Search Rerouting Malware

ihatemalware · May 5, 2009

Hi,

I have a similar problem to many of the posts I've been reading online. Most of the Google search results that I click on redirects me to a completely random advertising website. I'm running Firefox on XP.

I've ran Symantec anti-virus, Malwarebytes (after renaming the file...) and they found nothing. I downloaded Spybot but it won't open even after renaming the program. I also did Goored that I came across on a couple of threads. Still nothing...

Please help!! Thanks!!

HiJackThis Logfile:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: SnapToolbarHelper Class - {8600AC1E-BE58-4FFC-BD5D-F2A8EC38C838} - C:\Program Files\Snap Visual Search\snapbar.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Snap Visual Search - {EF56413F-9398-4DF5-BC88-6FC3B227D5C5} - C:\Program Files\Snap Visual Search\snapbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 03
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1190488614312
O16 - DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} (CPlayFirstDoggieDashControl Object) - http://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
O23 - Service: Proxim Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Tmesbs32 (Tmesbs) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 10303 bytes

Blade81 · May 6, 2009

Hi

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

BitTorrent DNA

I'd like you to read this thread.

Please go to Control Panel > Add/Remove Programs and uninstall BitTorrent and DNA entries there.

After that:

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
Save both reports to your desktop. Post them back to your topic.

ihatemalware · May 6, 2009

thanks so much for your help! here's the DDS log files:

DDS (Ver_09-03-16.01) - NTFSx86
Run by Katie Dong at 9:43:52.71 on Wed 05/06/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.32 [GMT -4:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\acs.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Katie Dong\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig?hl=en
uSearch Bar = hxxp://www.toshiba.com/search
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Aim6]
mRun: [00THotkey] c:\windows\system32\00THotkey.exe
mRun: [000StTHK] 000StTHK.exe
mRun: [TFNF5] TFNF5.exe
mRun: [Tpwrtray] TPWRTRAY.EXE
mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [TFncKy] TFncKy.exe /Type 03
mRun: [TcmTray]
mRun: [TDispVol] TDispVol.exe
mRun: [TMESBS.EXE] c:\program files\toshiba\tme3\TMESBS32.EXE /Client
mRun: [<NO NAME>]
mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
mRun: [nwiz] nwiz.exe /installquiet
mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [AAWTray] c:\program files\lavasoft\ad-aware 2007\AAWTray.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{4c271126-c295-4828-a901-5910ae0c258b}\Icon3E5562ED7.ico
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190488614312
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\katied~1\applic~1\mozilla\firefox\profiles\p1rsz0ax.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\katie dong\application data\mozilla\firefox\profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [2002-7-25 6082]
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-11-21 192104]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-11-21 169576]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2007-3-14 1816768]
R2 Tmesbs;Tmesbs32;c:\program files\toshiba\tme3\tmesbs32.exe [2002-8-5 77824]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\naveng.sys [2009-4-24 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\navex15.sys [2009-4-24 876144]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2007-3-14 116416]
S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2002-2-7 25420]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

=============== Created Last 30 ================

2009-05-06 09:27 <DIR> --dsh--- c:\documents and settings\katie dong\IETldCache
2009-05-06 09:20 <DIR> --d----- c:\windows\ie8updates
2009-05-06 09:16 <DIR> -cd-h--- c:\windows\ie8
2009-05-06 09:16 105,984 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Shared
2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Incomplete
2009-05-06 09:09 <DIR> --d----- c:\docume~1\katied~1\applic~1\LimeWire
2009-05-06 09:08 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-06 09:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\acccore
2009-05-06 09:03 <DIR> --d----- c:\program files\AIM6
2009-05-05 17:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-05-05 16:57 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-05-05 16:51 <DIR> --d----- c:\program files\Trend Micro
2009-05-05 13:40 <DIR> --d----- c:\docume~1\katied~1\applic~1\Malwarebytes
2009-05-05 13:34 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-05-05 13:34 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-05 13:34 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-05 13:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-16 13:50 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
2009-04-16 13:50 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
2009-04-16 13:50 110,592 -c------ c:\windows\system32\dllcache\services.exe
2009-04-16 13:50 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
2009-04-16 13:50 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 13:50 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 13:50 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 13:50 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
2009-04-16 13:50 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
2009-04-16 13:49 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-16 13:49 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
2009-04-16 13:49 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-04-06 18:12 <DIR> --d----- c:\program files\iPod
2009-04-06 18:11 <DIR> --d----- c:\program files\iTunes
2009-04-06 18:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

==================== Find3M ====================

2009-03-20 14:50 3,358,720 a------- c:\windows\system32\GPhotos.scr
2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-07 19:02 2,066,048 a------- c:\windows\system32\ntkrnlpa.exe
2009-02-06 07:11 110,592 a------- c:\windows\system32\services.exe
2009-02-06 07:08 2,189,056 a------- c:\windows\system32\ntoskrnl.exe
2009-02-06 06:39 35,328 a------- c:\windows\system32\sc.exe
2008-05-07 20:36 39,280 ac------ c:\docume~1\katied~1\applic~1\GDIPFONTCACHEV1.DAT
2008-09-14 14:57 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

============= FINISH: 9:44:42.74 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-03-16.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 9/22/2007 2:12:42 PM
System Uptime: 5/6/2009 9:26:48 AM (0 hours ago)

Motherboard: TOSHIBA | | Portable PC
Processor: Mobile Intel(R) Pentium(R) 4 - M CPU 2.20GHz | uFC-PGA Socket | 2192/100mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 56 GiB total, 29.146 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA

==== System Restore Points ===================

RP306: 2/3/2009 9:20:22 PM - System Checkpoint
RP307: 2/6/2009 1:24:21 PM - System Checkpoint
RP308: 2/7/2009 2:00:43 PM - System Checkpoint
RP309: 2/9/2009 1:53:32 PM - System Checkpoint
RP310: 2/11/2009 3:37:26 PM - System Checkpoint
RP311: 2/12/2009 12:03:34 AM - Software Distribution Service 3.0
RP312: 2/13/2009 3:26:53 PM - System Checkpoint
RP313: 2/14/2009 4:37:47 PM - System Checkpoint
RP314: 2/15/2009 5:21:02 PM - System Checkpoint
RP315: 2/16/2009 6:04:26 PM - System Checkpoint
RP316: 2/18/2009 1:12:09 PM - System Checkpoint
RP317: 2/19/2009 6:48:08 PM - System Checkpoint
RP318: 2/20/2009 7:17:48 PM - System Checkpoint
RP319: 2/21/2009 8:24:22 PM - System Checkpoint
RP320: 2/22/2009 10:08:56 PM - System Checkpoint
RP321: 2/23/2009 10:19:44 PM - System Checkpoint
RP322: 2/25/2009 7:41:31 PM - System Checkpoint
RP323: 2/25/2009 10:34:05 PM - Software Distribution Service 3.0
RP324: 2/27/2009 5:06:43 PM - System Checkpoint
RP325: 2/28/2009 6:39:41 PM - System Checkpoint
RP326: 3/2/2009 11:12:58 AM - System Checkpoint
RP327: 3/3/2009 3:56:11 PM - System Checkpoint
RP328: 3/4/2009 5:32:48 PM - System Checkpoint
RP329: 3/6/2009 1:21:32 PM - System Checkpoint
RP330: 3/7/2009 2:45:53 PM - System Checkpoint
RP331: 3/8/2009 4:35:24 PM - System Checkpoint
RP332: 3/9/2009 4:36:03 PM - System Checkpoint
RP333: 3/10/2009 6:25:58 PM - System Checkpoint
RP334: 3/11/2009 7:53:52 PM - Software Distribution Service 3.0
RP335: 3/13/2009 6:18:22 AM - System Checkpoint
RP336: 3/14/2009 11:56:12 AM - System Checkpoint
RP337: 3/15/2009 5:51:29 PM - System Checkpoint
RP338: 3/16/2009 7:25:54 PM - System Checkpoint
RP339: 3/16/2009 11:25:34 PM - Software Distribution Service 3.0
RP340: 3/18/2009 9:17:11 PM - System Checkpoint
RP341: 3/19/2009 9:58:06 PM - System Checkpoint
RP342: 3/21/2009 1:44:06 PM - System Checkpoint
RP343: 3/22/2009 3:19:09 PM - System Checkpoint
RP344: 3/23/2009 8:36:46 PM - System Checkpoint
RP345: 3/24/2009 9:39:10 PM - System Checkpoint
RP346: 3/25/2009 10:27:27 PM - System Checkpoint
RP347: 3/27/2009 1:28:24 PM - System Checkpoint
RP348: 3/28/2009 8:29:57 PM - System Checkpoint
RP349: 3/30/2009 2:44:09 PM - System Checkpoint
RP350: 3/31/2009 7:18:37 PM - System Checkpoint
RP351: 4/1/2009 8:00:54 PM - System Checkpoint
RP352: 4/2/2009 8:05:08 PM - System Checkpoint
RP353: 4/3/2009 8:42:04 PM - System Checkpoint
RP354: 4/5/2009 3:32:44 PM - System Checkpoint
RP355: 4/6/2009 6:46:03 PM - System Checkpoint
RP356: 4/7/2009 7:38:23 PM - System Checkpoint
RP357: 4/8/2009 8:15:14 PM - System Checkpoint
RP358: 4/10/2009 11:37:39 AM - System Checkpoint
RP359: 4/12/2009 9:27:49 PM - System Checkpoint
RP360: 4/14/2009 9:05:56 PM - System Checkpoint
RP361: 4/15/2009 10:20:35 PM - System Checkpoint
RP362: 4/17/2009 10:13:14 AM - Software Distribution Service 3.0
RP363: 4/18/2009 10:38:04 AM - System Checkpoint
RP364: 4/19/2009 1:52:13 PM - System Checkpoint
RP365: 4/20/2009 1:54:54 PM - System Checkpoint
RP366: 4/21/2009 3:39:20 PM - System Checkpoint
RP367: 4/22/2009 6:29:17 PM - System Checkpoint
RP368: 4/23/2009 10:01:05 PM - System Checkpoint
RP369: 4/24/2009 10:23:38 PM - System Checkpoint
RP370: 4/27/2009 7:58:56 PM - System Checkpoint
RP371: 4/30/2009 4:55:57 PM - System Checkpoint
RP372: 5/1/2009 8:08:38 PM - System Checkpoint
RP373: 5/2/2009 8:57:33 PM - System Checkpoint

==== Installed Programs ======================

Adobe Acrobat 6.0 Professional
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player
Adobe Stock Photos 1.0
AIM 6
Apple Mobile Device Support
Apple Software Update
AutoUpdate
BlitzMail
Bluetooth Stack for Windows by Toshiba
Cisco Systems VPN Client 5.0.03.0530
Comcast High-Speed Internet Install Wizard
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Drag'n Drop CD
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Intel(R) PRO Ethernet Adapter and Software
InterVideo WinDVD 4
iTunes
Java(TM) 6 Update 13
Java(TM) 6 Update 2
LiveReg (Symantec Corporation)
LiveUpdate 3.1 (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft VC9 runtime libraries
Mozilla Firefox (3.0.10)
Network Device Switch 3
NVIDIA Windows 2000/XP Display Drivers
ORiNOCO 802.11 Wireless Client
Picasa 3
QuickTime
RealPlayer
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Spybot - Search & Destroy
Symantec AntiVirus
Synaptics TouchPad
Toshiba Access
TOSHIBA Console
TOSHIBA Controls
Toshiba Hotkey Utility for Display Devices
TOSHIBA MEDIA PLAYER V1.7
TOSHIBA Mobile Extension3 for Windows XP V3.27.00.XP
TOSHIBA Power Saver
TOSHIBA Satellite Demo
TOSHIBA Software Modem
Toshiba Software Upgrades
Toshiba System Stability Program
Toshiba Tbiosdrv Driver
TOSHIBA TouchPad On/Off Utility V2.03.00
TOSHIBA Utilities
Toshiba WinXP Registration
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
Wireless Hotkey
YAMAHA AC-XG WDM

==== Event Viewer Messages From Past Week ========

5/6/2009 9:03:38 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
5/6/2009 9:03:38 AM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\KATIED~1\LOCALS~1\Temp\AIM_69~1.4\imappver.dll. Reference error message: The operation completed successfully. .
5/6/2009 9:03:38 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
5/5/2009 3:58:21 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
5/5/2009 1:42:41 PM, error: E100B [4] - Adapter Intel(R) PRO/100 VE Network Connection: Adapter Link Down
5/5/2009 1:18:44 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip
5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning.
5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/5/2009 1:17:55 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
5/5/2009 1:17:52 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
5/5/2009 1:07:46 PM, error: Service Control Manager [7034] - The Cisco Systems, Inc. VPN Service service terminated unexpectedly. It has done this 1 time(s).
5/4/2009 6:54:13 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
5/4/2009 3:30:21 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
5/3/2009 2:44:42 PM, error: Service Control Manager [7031] - The Symantec AntiVirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

==== End Of File ===========================

Blade81 · May 6, 2009

Hi again,

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds.txt log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

ihatemalware · May 6, 2009

Just finished running combofix, here are the reports you requested. Thanks!!

ComboFix 09-05-05.04 - Katie Dong 05/06/2009 12:28.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.212 [GMT -4:00]
Running from: c:\documