res"
    dRunOnce: [SpybotDeletingB2228] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_other.res"
    dRunOnce: [SpybotDeletingD7815] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_other.res"
    dRunOnce: [SpybotDeletingB7346] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_weather.res"
    dRunOnce: [SpybotDeletingD624] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_weather.res"
    dRunOnce: [SpybotDeletingB8476] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-t1-bg.res"
    dRunOnce: [SpybotDeletingD1575] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-t1-bg.res"
    dRunOnce: [SpybotDeletingB2550] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\icons2.res"
    dRunOnce: [SpybotDeletingD2427] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\icons2.res"
    dRunOnce: [SpybotDeletingB7455] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\ie_games_icon.res"
    dRunOnce: [SpybotDeletingD3418] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\ie_games_icon.res"
    dRunOnce: [SpybotDeletingB508] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\ie_video.res"
    dRunOnce: [SpybotDeletingD9445] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\ie_video.res"
    dRunOnce: [SpybotDeletingB7762] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\progress.res"
    dRunOnce: [SpybotDeletingD9148] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\progress.res"
    dRunOnce: [SpybotDeletingB7301] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\sales_buttons.res"
    dRunOnce: [SpybotDeletingD4683] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\sales_buttons.res"
    dRunOnce: [SpybotDeletingB8185] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\seekmo.res"
    dRunOnce: [SpybotDeletingD740] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\seekmo.res"
    dRunOnce: [SpybotDeletingB2679] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\seekmo_ie_menu.res"
    dRunOnce: [SpybotDeletingD1267] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\seekmo_ie_menu.res"
    dRunOnce: [SpybotDeletingB6795] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\s_icons_buttons.res"
    dRunOnce: [SpybotDeletingD1135] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\s_icons_buttons.res"
    dRunOnce: [SpybotDeletingB1601] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\t2_bg.res"
    dRunOnce: [SpybotDeletingD9438] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\t2_bg.res"
    dRunOnce: [SpybotDeletingB2846] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\tsd_bg.res"
    dRunOnce: [SpybotDeletingD6250] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\tsd_bg.res"
    dRunOnce: [SpybotDeletingB3307] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_511745-514279.mnu"
    dRunOnce: [SpybotDeletingD6803] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_511745-514279.mnu"
    dRunOnce: [SpybotDeletingB6987] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_categorize.mnu"
    dRunOnce: [SpybotDeletingD7093] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_categorize.mnu"
    dRunOnce: [SpybotDeletingB8046] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_comparison.mnu"
    dRunOnce: [SpybotDeletingD6774] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_comparison.mnu"
    dRunOnce: [SpybotDeletingB8874] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_explorer-Mails.mnu"
    dRunOnce: [SpybotDeletingD2622] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_explorer-Mails.mnu"
    dRunOnce: [SpybotDeletingB7238] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_explorer-people.mnu"
    dRunOnce: [SpybotDeletingD435] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_explorer-people.mnu"
    dRunOnce: [SpybotDeletingB7597] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_favorites.mnu"
    dRunOnce: [SpybotDeletingD6898] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_favorites.mnu"
    dRunOnce: [SpybotDeletingB5163] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Games.mnu"
    dRunOnce: [SpybotDeletingD4377] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Games.mnu"
    dRunOnce: [SpybotDeletingB8135] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Hide.mnu"
    dRunOnce: [SpybotDeletingD9923] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Hide.mnu"
    dRunOnce: [SpybotDeletingB5428] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_hotbarcom.mnu"
    dRunOnce: [SpybotDeletingD6663] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_hotbarcom.mnu"
    dRunOnce: [SpybotDeletingB109] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Hotmail.mnu"
    dRunOnce: [SpybotDeletingD9894] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Hotmail.mnu"
    dRunOnce: [SpybotDeletingB7311] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_hsskin.mnu"
    dRunOnce: [SpybotDeletingD4639] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_hsskin.mnu"
    dRunOnce: [SpybotDeletingB2206] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Mails.mnu"
    dRunOnce: [SpybotDeletingD2957] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Mails.mnu"
    dRunOnce: [SpybotDeletingB3477] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_new.mnu"
    dRunOnce: [SpybotDeletingD5613] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_new.mnu"
    dRunOnce: [SpybotDeletingB1089] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_premium.mnu"
    dRunOnce: [SpybotDeletingD822] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_premium.mnu"
    dRunOnce: [SpybotDeletingB8494] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_searchfor.mnu"
    dRunOnce: [SpybotDeletingD1443] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_searchfor.mnu"
    dRunOnce: [SpybotDeletingB5696] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_searchgo.mnu"
    dRunOnce: [SpybotDeletingD9456] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_searchgo.mnu"
    dRunOnce: [SpybotDeletingB4903] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_weather.mnu"
    dRunOnce: [SpybotDeletingD2062] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_weather.mnu"
    dRunOnce: [SpybotDeletingB9646] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_yellowpages.mnu"
    dRunOnce: [SpybotDeletingD9463] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_yellowpages.mnu"
    dRunOnce: [SpybotDeletingB4488] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-def-511724-548964.mnu"
    dRunOnce: [SpybotDeletingD9552] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-def-511724-548964.mnu"
    dRunOnce: [SpybotDeletingB1631] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-def-511724-9595.mnu"
    dRunOnce: [SpybotDeletingD1528] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-def-511724-9595.mnu"
    dRunOnce: [SpybotDeletingB9269] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\theweb.mnu"
    dRunOnce: [SpybotDeletingD5851] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\theweb.mnu"
    dRunOnce: [SpybotDeletingB6927] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Top7_theweb.mnu"
    dRunOnce: [SpybotDeletingD1479] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Top7_theweb.mnu"
    dRunOnce: [SpybotDeletingB5402] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\btntrans.idx"
    dRunOnce: [SpybotDeletingD9902] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\btntrans.idx"
    dRunOnce: [SpybotDeletingB6018] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\keywords.idx"
    dRunOnce: [SpybotDeletingD6622] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\keywords.idx"
    dRunOnce: [SpybotDeletingB8182] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\btntrans1.dat"
    dRunOnce: [SpybotDeletingD320] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\btntrans1.dat"
    dRunOnce: [SpybotDeletingB5667] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\keywords1.dat"
    dRunOnce: [SpybotDeletingD6160] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\keywords1.dat"
    dRunOnce: [SpybotDeletingB4625] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\components.cdf"
    dRunOnce: [SpybotDeletingD8044] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\components.cdf"
    dRunOnce: [SpybotDeletingB2145] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\default.cdf"
    dRunOnce: [SpybotDeletingD98] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\default.cdf"
    dRunOnce: [SpybotDeletingB9419] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\layout.cdf"
    dRunOnce: [SpybotDeletingD6531] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\layout.cdf"
    dRunOnce: [SpybotDeletingB9401] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\top7.cdf"
    dRunOnce: [SpybotDeletingD5219] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\top7.cdf"
    dRunOnce: [SpybotDeletingB9179] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\BtnTrans.xip"
    dRunOnce: [SpybotDeletingD7816] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\BtnTrans.xip"
    dRunOnce: [SpybotDeletingB8879] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\BtnTrans1.xip"
    dRunOnce: [SpybotDeletingD9631] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\BtnTrans1.xip"
    dRunOnce: [SpybotDeletingB869] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\buttondir.xip"
    dRunOnce: [SpybotDeletingD4699] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\buttondir.xip"
    dRunOnce: [SpybotDeletingB7310] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\cursors.xip"
    dRunOnce: [SpybotDeletingD319] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\cursors.xip"
    dRunOnce: [SpybotDeletingB8778] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\default.xip"
    dRunOnce: [SpybotDeletingD1043] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\default.xip"
    dRunOnce: [SpybotDeletingB6479] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_1000.xip"
    dRunOnce: [SpybotDeletingD6267] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_1000.xip"
    dRunOnce: [SpybotDeletingB6165] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_2000.xip"
    dRunOnce: [SpybotDeletingD6889] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_2000.xip"
    dRunOnce: [SpybotDeletingB2461] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_3000.xip"
    dRunOnce: [SpybotDeletingD8822] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_3000.xip"
    dRunOnce: [SpybotDeletingB2988] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_bar.xip"
    dRunOnce: [SpybotDeletingD5527] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_bar.xip"
    dRunOnce: [SpybotDeletingB4972] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_bbar1.xip"
    dRunOnce: [SpybotDeletingD5669] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_bbar1.xip"
    dRunOnce: [SpybotDeletingB7425] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_logos.xip"
    dRunOnce: [SpybotDeletingD5968] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_logos.xip"
    dRunOnce: [SpybotDeletingB1050] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_other.xip"
    dRunOnce: [SpybotDeletingD5470] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_other.xip"
    dRunOnce: [SpybotDeletingB3234] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_weather.xip"
    dRunOnce: [SpybotDeletingD3742] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_weather.xip"
    dRunOnce: [SpybotDeletingB7085] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\email-t1-bg.xip"
    dRunOnce: [SpybotDeletingD9716] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\email-t1-bg.xip"
    dRunOnce: [SpybotDeletingB4530] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\icons2.xip"
    dRunOnce: [SpybotDeletingD3526] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\icons2.xip"
    dRunOnce: [SpybotDeletingB2297] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\ie_games_icon.xip"
    dRunOnce: [SpybotDeletingD1053] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\ie_games_icon.xip"
    dRunOnce: [SpybotDeletingB9164] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\ie_video.xip"
    dRunOnce: [SpybotDeletingD309] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\ie_video.xip"
    dRunOnce: [SpybotDeletingB2129] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\keywords.xip"
    dRunOnce: [SpybotDeletingD2472] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\keywords.xip"
    dRunOnce: [SpybotDeletingB9508] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\keywords1.xip"
    dRunOnce: [SpybotDeletingD3400] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\keywords1.xip"
    dRunOnce: [SpybotDeletingB5502] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\layout.xip"
    dRunOnce: [SpybotDeletingD3499] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\layout.xip"
    dRunOnce: [SpybotDeletingB5067] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\linkpathlegal.xip"
    dRunOnce: [SpybotDeletingD4299] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\linkpathlegal.xip"
    dRunOnce: [SpybotDeletingB1751] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\progress.xip"
    dRunOnce: [SpybotDeletingD2832] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\progress.xip"
    dRunOnce: [SpybotDeletingB5701] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\sales_buttons.xip"
    dRunOnce: [SpybotDeletingD8033] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\sales_buttons.xip"
    dRunOnce: [SpybotDeletingB3172] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\samplegroups2.xip"
    dRunOnce: [SpybotDeletingD7687] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\samplegroups2.xip"
    dRunOnce: [SpybotDeletingB4909] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\seekmo.xip"
    dRunOnce: [SpybotDeletingD439] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\seekmo.xip"
    dRunOnce: [SpybotDeletingB441] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\seekmo_ie_menu.xip"
    dRunOnce: [SpybotDeletingD1845] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\seekmo_ie_menu.xip"
    dRunOnce: [SpybotDeletingB8142] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\s_icons_buttons.xip"
    dRunOnce: [SpybotDeletingD6490] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\s_icons_buttons.xip"
    dRunOnce: [SpybotDeletingB4858] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\t2_bg.xip"
    dRunOnce: [SpybotDeletingD4829] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\t2_bg.xip"
    dRunOnce: [SpybotDeletingB6983] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\top7.xip"
    dRunOnce: [SpybotDeletingD9946] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\top7.xip"
    dRunOnce: [SpybotDeletingB2190] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\tsd_bg.xip"
    dRunOnce: [SpybotDeletingD8730] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\tsd_bg.xip"
    dRunOnce: [SpybotDeletingB1502] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\samplegroups2.txt"
    dRunOnce: [SpybotDeletingD7407] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\samplegroups2.txt"
    uPolicies-explorer: DisallowRun = 1 (0x1)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
    IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    LSP: c:\windows\system32\wpclsp.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    AppInit_DLLs: avgrsstx.dll
    IFEO: image file execution options - svchost.exe
    IFEO: OLT.exe - svchost.exe
    Hosts: 74.125.45.100 4-open-davinci.com
    Hosts: 74.125.45.100 securitysoftwarepayments.com
    Hosts: 74.125.45.100 privatesecuredpayments.com
    Hosts: 74.125.45.100 secure.privatesecuredpayments.com
    Hosts: 74.125.45.100 getantivirusplusnow.com

    Note: multiple HOSTS entries found. Please refer to Attach.txt

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\thesiz~1\appdata\roaming\mozilla\firefox\profiles\v4g3d9ua.default\
    FF - prefs.js: browser.search.selectedEngine - search
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - plugin: c:\program files\download manager\npfpdlm.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\view22\version 3.10.50\NPView22.dll
    FF - plugin: c:\users\the sizers\appdata\roaming\mozilla\firefox\profiles\v4g3d9ua.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07076007.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-5-31 216400]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-5-31 29584]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-5-31 243024]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-1-31 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-1-31 55024]
    R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-7-26 921952]
    R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-26 308136]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-1-31 1153368]
    R3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-2 21504]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate1c8c2207b568970;Google Update Service (gupdate1c8c2207b568970);c:\program files\google\update\GoogleUpdate.exe [2009-1-31 133104]
    S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2008-7-7 20480]
    S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2008-5-9 174336]
    S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-1-31 7408]
    S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-3-20 32408]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

    =============== Created Last 30 ================

    2011-01-27 01:13:47 411368 ----a-w- c:\windows\system32\deployJava1.dll
    2011-01-27 01:13:47 411368 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    2011-01-27 01:09:12 2381824 ----a-w- c:\windows\system32\mshtml.tlb
    2011-01-27 01:09:12 1448448 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-01-26 05:56:50 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
    2011-01-26 05:56:50 797184 ----a-w- c:\windows\system32\FntCache.dll
    2011-01-26 05:56:50 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
    2011-01-26 05:56:50 302592 ----a-w- c:\windows\system32\mfmp4src.dll
    2011-01-26 05:56:50 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-01-26 05:56:50 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
    2011-01-26 05:56:50 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
    2011-01-26 05:56:50 161280 ----a-w- c:\windows\system32\d3d10_1.dll
    2011-01-26 05:56:50 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
    2011-01-26 05:56:50 1174528 ----a-w- c:\windows\system32\d3d10warp.dll
    2011-01-26 05:56:50 1068032 ----a-w- c:\windows\system32\DWrite.dll
    2011-01-26 05:56:49 680960 ----a-w- c:\windows\system32\d2d1.dll
    2011-01-26 05:53:32 -------- d-----w- c:\program files\Feedback Tool
    2011-01-26 00:08:37 5890896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{3fb7f439-fced-4e67-b642-518f0ab4a977}\mpengine.dll
    2011-01-24 05:34:44 5890896 ------w- c:\progra~2\microsoft\windows defender\definition updates\updates\mpengine.dll
    2011-01-24 02:24:20 -------- d-sh--w- c:\progra~2\PIRTS
    2011-01-24 02:22:12 -------- d-sh--w- c:\progra~2\f08d2b
    2011-01-19 05:12:39 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
    2011-01-19 05:12:38 49472 ----a-w- c:\windows\system32\netfxperf.dll
    2011-01-19 05:12:38 297808 ----a-w- c:\windows\system32\mscoree.dll
    2011-01-19 05:12:38 295264 ----a-w- c:\windows\system32\PresentationHost.exe
    2011-01-19 05:12:38 1130824 ----a-w- c:\windows\system32\dfshim.dll
    2011-01-19 05:05:24 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-01-19 05:05:05 8147456 ----a-w- c:\windows\system32\wmploc.DLL
    2011-01-19 05:05:05 168960 ----a-w- c:\program files\windows media player\wmplayer.exe
    2011-01-19 05:04:38 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-01-19 05:02:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2011-01-19 05:01:26 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-01-19 05:01:24 867328 ----a-w- c:\windows\system32\wmpmde.dll
    2011-01-19 05:01:22 157184 ----a-w- c:\windows\system32\t2embed.dll
    2011-01-19 05:01:21 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
    2011-01-19 05:01:17 1169408 ----a-w- c:\windows\system32\sdclt.exe
    2011-01-19 04:59:43 81920 ----a-w- c:\windows\system32\iccvid.dll
    2011-01-19 04:58:45 954752 ----a-w- c:\windows\system32\mfc40.dll
    2011-01-19 04:58:45 954288 ----a-w- c:\windows\system32\mfc40u.dll
    2011-01-19 04:58:27 7680 ----a-w- c:\program files\internet explorer\iecompat.dll
    2011-01-19 04:58:26 81920 ----a-w- c:\windows\system32\consent.exe
    2011-01-19 04:58:01 231424 ----a-w- c:\windows\system32\msshsq.dll
    2011-01-19 04:55:04 531968 ----a-w- c:\windows\system32\comctl32.dll
    2011-01-06 15:08:19 -------- d-----w- c:\program files\iPod
    2011-01-06 15:08:14 -------- d-----w- c:\program files\iTunes

    ==================== Find3M ====================

    2010-12-28 15:55:03 413696 ----a-w- c:\windows\system32\odbc32.dll
    2010-11-29 23:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 23:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts

    ============= FINISH: 19:41:12.84 ===============



    here are the results of the last spybot scan


    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    4-open-davinci.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    securitysoftwarepayments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    privatesecuredpayments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    secure.privatesecuredpayments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    getantivirusplusnow.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    secure-plus-payments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    www.getantivirusplusnow.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    www.secure-plus-payments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    www.getavplusnow.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    safebrowsing-cache.google.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    urs.microsoft.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    www.securesoftwarebill.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    secure.paysecuresystem.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    paysoftbillsolution.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    protected.maxisoftwaremart.com=74.125.45.100

    Microsoft.Windows.RedirectedHosts: [SBI $B89FBA81] Redirected host (Redirected host, nothing done)
    www.securesoftwarebill.com=74.125.45.100

    Microsoft.Windows.RedirectedHosts: [SBI $19781685] Redirected host (Redirected host, nothing done)
    secure.paysecuresystem.com=74.125.45.100

    Microsoft.Windows.RedirectedHosts: [SBI $CEFF52BA] Redirected host (Redirected host, nothing done)
    paysoftbillsolution.com=74.125.45.100

    Right Media: Tracking cookie (Internet Explorer: The Sizers) (Cookie, nothing done)


    DoubleClick: Tracking cookie (Internet Explorer: The Sizers) (Cookie, nothing done)



    --- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

    2009-01-26 blindman.exe (1.0.0.8)
    2009-01-26 SDFiles.exe (1.6.1.7)
    2009-01-26 SDMain.exe (1.0.0.6)
    2009-01-26 SDShred.exe (1.0.2.5)
    2009-01-26 SDUpdate.exe (1.6.0.12)
    2009-01-26 SDWinSec.exe (1.0.0.12)
    2009-01-26 SpybotSD.exe (1.6.2.46)
    2009-03-05 TeaTimer.exe (1.6.6.32)
    2009-08-23 unins000.exe (51.49.0.0)
    2009-01-26 Update.exe (1.6.0.7)
    2009-11-04 advcheck.dll (1.6.5.20)
    2007-04-02 aports.dll (2.1.0.0)
    2008-06-14 DelZip179.dll (1.79.11.1)
    2009-01-26 SDHelper.dll (1.6.2.14)
    2008-06-19 sqlite3.dll
    2009-01-26 Tools.dll (2.1.6.10)
    2009-01-16 UninsSrv.dll (1.0.0.0)
    2010-10-05 Includes\Adware.sbi (*)
    2011-02-01 Includes\AdwareC.sbi (*)
    2010-08-13 Includes\Cookies.sbi (*)
    2010-12-14 Includes\Dialer.sbi (*)
    2010-12-14 Includes\DialerC.sbi (*)
    2010-01-25 Includes\HeavyDuty.sbi (*)
    2010-11-30 Includes\Hijackers.sbi (*)
    2011-01-25 Includes\HijackersC.sbi (*)
    2010-09-15 Includes\iPhone.sbi (*)
    2010-12-14 Includes\Keyloggers.sbi (*)
    2010-12-14 Includes\KeyloggersC.sbi (*)
    2004-11-29 Includes\LSP.sbi (*)
    2010-12-14 Includes\Malware.sbi (*)
    2011-02-01 Includes\MalwareC.sbi (*)
    2010-05-18 Includes\PUPS.sbi (*)
    2010-12-14 Includes\PUPSC.sbi (*)
    2010-01-25 Includes\Revision.sbi (*)
    2009-01-13 Includes\Security.sbi (*)
    2010-12-14 Includes\SecurityC.sbi (*)
    2008-06-03 Includes\Spybots.sbi (*)
    2008-06-03 Includes\SpybotsC.sbi (*)
    2011-01-18 Includes\Spyware.sbi (*)
    2011-01-18 Includes\SpywareC.sbi (*)
    2010-03-08 Includes\Tracks.uti
    2010-12-28 Includes\Trojans.sbi (*)
    2011-02-01 Includes\TrojansC-02.sbi (*)
    2011-01-13 Includes\TrojansC-03.sbi (*)
    2011-01-25 Includes\TrojansC-04.sbi (*)
    2011-01-26 Includes\TrojansC-05.sbi (*)
    2010-12-28 Includes\TrojansC.sbi (*)
    2008-03-04 Plugins\Chai.dll
    2008-03-05 Plugins\Fennel.dll
    2008-02-26 Plugins\Mate.dll
    2007-12-24 Plugins\TCPIPAddress.dll

  2. #2
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi


    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully first.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member
    Join Date
    Feb 2011
    Posts
    19

    Default

    I had to uninstall avg 9.0 in order to run combofix,here are the results

    ComboFix 11-01-31.02 - The Sizers 02/03/2011 18:03:54.2.1 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2046.1439 [GMT -6:00]
    Running from: c:\users\The Sizers\Downloads\ComboFix.exe
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.exe
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\CLSV.dll
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.tmp
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\eb.tmp
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\energy.dll
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\exec.dll
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\exec.sys
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\hymt.sys
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\kernel32.drv
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\PE.drv
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\PE.sys
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\runddl.drv
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.sys
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.tmp
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\sld.tmp
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\SM.exe
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\SM.tmp
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\snl2w.drv
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\snl2w.sys
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.exe
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\tjd.drv
    c:\users\The Sizers\AppData\Roaming\Microsoft\Windows\Recent\tjd.exe
    c:\windows\system32\404Fix.exe
    c:\windows\system32\Agent.OMZ.Fix.exe
    c:\windows\system32\dumphive.exe
    c:\windows\system32\IEDFix.C.exe
    c:\windows\system32\IEDFix.exe
    c:\windows\system32\jusched.exe
    c:\windows\system32\o4Patch.exe
    c:\windows\system32\Process.exe
    c:\windows\system32\SrchSTS.exe
    c:\windows\system32\tmp.reg
    c:\windows\system32\VACFix.exe
    c:\windows\system32\VCCLSID.exe
    c:\windows\system32\WS2Fix.exe

    .
    ((((((((((((((((((((((((( Files Created from 2011-01-04 to 2011-02-04 )))))))))))))))))))))))))))))))
    .

    2011-02-04 00:11 . 2011-02-04 00:11 -------- d-----w- c:\users\The Sizers\AppData\Local\temp
    2011-02-04 00:11 . 2011-02-04 00:11 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-02-04 00:11 . 2011-02-04 00:11 -------- d-----w- c:\users\Guest\AppData\Local\temp
    2011-02-03 01:36 . 2011-02-03 01:36 -------- d-----w- c:\program files\ERUNT
    2011-02-02 23:02 . 2011-02-02 23:02 -------- d-----w- c:\windows\Sun
    2011-01-27 01:13 . 2011-01-27 01:13 411368 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-01-27 01:13 . 2011-01-27 01:13 411368 ----a-w- c:\windows\system32\deployJava1.dll
    2011-01-27 01:09 . 2010-11-01 23:03 1448448 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-01-27 01:09 . 2010-11-01 22:59 2381824 ----a-w- c:\windows\system32\mshtml.tlb
    2011-01-26 05:56 . 2010-08-17 23:54 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-01-26 05:56 . 2010-08-17 23:54 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
    2011-01-26 05:56 . 2010-08-17 23:52 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
    2011-01-26 05:56 . 2010-08-17 23:51 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
    2011-01-26 05:56 . 2010-08-17 23:51 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
    2011-01-26 05:56 . 2010-08-17 23:51 302592 ----a-w- c:\windows\system32\mfmp4src.dll
    2011-01-26 05:56 . 2010-08-17 23:49 1174528 ----a-w- c:\windows\system32\d3d10warp.dll
    2011-01-26 05:56 . 2010-08-17 23:49 1068032 ----a-w- c:\windows\system32\DWrite.dll
    2011-01-26 05:56 . 2010-08-17 23:49 797184 ----a-w- c:\windows\system32\FntCache.dll
    2011-01-26 05:56 . 2010-08-17 23:48 161280 ----a-w- c:\windows\system32\d3d10_1.dll
    2011-01-26 05:56 . 2010-08-17 23:48 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
    2011-01-26 05:56 . 2010-08-17 23:50 680960 ----a-w- c:\windows\system32\d2d1.dll
    2011-01-26 05:53 . 2011-01-26 05:53 -------- d-----w- c:\program files\Feedback Tool
    2011-01-26 00:08 . 2011-01-20 16:39 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3FB7F439-FCED-4E67-B642-518F0AB4A977}\mpengine.dll
    2011-01-25 09:01 . 2011-01-25 09:01 -------- d-----w- c:\program files\Microsoft.NET
    2011-01-24 02:24 . 2011-01-24 05:25 -------- d-sh--w- c:\programdata\PIRTS
    2011-01-24 02:22 . 2011-01-25 04:45 -------- d-sh--w- c:\programdata\f08d2b
    2011-01-19 05:12 . 2009-11-08 16:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
    2011-01-19 05:12 . 2009-11-08 16:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
    2011-01-19 05:12 . 2009-11-08 16:55 297808 ----a-w- c:\windows\system32\mscoree.dll
    2011-01-19 05:12 . 2009-11-08 16:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
    2011-01-19 05:12 . 2009-11-08 16:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
    2011-01-19 05:05 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-01-19 05:05 . 2010-09-13 13:56 8147456 ----a-w- c:\windows\system32\wmploc.DLL
    2011-01-19 05:05 . 2010-09-13 13:56 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
    2011-01-19 05:04 . 2010-10-28 13:20 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-01-19 05:02 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2011-01-19 05:01 . 2010-05-27 20:08 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-01-19 05:01 . 2010-08-20 16:05 867328 ----a-w- c:\windows\system32\wmpmde.dll
    2011-01-19 05:01 . 2010-08-26 16:37 157184 ----a-w- c:\windows\system32\t2embed.dll
    2011-01-19 05:01 . 2010-04-05 17:02 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
    2011-01-19 05:01 . 2010-12-14 14:49 1169408 ----a-w- c:\windows\system32\sdclt.exe
    2011-01-19 04:59 . 2010-05-27 20:08 81920 ----a-w- c:\windows\system32\iccvid.dll
    2011-01-19 04:58 . 2010-08-31 15:46 954752 ----a-w- c:\windows\system32\mfc40.dll
    2011-01-19 04:58 . 2010-08-31 15:46 954288 ----a-w- c:\windows\system32\mfc40u.dll
    2011-01-19 04:58 . 2010-10-19 04:27 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll
    2011-01-19 04:58 . 2010-10-18 13:37 81920 ----a-w- c:\windows\system32\consent.exe
    2011-01-19 04:58 . 2010-05-04 19:13 231424 ----a-w- c:\windows\system32\msshsq.dll
    2011-01-19 04:55 . 2010-08-31 15:44 531968 ----a-w- c:\windows\system32\comctl32.dll
    2011-01-06 15:08 . 2011-01-06 15:08 -------- d-----w- c:\program files\iPod
    2011-01-06 15:08 . 2011-01-06 15:08 -------- d-----w- c:\program files\iTunes

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-26 07:06 . 2010-12-26 07:06 749832 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
    2010-12-21 00:09 . 2009-01-31 18:20 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-21 00:08 . 2009-01-31 18:20 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]
    "SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "AvgUninstallURL"="start http:" [X]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "SpybotDeletingB950"="command" [X]
    "SpybotDeletingD3768"="del" [X]
    "SpybotDeletingB3134"="command" [X]
    "SpybotDeletingD4922"="del" [X]
    "SpybotDeletingB1416"="command" [X]
    "SpybotDeletingD8036"="del" [X]
    "SpybotDeletingB2740"="command" [X]
    "SpybotDeletingD8921"="del" [X]
    "SpybotDeletingB4957"="command" [X]
    "SpybotDeletingD7578"="del" [X]
    "SpybotDeletingB9864"="command" [X]
    "SpybotDeletingD550"="del" [X]
    "SpybotDeletingB2399"="command" [X]
    "SpybotDeletingD4213"="del" [X]
    "SpybotDeletingB6923"="command" [X]
    "SpybotDeletingD2566"="del" [X]
    "SpybotDeletingB5313"="command" [X]
    "SpybotDeletingD6224"="del" [X]
    "SpybotDeletingB9423"="command" [X]
    "SpybotDeletingD2131"="del" [X]
    "SpybotDeletingB7754"="command" [X]
    "SpybotDeletingD2634"="del" [X]
    "SpybotDeletingB2228"="command" [X]
    "SpybotDeletingD7815"="del" [X]
    "SpybotDeletingB7346"="command" [X]
    "SpybotDeletingD624"="del" [X]
    "SpybotDeletingB8476"="command" [X]
    "SpybotDeletingD1575"="del" [X]
    "SpybotDeletingB2550"="command" [X]
    "SpybotDeletingD2427"="del" [X]
    "SpybotDeletingB7455"="command" [X]
    "SpybotDeletingD3418"="del" [X]
    "SpybotDeletingB508"="command" [X]
    "SpybotDeletingD9445"="del" [X]
    "SpybotDeletingB7762"="command" [X]
    "SpybotDeletingD9148"="del" [X]
    "SpybotDeletingB7301"="command" [X]
    "SpybotDeletingD4683"="del" [X]
    "SpybotDeletingB8185"="command" [X]
    "SpybotDeletingD740"="del" [X]
    "SpybotDeletingB2679"="command" [X]
    "SpybotDeletingD1267"="del" [X]
    "SpybotDeletingB6795"="command" [X]
    "SpybotDeletingD1135"="del" [X]
    "SpybotDeletingB1601"="command" [X]
    "SpybotDeletingD9438"="del" [X]
    "SpybotDeletingB2846"="command" [X]
    "SpybotDeletingD6250"="del" [X]
    "SpybotDeletingB3307"="command" [X]
    "SpybotDeletingD6803"="del" [X]
    "SpybotDeletingB6987"="command" [X]
    "SpybotDeletingD7093"="del" [X]
    "SpybotDeletingB8046"="command" [X]
    "SpybotDeletingD6774"="del" [X]
    "SpybotDeletingB8874"="command" [X]
    "SpybotDeletingD2622"="del" [X]
    "SpybotDeletingB7238"="command" [X]
    "SpybotDeletingD435"="del" [X]
    "SpybotDeletingB7597"="command" [X]
    "SpybotDeletingD6898"="del" [X]
    "SpybotDeletingB5163"="command" [X]
    "SpybotDeletingD4377"="del" [X]
    "SpybotDeletingB8135"="command" [X]
    "SpybotDeletingD9923"="del" [X]
    "SpybotDeletingB5428"="command" [X]
    "SpybotDeletingD6663"="del" [X]
    "SpybotDeletingB109"="command" [X]
    "SpybotDeletingD9894"="del" [X]
    "SpybotDeletingB7311"="command" [X]
    "SpybotDeletingD4639"="del" [X]
    "SpybotDeletingB2206"="command" [X]
    "SpybotDeletingD2957"="del" [X]
    "SpybotDeletingB3477"="command" [X]
    "SpybotDeletingD5613"="del" [X]
    "SpybotDeletingB1089"="command" [X]
    "SpybotDeletingD822"="del" [X]
    "SpybotDeletingB8494"="command" [X]
    "SpybotDeletingD1443"="del" [X]
    "SpybotDeletingB5696"="command" [X]
    "SpybotDeletingD9456"="del" [X]
    "SpybotDeletingB4903"="command" [X]
    "SpybotDeletingD2062"="del" [X]
    "SpybotDeletingB9646"="command" [X]
    "SpybotDeletingD9463"="del" [X]
    "SpybotDeletingB4488"="command" [X]
    "SpybotDeletingD9552"="del" [X]
    "SpybotDeletingB1631"="command" [X]
    "SpybotDeletingD1528"="del" [X]
    "SpybotDeletingB9269"="command" [X]
    "SpybotDeletingD5851"="del" [X]
    "SpybotDeletingB6927"="command" [X]
    "SpybotDeletingD1479"="del" [X]
    "SpybotDeletingB5402"="command" [X]
    "SpybotDeletingD9902"="del" [X]
    "SpybotDeletingB6018"="command" [X]
    "SpybotDeletingD6622"="del" [X]
    "SpybotDeletingB8182"="command" [X]
    "SpybotDeletingD320"="del" [X]
    "SpybotDeletingB5667"="command" [X]
    "SpybotDeletingD6160"="del" [X]
    "SpybotDeletingB4625"="command" [X]
    "SpybotDeletingD8044"="del" [X]
    "SpybotDeletingB2145"="command" [X]
    "SpybotDeletingD98"="del" [X]
    "SpybotDeletingB9419"="command" [X]
    "SpybotDeletingD6531"="del" [X]
    "SpybotDeletingB9401"="command" [X]
    "SpybotDeletingD5219"="del" [X]
    "SpybotDeletingB9179"="command" [X]
    "SpybotDeletingD7816"="del" [X]
    "SpybotDeletingB8879"="command" [X]
    "SpybotDeletingD9631"="del" [X]
    "SpybotDeletingB869"="command" [X]
    "SpybotDeletingD4699"="del" [X]
    "SpybotDeletingB7310"="command" [X]
    "SpybotDeletingD319"="del" [X]
    "SpybotDeletingB8778"="command" [X]
    "SpybotDeletingD1043"="del" [X]
    "SpybotDeletingB6479"="command" [X]
    "SpybotDeletingD6267"="del" [X]
    "SpybotDeletingB6165"="command" [X]
    "SpybotDeletingD6889"="del" [X]
    "SpybotDeletingB2461"="command" [X]
    "SpybotDeletingD8822"="del" [X]
    "SpybotDeletingB2988"="command" [X]
    "SpybotDeletingD5527"="del" [X]
    "SpybotDeletingB4972"="command" [X]
    "SpybotDeletingD5669"="del" [X]
    "SpybotDeletingB7425"="command" [X]
    "SpybotDeletingD5968"="del" [X]
    "SpybotDeletingB1050"="command" [X]
    "SpybotDeletingD5470"="del" [X]
    "SpybotDeletingB3234"="command" [X]
    "SpybotDeletingD3742"="del" [X]
    "SpybotDeletingB7085"="command" [X]
    "SpybotDeletingD9716"="del" [X]
    "SpybotDeletingB4530"="command" [X]
    "SpybotDeletingD3526"="del" [X]
    "SpybotDeletingB2297"="command" [X]
    "SpybotDeletingD1053"="del" [X]
    "SpybotDeletingB9164"="command" [X]
    "SpybotDeletingD309"="del" [X]
    "SpybotDeletingB2129"="command" [X]
    "SpybotDeletingD2472"="del" [X]
    "SpybotDeletingB9508"="command" [X]
    "SpybotDeletingD3400"="del" [X]
    "SpybotDeletingB5502"="command" [X]
    "SpybotDeletingD3499"="del" [X]
    "SpybotDeletingB5067"="command" [X]
    "SpybotDeletingD4299"="del" [X]
    "SpybotDeletingB1751"="command" [X]
    "SpybotDeletingD2832"="del" [X]
    "SpybotDeletingB5701"="command" [X]
    "SpybotDeletingD8033"="del" [X]
    "SpybotDeletingB3172"="command" [X]
    "SpybotDeletingD7687"="del" [X]
    "SpybotDeletingB4909"="command" [X]
    "SpybotDeletingD439"="del" [X]
    "SpybotDeletingB441"="command" [X]
    "SpybotDeletingD1845"="del" [X]
    "SpybotDeletingB8142"="command" [X]
    "SpybotDeletingD6490"="del" [X]
    "SpybotDeletingB4858"="command" [X]
    "SpybotDeletingD4829"="del" [X]
    "SpybotDeletingB6983"="command" [X]
    "SpybotDeletingD9946"="del" [X]
    "SpybotDeletingB2190"="command" [X]
    "SpybotDeletingD8730"="del" [X]
    "SpybotDeletingB1502"="command" [X]
    "SpybotDeletingD7407"="del" [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorUser"= 2 (0x2)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
    backup=c:\windows\pss\Kodak EasyShare software.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e]
    ˆexe [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
    2010-12-14 23:17 47904 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2007-10-15 03:17 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
    2007-10-04 02:02 1783136 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
    2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-12-13 23:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
    2009-03-18 23:50 4363504 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    2008-12-12 18:46 9555968 ----a-w- c:\program files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    2007-12-26 22:34 8530464 ----a-w- c:\windows\System32\nvcpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    2007-12-26 22:34 81920 ----a-w- c:\windows\System32\nvmctray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
    2007-12-26 22:34 86016 ----a-w- c:\windows\System32\nvsvc.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
    2008-04-01 01:54 507904 ----a-w- c:\program files\Winamp Remote\bin\OrbTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro]
    2007-02-15 11:59 118784 ----a-w- c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-11-29 23:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
    2007-08-20 16:58 701736 ----a-w- c:\program files\Registry Mechanic\RMTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
    2008-01-15 16:26 4874240 ----a-w- c:\windows\RtHDVCpl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    2008-02-01 23:22 21898024 ----a-r- c:\program files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    2008-04-01 18:49 36352 ----a-w- c:\program files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 gupdate1c8c2207b568970;Google Update Service (gupdate1c8c2207b568970);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-07 133104]
    R3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\DRIVERS\NwUsbCdFil.sys [2008-07-07 20480]
    R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\DRIVERS\nwusbser2.sys [2008-05-09 174336]
    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
    R3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [2009-03-21 32408]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-04 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-30 17:59]

    2011-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-01-31 05:11]

    2011-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-01-31 05:11]

    2011-02-04 c:\windows\Tasks\User_Feed_Synchronization-{A110AB10-5BD3-45B6-861B-1E9924F1496E}.job
    - c:\windows\system32\msfeedssync.exe [2011-01-26 06:42]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    LSP: c:\windows\system32\wpclsp.dll
    FF - ProfilePath - c:\users\The Sizers\AppData\Roaming\Mozilla\Firefox\Profiles\v4g3d9ua.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    .
    - - - - ORPHANS REMOVED - - - -

    MSConfigStartUp-BearShare - c:\program files\BearShare\BearShare.exe
    MSConfigStartUp-F-Secure Manager - c:\program files\PC Defender\Common\FSM32.EXE
    MSConfigStartUp-F-Secure TNB - c:\program files\PC Defender\FSGUI\TNBUtil.exe
    MSConfigStartUp-Personal Internet Security 2011 - c:\programdata\f08d2b\PIf08_2278.exe
    AddRemove-HijackThis - c:\users\THESIZ~1\AppData\Local\Temp\LMI98B3.tmp\Script_3\HijackThis.exe
    AddRemove-Lightning - c:\program files\HeavenWord



    **************************************************************************
    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files:

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-1200996304-788045959-2936275167-1000\Software\SecuROM\License information*]
    "datasecu"=hex:d3,c3,a4,62,70,a1,e0,37,50,38,56,f3,dc,94,16,f0,ae,37,4a,ff,b6,
    11,08,42,24,d6,96,6e,7a,4d,dd,2f,f7,71,f0,fa,9e,d4,e2,71,90,36,e9,6c,33,f8,\
    "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

    [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2011-02-03 18:14:49
    ComboFix-quarantined-files.txt 2011-02-04 00:14
    ComboFix2.txt 2009-01-31 21:03

    Pre-Run: 45,635,780,608 bytes free
    Post-Run: 45,309,251,584 bytes free

    - - End Of File - - C4C9FAD477D26C8DBC7C26A61C602089



    here is the dds log


    DDS (Ver_10-12-12.02) - NTFSx86
    Run by The Sizers at 18:17:42.66 on Thu 02/03/2011
    Internet Explorer: 9.0.7930.16406 BrowserJavaVersion: 1.6.0_20
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2046.1151 [GMT -6:00]

    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Windows\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\System32\wpcumi.exe
    C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\System32\alg.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\notepad.exe
    C:\Windows\explorer.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Users\The Sizers\Downloads\dds.scr
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.yahoo.com/
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
    TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe
    mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=OQBBAFYARgBSAEUARQAtAFYATgBKADMAMgAtAEcAMwBMAEEAQQAtAEEANAA4ADkAUgAtADkAVQBKAEsARgAtAEUASwBLADMAWAA"&"inst=NwA3AC0AMwA0ADcAMQA0ADQANgA0ADEALQBGAFAAOQArADYALQBUAEIAOQArADIALQBGAEwAKwA5AC0AWABPADMANgArADEALQBGADkATQAxADAAQgArADEA"&"prod=90"&"ver=9.0.872
    dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
    dRunOnce: [SpybotDeletingB950] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\dynamic\1.sdf"
    dRunOnce: [SpybotDeletingD3768] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\dynamic\1.sdf"
    dRunOnce: [SpybotDeletingB3134] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\dynamic\domains.txt"
    dRunOnce: [SpybotDeletingD4922] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\dynamic\domains.txt"
    dRunOnce: [SpybotDeletingB1416] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\buttondir.txt"
    dRunOnce: [SpybotDeletingD8036] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\buttondir.txt"
    dRunOnce: [SpybotDeletingB2740] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\linkpathlegal.txt"
    dRunOnce: [SpybotDeletingD8921] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\linkpathlegal.txt"
    dRunOnce: [SpybotDeletingB4957] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\cursors.res"
    dRunOnce: [SpybotDeletingD7578] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\cursors.res"
    dRunOnce: [SpybotDeletingB9864] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_1000.res"
    dRunOnce: [SpybotDeletingD550] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_1000.res"
    dRunOnce: [SpybotDeletingB2399] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_2000.res"
    dRunOnce: [SpybotDeletingD4213] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_2000.res"
    dRunOnce: [SpybotDeletingB6923] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_3000.res"
    dRunOnce: [SpybotDeletingD2566] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_3000.res"
    dRunOnce: [SpybotDeletingB5313] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_bar.res"
    dRunOnce: [SpybotDeletingD6224] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_bar.res"
    dRunOnce: [SpybotDeletingB9423] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_bbar1.res"
    dRunOnce: [SpybotDeletingD2131] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_bbar1.res"
    dRunOnce: [SpybotDeletingB7754] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_logos.res"
    dRunOnce: [SpybotDeletingD2634] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_logos.res"
    dRunOnce: [SpybotDeletingB2228] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_other.res"
    dRunOnce: [SpybotDeletingD7815] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_buttons_other.res"
    dRunOnce: [SpybotDeletingB7346] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_weather.res"
    dRunOnce: [SpybotDeletingD624] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\d_icons_weather.res"
    dRunOnce: [SpybotDeletingB8476] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-t1-bg.res"
    dRunOnce: [SpybotDeletingD1575] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-t1-bg.res"
    dRunOnce: [SpybotDeletingB2550] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\icons2.res"
    dRunOnce: [SpybotDeletingD2427] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\icons2.res"
    dRunOnce: [SpybotDeletingB7455] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\ie_games_icon.res"
    dRunOnce: [SpybotDeletingD3418] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\ie_games_icon.res"
    dRunOnce: [SpybotDeletingB508] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\ie_video.res"
    dRunOnce: [SpybotDeletingD9445] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\ie_video.res"
    dRunOnce: [SpybotDeletingB7762] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\progress.res"
    dRunOnce: [SpybotDeletingD9148] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\progress.res"
    dRunOnce: [SpybotDeletingB7301] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\sales_buttons.res"
    dRunOnce: [SpybotDeletingD4683] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\sales_buttons.res"
    dRunOnce: [SpybotDeletingB8185] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\seekmo.res"
    dRunOnce: [SpybotDeletingD740] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\seekmo.res"
    dRunOnce: [SpybotDeletingB2679] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\seekmo_ie_menu.res"
    dRunOnce: [SpybotDeletingD1267] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\seekmo_ie_menu.res"
    dRunOnce: [SpybotDeletingB6795] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\s_icons_buttons.res"
    dRunOnce: [SpybotDeletingD1135] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\s_icons_buttons.res"
    dRunOnce: [SpybotDeletingB1601] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\t2_bg.res"
    dRunOnce: [SpybotDeletingD9438] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\t2_bg.res"
    dRunOnce: [SpybotDeletingB2846] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\tsd_bg.res"
    dRunOnce: [SpybotDeletingD6250] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\tsd_bg.res"
    dRunOnce: [SpybotDeletingB3307] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_511745-514279.mnu"
    dRunOnce: [SpybotDeletingD6803] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_511745-514279.mnu"
    dRunOnce: [SpybotDeletingB6987] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_categorize.mnu"
    dRunOnce: [SpybotDeletingD7093] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_categorize.mnu"
    dRunOnce: [SpybotDeletingB8046] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_comparison.mnu"
    dRunOnce: [SpybotDeletingD6774] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_comparison.mnu"
    dRunOnce: [SpybotDeletingB8874] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_explorer-Mails.mnu"
    dRunOnce: [SpybotDeletingD2622] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_explorer-Mails.mnu"
    dRunOnce: [SpybotDeletingB7238] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_explorer-people.mnu"
    dRunOnce: [SpybotDeletingD435] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_explorer-people.mnu"
    dRunOnce: [SpybotDeletingB7597] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_favorites.mnu"
    dRunOnce: [SpybotDeletingD6898] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_favorites.mnu"
    dRunOnce: [SpybotDeletingB5163] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Games.mnu"
    dRunOnce: [SpybotDeletingD4377] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Games.mnu"
    dRunOnce: [SpybotDeletingB8135] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Hide.mnu"
    dRunOnce: [SpybotDeletingD9923] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Hide.mnu"
    dRunOnce: [SpybotDeletingB5428] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_hotbarcom.mnu"
    dRunOnce: [SpybotDeletingD6663] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_hotbarcom.mnu"
    dRunOnce: [SpybotDeletingB109] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Hotmail.mnu"
    dRunOnce: [SpybotDeletingD9894] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Hotmail.mnu"
    dRunOnce: [SpybotDeletingB7311] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_hsskin.mnu"
    dRunOnce: [SpybotDeletingD4639] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_hsskin.mnu"
    dRunOnce: [SpybotDeletingB2206] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Mails.mnu"
    dRunOnce: [SpybotDeletingD2957] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_Mails.mnu"
    dRunOnce: [SpybotDeletingB3477] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_new.mnu"
    dRunOnce: [SpybotDeletingD5613] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_new.mnu"
    dRunOnce: [SpybotDeletingB1089] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_premium.mnu"
    dRunOnce: [SpybotDeletingD822] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_premium.mnu"
    dRunOnce: [SpybotDeletingB8494] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_searchfor.mnu"
    dRunOnce: [SpybotDeletingD1443] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_searchfor.mnu"
    dRunOnce: [SpybotDeletingB5696] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_searchgo.mnu"
    dRunOnce: [SpybotDeletingD9456] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_searchgo.mnu"
    dRunOnce: [SpybotDeletingB4903] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_weather.mnu"
    dRunOnce: [SpybotDeletingD2062] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_weather.mnu"
    dRunOnce: [SpybotDeletingB9646] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_yellowpages.mnu"
    dRunOnce: [SpybotDeletingD9463] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Default_yellowpages.mnu"
    dRunOnce: [SpybotDeletingB4488] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-def-511724-548964.mnu"
    dRunOnce: [SpybotDeletingD9552] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-def-511724-548964.mnu"
    dRunOnce: [SpybotDeletingB1631] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-def-511724-9595.mnu"
    dRunOnce: [SpybotDeletingD1528] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\email-def-511724-9595.mnu"
    dRunOnce: [SpybotDeletingB9269] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\theweb.mnu"
    dRunOnce: [SpybotDeletingD5851] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\theweb.mnu"
    dRunOnce: [SpybotDeletingB6927] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Top7_theweb.mnu"
    dRunOnce: [SpybotDeletingD1479] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\Top7_theweb.mnu"
    dRunOnce: [SpybotDeletingB5402] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\btntrans.idx"
    dRunOnce: [SpybotDeletingD9902] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\btntrans.idx"
    dRunOnce: [SpybotDeletingB6018] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\keywords.idx"
    dRunOnce: [SpybotDeletingD6622] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\keywords.idx"
    dRunOnce: [SpybotDeletingB8182] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\btntrans1.dat"
    dRunOnce: [SpybotDeletingD320] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\btntrans1.dat"
    dRunOnce: [SpybotDeletingB5667] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\keywords1.dat"
    dRunOnce: [SpybotDeletingD6160] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\keywords1.dat"
    dRunOnce: [SpybotDeletingB4625] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\components.cdf"
    dRunOnce: [SpybotDeletingD8044] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\components.cdf"
    dRunOnce: [SpybotDeletingB2145] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\default.cdf"
    dRunOnce: [SpybotDeletingD98] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\default.cdf"
    dRunOnce: [SpybotDeletingB9419] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\layout.cdf"
    dRunOnce: [SpybotDeletingD6531] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\layout.cdf"
    dRunOnce: [SpybotDeletingB9401] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\top7.cdf"
    dRunOnce: [SpybotDeletingD5219] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\1\top7.cdf"
    dRunOnce: [SpybotDeletingB9179] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\BtnTrans.xip"
    dRunOnce: [SpybotDeletingD7816] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\BtnTrans.xip"
    dRunOnce: [SpybotDeletingB8879] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\BtnTrans1.xip"
    dRunOnce: [SpybotDeletingD9631] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\BtnTrans1.xip"
    dRunOnce: [SpybotDeletingB869] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\buttondir.xip"
    dRunOnce: [SpybotDeletingD4699] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\buttondir.xip"
    dRunOnce: [SpybotDeletingB7310] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\cursors.xip"
    dRunOnce: [SpybotDeletingD319] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\cursors.xip"
    dRunOnce: [SpybotDeletingB8778] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\default.xip"
    dRunOnce: [SpybotDeletingD1043] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\default.xip"
    dRunOnce: [SpybotDeletingB6479] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_1000.xip"
    dRunOnce: [SpybotDeletingD6267] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_1000.xip"
    dRunOnce: [SpybotDeletingB6165] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_2000.xip"
    dRunOnce: [SpybotDeletingD6889] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_2000.xip"
    dRunOnce: [SpybotDeletingB2461] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_3000.xip"
    dRunOnce: [SpybotDeletingD8822] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_3000.xip"
    dRunOnce: [SpybotDeletingB2988] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_bar.xip"
    dRunOnce: [SpybotDeletingD5527] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_bar.xip"
    dRunOnce: [SpybotDeletingB4972] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_bbar1.xip"
    dRunOnce: [SpybotDeletingD5669] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_bbar1.xip"
    dRunOnce: [SpybotDeletingB7425] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_logos.xip"
    dRunOnce: [SpybotDeletingD5968] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_logos.xip"
    dRunOnce: [SpybotDeletingB1050] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_other.xip"
    dRunOnce: [SpybotDeletingD5470] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_buttons_other.xip"
    dRunOnce: [SpybotDeletingB3234] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_weather.xip"
    dRunOnce: [SpybotDeletingD3742] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\d_icons_weather.xip"
    dRunOnce: [SpybotDeletingB7085] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\email-t1-bg.xip"
    dRunOnce: [SpybotDeletingD9716] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\email-t1-bg.xip"
    dRunOnce: [SpybotDeletingB4530] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\icons2.xip"
    dRunOnce: [SpybotDeletingD3526] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\icons2.xip"
    dRunOnce: [SpybotDeletingB2297] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\ie_games_icon.xip"
    dRunOnce: [SpybotDeletingD1053] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\ie_games_icon.xip"
    dRunOnce: [SpybotDeletingB9164] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\ie_video.xip"
    dRunOnce: [SpybotDeletingD309] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\ie_video.xip"
    dRunOnce: [SpybotDeletingB2129] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\keywords.xip"
    dRunOnce: [SpybotDeletingD2472] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\keywords.xip"
    dRunOnce: [SpybotDeletingB9508] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\keywords1.xip"
    dRunOnce: [SpybotDeletingD3400] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\keywords1.xip"
    dRunOnce: [SpybotDeletingB5502] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\layout.xip"
    dRunOnce: [SpybotDeletingD3499] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\layout.xip"
    dRunOnce: [SpybotDeletingB5067] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\linkpathlegal.xip"
    dRunOnce: [SpybotDeletingD4299] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\linkpathlegal.xip"
    dRunOnce: [SpybotDeletingB1751] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\progress.xip"
    dRunOnce: [SpybotDeletingD2832] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\progress.xip"
    dRunOnce: [SpybotDeletingB5701] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\sales_buttons.xip"
    dRunOnce: [SpybotDeletingD8033] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\sales_buttons.xip"
    dRunOnce: [SpybotDeletingB3172] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\samplegroups2.xip"
    dRunOnce: [SpybotDeletingD7687] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\samplegroups2.xip"
    dRunOnce: [SpybotDeletingB4909] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\seekmo.xip"
    dRunOnce: [SpybotDeletingD439] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\seekmo.xip"
    dRunOnce: [SpybotDeletingB441] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\seekmo_ie_menu.xip"
    dRunOnce: [SpybotDeletingD1845] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\seekmo_ie_menu.xip"
    dRunOnce: [SpybotDeletingB8142] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\s_icons_buttons.xip"
    dRunOnce: [SpybotDeletingD6490] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\s_icons_buttons.xip"
    dRunOnce: [SpybotDeletingB4858] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\t2_bg.xip"
    dRunOnce: [SpybotDeletingD4829] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\t2_bg.xip"
    dRunOnce: [SpybotDeletingB6983] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\top7.xip"
    dRunOnce: [SpybotDeletingD9946] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\top7.xip"
    dRunOnce: [SpybotDeletingB2190] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\tsd_bg.xip"
    dRunOnce: [SpybotDeletingD8730] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\tsd_bg.xip"
    dRunOnce: [SpybotDeletingB1502] command /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\samplegroups2.txt"
    dRunOnce: [SpybotDeletingD7407] cmd /c del "c:\users\the sizers\appdata\roaming\seekmo\v3.0\seekmo\static\download\samplegroups2.txt"
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
    IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    LSP: c:\windows\system32\wpclsp.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\thesiz~1\appdata\roaming\mozilla\firefox\profiles\v4g3d9ua.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - plugin: c:\program files\download manager\npfpdlm.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\view22\version 3.10.50\NPView22.dll
    FF - plugin: c:\users\the sizers\appdata\roaming\mozilla\firefox\profiles\v4g3d9ua.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07076007.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

    ============= SERVICES / DRIVERS ===============

    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-1-31 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-1-31 55024]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-1-31 1153368]
    R3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-2 21504]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate1c8c2207b568970;Google Update Service (gupdate1c8c2207b568970);c:\program files\google\update\GoogleUpdate.exe [2009-1-31 133104]
    S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2008-7-7 20480]
    S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2008-5-9 174336]
    S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-1-31 7408]
    S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-3-20 32408]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

    =============== Created Last 30 ================

    2011-02-04 00:14:57 -------- d-sh--w- C:\$RECYCLE.BIN
    2011-02-04 00:14:51 -------- d-----w- c:\users\thesiz~1\appdata\local\temp
    2011-02-04 00:01:50 89088 ----a-w- c:\windows\MBR.exe
    2011-02-04 00:01:50 256512 ----a-w- c:\windows\PEV.exe
    2011-01-27 01:13:47 411368 ----a-w- c:\windows\system32\deployJava1.dll
    2011-01-27 01:13:47 411368 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    2011-01-27 01:09:12 2381824 ----a-w- c:\windows\system32\mshtml.tlb
    2011-01-27 01:09:12 1448448 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-01-26 05:56:50 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
    2011-01-26 05:56:50 797184 ----a-w- c:\windows\system32\FntCache.dll
    2011-01-26 05:56:50 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
    2011-01-26 05:56:50 302592 ----a-w- c:\windows\system32\mfmp4src.dll
    2011-01-26 05:56:50 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-01-26 05:56:50 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
    2011-01-26 05:56:50 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
    2011-01-26 05:56:50 161280 ----a-w- c:\windows\system32\d3d10_1.dll
    2011-01-26 05:56:50 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
    2011-01-26 05:56:50 1174528 ----a-w- c:\windows\system32\d3d10warp.dll
    2011-01-26 05:56:50 1068032 ----a-w- c:\windows\system32\DWrite.dll
    2011-01-26 05:56:49 680960 ----a-w- c:\windows\system32\d2d1.dll
    2011-01-26 05:53:32 -------- d-----w- c:\program files\Feedback Tool
    2011-01-26 00:08:37 5890896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{3fb7f439-fced-4e67-b642-518f0ab4a977}\mpengine.dll
    2011-01-24 05:34:44 5890896 ------w- c:\progra~2\microsoft\windows defender\definition updates\updates\mpengine.dll
    2011-01-24 02:24:20 -------- d-sh--w- c:\progra~2\PIRTS
    2011-01-24 02:22:12 -------- d-sh--w- c:\progra~2\f08d2b
    2011-01-19 05:12:39 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
    2011-01-19 05:12:38 49472 ----a-w- c:\windows\system32\netfxperf.dll
    2011-01-19 05:12:38 297808 ----a-w- c:\windows\system32\mscoree.dll
    2011-01-19 05:12:38 295264 ----a-w- c:\windows\system32\PresentationHost.exe
    2011-01-19 05:12:38 1130824 ----a-w- c:\windows\system32\dfshim.dll
    2011-01-19 05:05:24 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-01-19 05:05:05 8147456 ----a-w- c:\windows\system32\wmploc.DLL
    2011-01-19 05:05:05 168960 ----a-w- c:\program files\windows media player\wmplayer.exe
    2011-01-19 05:04:38 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-01-19 05:02:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2011-01-19 05:01:26 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-01-19 05:01:24 867328 ----a-w- c:\windows\system32\wmpmde.dll
    2011-01-19 05:01:22 157184 ----a-w- c:\windows\system32\t2embed.dll
    2011-01-19 05:01:21 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
    2011-01-19 05:01:17 1169408 ----a-w- c:\windows\system32\sdclt.exe
    2011-01-19 04:59:43 81920 ----a-w- c:\windows\system32\iccvid.dll
    2011-01-19 04:58:45 954752 ----a-w- c:\windows\system32\mfc40.dll
    2011-01-19 04:58:45 954288 ----a-w- c:\windows\system32\mfc40u.dll
    2011-01-19 04:58:27 7680 ----a-w- c:\program files\internet explorer\iecompat.dll
    2011-01-19 04:58:26 81920 ----a-w- c:\windows\system32\consent.exe
    2011-01-19 04:58:01 231424 ----a-w- c:\windows\system32\msshsq.dll
    2011-01-19 04:55:04 531968 ----a-w- c:\windows\system32\comctl32.dll
    2011-01-06 15:08:19 -------- d-----w- c:\program files\iPod
    2011-01-06 15:08:14 -------- d-----w- c:\program files\iTunes

    ==================== Find3M ====================

    2010-12-28 15:55:03 413696 ----a-w- c:\windows\system32\odbc32.dll
    2010-11-29 23:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 23:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts

    ============= FINISH: 18:18:05.02 ===============

  4. #4
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    I had to uninstall avg 9.0 in order to run combofix
    Yep. You may reinstall it after we've finished the case



    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    DirLook::
    c:\programdata\PIRTS
    c:\programdata\f08d2b
    DDS::
    BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
    TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File
    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "SpybotDeletingB950"=-
    "SpybotDeletingD3768"=-
    "SpybotDeletingB3134"=-
    "SpybotDeletingD4922"=-
    "SpybotDeletingB1416"=-
    "SpybotDeletingD8036"=-
    "SpybotDeletingB2740"=-
    "SpybotDeletingD8921"=-
    "SpybotDeletingB4957"=-
    "SpybotDeletingD7578"=-
    "SpybotDeletingB9864"=-
    "SpybotDeletingD550"=-
    "SpybotDeletingB2399"=-
    "SpybotDeletingD4213"=-
    "SpybotDeletingB6923"=-
    "SpybotDeletingD2566"=-
    "SpybotDeletingB5313"=-
    "SpybotDeletingD6224"=-
    "SpybotDeletingB9423"=-
    "SpybotDeletingD2131"=-
    "SpybotDeletingB7754"=-
    "SpybotDeletingD2634"=-
    "SpybotDeletingB2228"=-
    "SpybotDeletingD7815"=-
    "SpybotDeletingB7346"=-
    "SpybotDeletingD624"=-
    "SpybotDeletingB8476"=-
    "SpybotDeletingD1575"=-
    "SpybotDeletingB2550"=-
    "SpybotDeletingD2427"=-
    "SpybotDeletingB7455"=-
    "SpybotDeletingD3418"=-
    "SpybotDeletingB508"=-
    "SpybotDeletingD9445"=-
    "SpybotDeletingB7762"=-
    "SpybotDeletingD9148"=-
    "SpybotDeletingB7301"=-
    "SpybotDeletingD4683"=-
    "SpybotDeletingB8185"=-
    "SpybotDeletingD740"=-
    "SpybotDeletingB2679"=-
    "SpybotDeletingD1267"=-
    "SpybotDeletingB6795"=-
    "SpybotDeletingD1135"=-
    "SpybotDeletingB1601"=-
    "SpybotDeletingD9438"=-
    "SpybotDeletingB2846"=-
    "SpybotDeletingD6250"=-
    "SpybotDeletingB3307"=-
    "SpybotDeletingD6803"=-
    "SpybotDeletingB6987"=-
    "SpybotDeletingD7093"=-
    "SpybotDeletingB8046"=-
    "SpybotDeletingD6774"=-
    "SpybotDeletingB8874"=-
    "SpybotDeletingD2622"=-
    "SpybotDeletingB7238"=-
    "SpybotDeletingD435"=-
    "SpybotDeletingB7597"=-
    "SpybotDeletingD6898"=-
    "SpybotDeletingB5163"=-
    "SpybotDeletingD4377"=-
    "SpybotDeletingB8135"=-
    "SpybotDeletingD9923"=-
    "SpybotDeletingB5428"=-
    "SpybotDeletingD6663"=-
    "SpybotDeletingB109"=-
    "SpybotDeletingD9894"=-
    "SpybotDeletingB7311"=-
    "SpybotDeletingD4639"=-
    "SpybotDeletingB2206"=-
    "SpybotDeletingD2957"=-
    "SpybotDeletingB3477"=-
    "SpybotDeletingD5613"=-
    "SpybotDeletingB1089"=-
    "SpybotDeletingD822"=-
    "SpybotDeletingB8494"=-
    "SpybotDeletingD1443"=-
    "SpybotDeletingB5696"=-
    "SpybotDeletingD9456"=-
    "SpybotDeletingB4903"=-
    "SpybotDeletingD2062"=-
    "SpybotDeletingB9646"=-
    "SpybotDeletingD9463"=-
    "SpybotDeletingB4488"=-
    "SpybotDeletingD9552"=-
    "SpybotDeletingB1631"=-
    "SpybotDeletingD1528"=-
    "SpybotDeletingB9269"=-
    "SpybotDeletingD5851"=-
    "SpybotDeletingB6927"=-
    "SpybotDeletingD1479"=-
    "SpybotDeletingB5402"=-
    "SpybotDeletingD9902"=-
    "SpybotDeletingB6018"=-
    "SpybotDeletingD6622"=-
    "SpybotDeletingB8182"=-
    "SpybotDeletingD320"=-
    "SpybotDeletingB5667"=-
    "SpybotDeletingD6160"=-
    "SpybotDeletingB4625"=-
    "SpybotDeletingD8044"=-
    "SpybotDeletingB2145"=-
    "SpybotDeletingD98"=-
    "SpybotDeletingB9419"=-
    "SpybotDeletingD6531"=-
    "SpybotDeletingB9401"=-
    "SpybotDeletingD5219"=-
    "SpybotDeletingB9179"=-
    "SpybotDeletingD7816"=-
    "SpybotDeletingB8879"=-
    "SpybotDeletingD9631"=-
    "SpybotDeletingB869"=-
    "SpybotDeletingD4699"=-
    "SpybotDeletingB7310"=-
    "SpybotDeletingD319"=-
    "SpybotDeletingB8778"=-
    "SpybotDeletingD1043"=-
    "SpybotDeletingB6479"=-
    "SpybotDeletingD6267"=-
    "SpybotDeletingB6165"=-
    "SpybotDeletingD6889"=-
    "SpybotDeletingB2461"=-
    "SpybotDeletingD8822"=-
    "SpybotDeletingB2988"=-
    "SpybotDeletingD5527"=-
    "SpybotDeletingB4972"=-
    "SpybotDeletingD5669"=-
    "SpybotDeletingB7425"=-
    "SpybotDeletingD5968"=-
    "SpybotDeletingB1050"=-
    "SpybotDeletingD5470"=-
    "SpybotDeletingB3234"=-
    "SpybotDeletingD3742"=-
    "SpybotDeletingB7085"=-
    "SpybotDeletingD9716"=-
    "SpybotDeletingB4530"=-
    "SpybotDeletingD3526"=-
    "SpybotDeletingB2297"=-
    "SpybotDeletingD1053"=-
    "SpybotDeletingB9164"=-
    "SpybotDeletingD309"=-
    "SpybotDeletingB2129"=-
    "SpybotDeletingD2472"=-
    "SpybotDeletingB9508"=-
    "SpybotDeletingD3400"=-
    "SpybotDeletingB5502"=-
    "SpybotDeletingD3499"=-
    "SpybotDeletingB5067"=-
    "SpybotDeletingD4299"=-
    "SpybotDeletingB1751"=-
    "SpybotDeletingD2832"=-
    "SpybotDeletingB5701"=-
    "SpybotDeletingD8033"=-
    "SpybotDeletingB3172"=-
    "SpybotDeletingD7687"=-
    "SpybotDeletingB4909"=-
    "SpybotDeletingD439"=-
    "SpybotDeletingB441"=-
    "SpybotDeletingD1845"=-
    "SpybotDeletingB8142"=-
    "SpybotDeletingD6490"=-
    "SpybotDeletingB4858"=-
    "SpybotDeletingD4829"=-
    "SpybotDeletingB6983"=-
    "SpybotDeletingD9946"=-
    "SpybotDeletingB2190"=-
    "SpybotDeletingD8730"=-
    "SpybotDeletingB1502"=-
    "SpybotDeletingD7407"=-

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Uninstall old Adobe Reader versions and get the latest one (9.4 + 9.4.1 update or Adobe Reader X if offered) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.


    Uninstall vulnerable Flash versions by following instructions here. Fresh version can be obtained here.


    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 Update 23.
    • Click the
      Download
      button to the right.
    • Select Windows on platform combobox and check the box that says:
      Accept License Agreement. Click continue.
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u23-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.



    * Go here to run an online scanner from ESET.
    • Note: You will need to use Internet explorer for this scan
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the activex control to install
    • Click Start
    • Make sure that the option Remove found threats is UNchecked.
    • Click Scan
    • Wait for the scan to finish.


    Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Junior Member
    Join Date
    Feb 2011
    Posts
    19

    Default

    I updated java, adobe, and adobe flash, Here is the combofix logs, yesterday i downloaded avg 2011 free version, I uninstalled it today before running the programs . after running combofix computer did not restart automatically, I tried to go online but every icon I clicked gave the same message, something about item scheduled for deletion, or registry item scheduled for deletion, I cant remember exactly what it said, nothing would work . I restarted computer everything went back to normal. also , I have windows defender disabled(eset warned me to disable defender) so I have no antivirus , malware or spyware running at this time. I am afraid my computer will become infected while I am online without any protection.

    ComboFix 11-01-31.02 - The Sizers 02/04/2011 17:31:56.3.1 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2046.1348 [GMT -6:00]
    Running from: c:\users\The Sizers\Downloads\ComboFix.exe
    Command switches used :: c:\users\The Sizers\Desktop\CFScript.txt
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .

    ((((((((((((((((((((((((( Files Created from 2011-01-04 to 2011-02-04 )))))))))))))))))))))))))))))))
    .

    2011-02-04 23:38 . 2011-02-04 23:39 -------- d-----w- c:\users\The Sizers\AppData\Local\temp
    2011-02-04 23:38 . 2011-02-04 23:38 -------- d-----w- c:\users\Guest\AppData\Local\temp
    2011-02-04 23:38 . 2011-02-04 23:38 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-02-04 01:21 . 2011-02-04 01:21 -------- d-----w- c:\users\The Sizers\AppData\Roaming\AVG10
    2011-02-04 01:19 . 2011-02-04 01:19 -------- d--h--w- c:\programdata\Common Files
    2011-02-04 01:17 . 2011-02-04 23:15 -------- d-----w- c:\programdata\AVG10
    2011-02-04 00:52 . 2011-02-04 01:16 -------- d-----w- c:\programdata\MFAData
    2011-02-03 01:36 . 2011-02-03 01:36 -------- d-----w- c:\program files\ERUNT
    2011-02-02 23:02 . 2011-02-02 23:02 -------- d-----w- c:\windows\Sun
    2011-01-27 01:13 . 2011-01-27 01:13 411368 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-01-27 01:13 . 2011-01-27 01:13 411368 ----a-w- c:\windows\system32\deployJava1.dll
    2011-01-27 01:09 . 2010-11-01 23:03 1448448 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-01-27 01:09 . 2010-11-01 22:59 2381824 ----a-w- c:\windows\system32\mshtml.tlb
    2011-01-26 05:56 . 2010-08-17 23:54 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-01-26 05:56 . 2010-08-17 23:54 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
    2011-01-26 05:56 . 2010-08-17 23:52 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
    2011-01-26 05:56 . 2010-08-17 23:51 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
    2011-01-26 05:56 . 2010-08-17 23:51 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
    2011-01-26 05:56 . 2010-08-17 23:51 302592 ----a-w- c:\windows\system32\mfmp4src.dll
    2011-01-26 05:56 . 2010-08-17 23:49 1174528 ----a-w- c:\windows\system32\d3d10warp.dll
    2011-01-26 05:56 . 2010-08-17 23:49 1068032 ----a-w- c:\windows\system32\DWrite.dll
    2011-01-26 05:56 . 2010-08-17 23:49 797184 ----a-w- c:\windows\system32\FntCache.dll
    2011-01-26 05:56 . 2010-08-17 23:48 161280 ----a-w- c:\windows\system32\d3d10_1.dll
    2011-01-26 05:56 . 2010-08-17 23:48 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
    2011-01-26 05:56 . 2010-08-17 23:50 680960 ----a-w- c:\windows\system32\d2d1.dll
    2011-01-26 05:53 . 2011-01-26 05:53 -------- d-----w- c:\program files\Feedback Tool
    2011-01-26 00:08 . 2011-01-20 16:39 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3FB7F439-FCED-4E67-B642-518F0AB4A977}\mpengine.dll
    2011-01-25 09:01 . 2011-01-25 09:01 -------- d-----w- c:\program files\Microsoft.NET
    2011-01-24 02:24 . 2011-01-24 05:25 -------- d-sh--w- c:\programdata\PIRTS
    2011-01-24 02:22 . 2011-01-25 04:45 -------- d-sh--w- c:\programdata\f08d2b
    2011-01-19 05:12 . 2009-11-08 16:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
    2011-01-19 05:12 . 2009-11-08 16:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
    2011-01-19 05:12 . 2009-11-08 16:55 297808 ----a-w- c:\windows\system32\mscoree.dll
    2011-01-19 05:12 . 2009-11-08 16:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
    2011-01-19 05:12 . 2009-11-08 16:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
    2011-01-19 05:05 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-01-19 05:05 . 2010-09-13 13:56 8147456 ----a-w- c:\windows\system32\wmploc.DLL
    2011-01-19 05:05 . 2010-09-13 13:56 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
    2011-01-19 05:04 . 2010-10-28 13:20 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-01-19 05:02 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2011-01-19 05:01 . 2010-05-27 20:08 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-01-19 05:01 . 2010-08-20 16:05 867328 ----a-w- c:\windows\system32\wmpmde.dll
    2011-01-19 05:01 . 2010-08-26 16:37 157184 ----a-w- c:\windows\system32\t2embed.dll
    2011-01-19 05:01 . 2010-04-05 17:02 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
    2011-01-19 05:01 . 2010-12-14 14:49 1169408 ----a-w- c:\windows\system32\sdclt.exe
    2011-01-19 04:59 . 2010-05-27 20:08 81920 ----a-w- c:\windows\system32\iccvid.dll
    2011-01-19 04:58 . 2010-08-31 15:46 954752 ----a-w- c:\windows\system32\mfc40.dll
    2011-01-19 04:58 . 2010-08-31 15:46 954288 ----a-w- c:\windows\system32\mfc40u.dll
    2011-01-19 04:58 . 2010-10-19 04:27 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll
    2011-01-19 04:58 . 2010-10-18 13:37 81920 ----a-w- c:\windows\system32\consent.exe
    2011-01-19 04:58 . 2010-05-04 19:13 231424 ----a-w- c:\windows\system32\msshsq.dll
    2011-01-19 04:55 . 2010-08-31 15:44 531968 ----a-w- c:\windows\system32\comctl32.dll
    2011-01-06 15:08 . 2011-01-06 15:08 -------- d-----w- c:\program files\iPod
    2011-01-06 15:08 . 2011-01-06 15:08 -------- d-----w- c:\program files\iTunes

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-26 07:06 . 2010-12-26 07:06 749832 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
    2010-12-21 00:09 . 2009-01-31 18:20 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-21 00:08 . 2009-01-31 18:20 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    .

    (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    ---- Directory of c:\programdata\f08d2b ----

    2011-01-24 05:30 . 2011-01-24 06:02 119 ----a-w- c:\programdata\f08d2b\4160fc86a653a494570e0cc1d00803a8.ocx
    2011-01-24 02:54 . 2011-01-24 02:54 95 ----a-w- c:\programdata\f08d2b\1276eaa2910e83e58bb1136d5d16ef73.ocx
    2011-01-24 02:24 . 2011-01-24 02:24 53 ----a-w- c:\programdata\f08d2b\5e7tm9q01u8zkrvov7tm9q01gjvvm9q01u8vop45e7tm9d5e7tm9qw.dll
    2011-01-24 02:24 . 2011-01-24 06:02 4286 ----a-w- c:\programdata\f08d2b\PIS.ico
    2011-01-24 02:24 . 2011-01-24 02:24 73 ----a-w- c:\programdata\f08d2b\f08d2b6f00ed7f828d2c115a033bfe00.ocx
    2011-01-24 02:24 . 2010-05-31 15:33 710104 ----a-w- c:\programdata\f08d2b\mozcrt19.dll
    2011-01-24 02:24 . 2010-05-31 15:33 443352 ----a-w- c:\programdata\f08d2b\sqlite3.dll

    ---- Directory of c:\programdata\PIRTS ----

    2011-01-24 02:24 . 2011-01-24 06:06 26816 --sha-w- c:\programdata\PIRTS\PIIKDPFVS.cfg


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]
    "SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorUser"= 2 (0x2)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
    backup=c:\windows\pss\Kodak EasyShare software.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
    2010-12-14 23:17 47904 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2007-10-15 03:17 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
    2007-10-04 02:02 1783136 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
    2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-12-13 23:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
    2009-03-18 23:50 4363504 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    2008-12-12 18:46 9555968 ----a-w- c:\program files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    2007-12-26 22:34 8530464 ----a-w- c:\windows\System32\nvcpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    2007-12-26 22:34 81920 ----a-w- c:\windows\System32\nvmctray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
    2007-12-26 22:34 86016 ----a-w- c:\windows\System32\nvsvc.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
    2008-04-01 01:54 507904 ----a-w- c:\program files\Winamp Remote\bin\OrbTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro]
    2007-02-15 11:59 118784 ----a-w- c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-11-29 23:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
    2007-08-20 16:58 701736 ----a-w- c:\program files\Registry Mechanic\RMTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
    2008-01-15 16:26 4874240 ----a-w- c:\windows\RtHDVCpl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    2008-02-01 23:22 21898024 ----a-r- c:\program files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    2008-04-01 18:49 36352 ----a-w- c:\program files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 gupdate1c8c2207b568970;Google Update Service (gupdate1c8c2207b568970);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-07 133104]
    R3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\DRIVERS\NwUsbCdFil.sys [2008-07-07 20480]
    R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\DRIVERS\nwusbser2.sys [2008-05-09 174336]
    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
    R3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [2009-03-21 32408]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-04 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-30 17:59]

    2011-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-01-31 05:11]

    2011-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-01-31 05:11]

    2011-02-04 c:\windows\Tasks\User_Feed_Synchronization-{A110AB10-5BD3-45B6-861B-1E9924F1496E}.job
    - c:\windows\system32\msfeedssync.exe [2011-01-26 06:42]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    LSP: c:\windows\system32\wpclsp.dll
    FF - ProfilePath - c:\users\The Sizers\AppData\Roaming\Mozilla\Firefox\Profiles\v4g3d9ua.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-04 17:39
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-1200996304-788045959-2936275167-1000\Software\SecuROM\License information*]
    "datasecu"=hex:d3,c3,a4,62,70,a1,e0,37,50,38,56,f3,dc,94,16,f0,ae,37,4a,ff,b6,
    11,08,42,24,d6,96,6e,7a,4d,dd,2f,f7,71,f0,fa,9e,d4,e2,71,90,36,e9,6c,33,f8,\
    "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

    [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2011-02-04 17:42:04
    ComboFix-quarantined-files.txt 2011-02-04 23:42
    ComboFix2.txt 2011-02-04 00:14
    ComboFix3.txt 2009-01-31 21:03

    Pre-Run: 64,271,339,520 bytes free
    Post-Run: 64,225,792,000 bytes free

    - - End Of File - - 6D3682F61FD52FAD15DE1D014F482EC5


    here is eset log



    C:\ProgramData\Spybot - Search & Destroy\Recovery\WinKoobface1.zip Win32/Bagle.gen.zip worm
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\WinKoobface1.zip Win32/Bagle.gen.zip worm



    here is dds log



    DDS (Ver_10-12-12.02) - NTFSx86
    Run by The Sizers at 20:40:28.20 on Fri 02/04/2011
    Internet Explorer: 9.0.7930.16406 BrowserJavaVersion: 1.6.0_23
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2046.1154 [GMT -6:00]

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\Dwm.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\Explorer.EXE
    C:\Windows\System32\wpcumi.exe
    C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Windows\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\System32\alg.exe
    C:\Windows\system32\wbem\unsecapp.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Users\The Sizers\Downloads\dds.scr
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.yahoo.com/
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe
    mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe" -delete
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
    IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    LSP: c:\windows\system32\wpclsp.dll
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\thesiz~1\appdata\roaming\mozilla\firefox\profiles\v4g3d9ua.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - plugin: c:\program files\download manager\npfpdlm.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\view22\version 3.10.50\NPView22.dll
    FF - plugin: c:\users\the sizers\appdata\roaming\mozilla\firefox\profiles\v4g3d9ua.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07076007.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

    ============= SERVICES / DRIVERS ===============

    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-1-31 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-1-31 55024]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-1-31 1153368]
    R3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-2 21504]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate1c8c2207b568970;Google Update Service (gupdate1c8c2207b568970);c:\program files\google\update\GoogleUpdate.exe [2009-1-31 133104]
    S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2008-7-7 20480]
    S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2008-5-9 174336]
    S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-1-31 7408]
    S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-3-20 32408]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

    =============== Created Last 30 ================

    2011-02-05 00:53:58 -------- d-----w- c:\program files\ESET
    2011-02-04 23:42:06 -------- d-----w- c:\users\thesiz~1\appdata\local\temp
    2011-02-04 23:40:51 -------- d-sh--w- C:\$RECYCLE.BIN
    2011-02-04 01:21:29 -------- d-----w- c:\users\thesiz~1\appdata\roaming\AVG10
    2011-02-04 01:19:26 -------- d--h--w- c:\progra~2\Common Files
    2011-02-04 01:17:23 -------- d-----w- c:\progra~2\AVG10
    2011-02-04 00:52:38 -------- d-----w- c:\progra~2\MFAData
    2011-02-04 00:01:50 89088 ----a-w- c:\windows\MBR.exe
    2011-02-04 00:01:50 256512 ----a-w- c:\windows\PEV.exe
    2011-01-27 01:13:47 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-01-27 01:13:47 472808 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    2011-01-27 01:09:12 2381824 ----a-w- c:\windows\system32\mshtml.tlb
    2011-01-27 01:09:12 1448448 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-01-26 05:56:50 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
    2011-01-26 05:56:50 797184 ----a-w- c:\windows\system32\FntCache.dll
    2011-01-26 05:56:50 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
    2011-01-26 05:56:50 302592 ----a-w- c:\windows\system32\mfmp4src.dll
    2011-01-26 05:56:50 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-01-26 05:56:50 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
    2011-01-26 05:56:50 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
    2011-01-26 05:56:50 161280 ----a-w- c:\windows\system32\d3d10_1.dll
    2011-01-26 05:56:50 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
    2011-01-26 05:56:50 1174528 ----a-w- c:\windows\system32\d3d10warp.dll
    2011-01-26 05:56:50 1068032 ----a-w- c:\windows\system32\DWrite.dll
    2011-01-26 05:56:49 680960 ----a-w- c:\windows\system32\d2d1.dll
    2011-01-26 05:53:32 -------- d-----w- c:\program files\Feedback Tool
    2011-01-26 00:08:37 5890896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{3fb7f439-fced-4e67-b642-518f0ab4a977}\mpengine.dll
    2011-01-24 05:34:44 5890896 ------w- c:\progra~2\microsoft\windows defender\definition updates\updates\mpengine.dll
    2011-01-24 02:24:20 -------- d-sh--w- c:\progra~2\PIRTS
    2011-01-24 02:22:12 -------- d-sh--w- c:\progra~2\f08d2b
    2011-01-19 05:12:39 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
    2011-01-19 05:12:38 49472 ----a-w- c:\windows\system32\netfxperf.dll
    2011-01-19 05:12:38 297808 ----a-w- c:\windows\system32\mscoree.dll
    2011-01-19 05:12:38 295264 ----a-w- c:\windows\system32\PresentationHost.exe
    2011-01-19 05:12:38 1130824 ----a-w- c:\windows\system32\dfshim.dll
    2011-01-19 05:05:24 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-01-19 05:05:05 8147456 ----a-w- c:\windows\system32\wmploc.DLL
    2011-01-19 05:05:05 168960 ----a-w- c:\program files\windows media player\wmplayer.exe
    2011-01-19 05:04:38 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-01-19 05:02:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2011-01-19 05:01:26 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-01-19 05:01:24 867328 ----a-w- c:\windows\system32\wmpmde.dll
    2011-01-19 05:01:22 157184 ----a-w- c:\windows\system32\t2embed.dll
    2011-01-19 05:01:21 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
    2011-01-19 05:01:17 1169408 ----a-w- c:\windows\system32\sdclt.exe
    2011-01-19 04:59:43 81920 ----a-w- c:\windows\system32\iccvid.dll
    2011-01-19 04:58:45 954752 ----a-w- c:\windows\system32\mfc40.dll
    2011-01-19 04:58:45 954288 ----a-w- c:\windows\system32\mfc40u.dll
    2011-01-19 04:58:27 7680 ----a-w- c:\program files\internet explorer\iecompat.dll
    2011-01-19 04:58:26 81920 ----a-w- c:\windows\system32\consent.exe
    2011-01-19 04:58:01 231424 ----a-w- c:\windows\system32\msshsq.dll
    2011-01-19 04:55:04 531968 ----a-w- c:\windows\system32\comctl32.dll
    2011-01-06 15:08:19 -------- d-----w- c:\program files\iPod
    2011-01-06 15:08:14 -------- d-----w- c:\program files\iTunes

    ==================== Find3M ====================

    2010-12-28 15:55:03 413696 ----a-w- c:\windows\system32\odbc32.dll
    2010-11-29 23:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 23:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts

    ============= FINISH: 20:41:11.66 ===============

  6. #6
    Junior Member
    Join Date
    Feb 2011
    Posts
    19

    Default

    computer is working much better but there is still one odd problem that I notice, The outline around boxes on yahoo such as the signin box where you would type your username and some other sites is partly missing,by missing i mean it looks like someone cut the box in half vertically and removed the left half of the outline, its is always the same on affected boxes. problem has occured only since infection. also , the green light around the power button on the computer tower was not coming on but it started working today.

  7. #7
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    there is still one odd problem that I notice, The outline around boxes on yahoo such as the signin box where you would type your username and some other sites is partly missing,by missing i mean it looks like someone cut the box in half vertically and removed the left half of the outline, its is always the same on affected boxes. problem has occured only since infection.
    Does this happen with both Internet Explorer and Firefox?
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  8. #8
    Junior Member
    Join Date
    Feb 2011
    Posts
    19

    Default

    I dont see this problem with firefox.

  9. #9
    Junior Member
    Join Date
    Feb 2011
    Posts
    19

    Default

    I also noticed that after I ran combofix the first time , my computer was faster than it has ever been, but it has slowed down since I ran combofix the second time.

  10. #10
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi again,


    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    Folder::
    c:\programdata\PIRTS
    c:\programdata\f08d2b

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log + fresh dds.txt log.


    Please uninstall IE9 and see how the things are running with IE8 (will be in use after IE9 is uninstalled).
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •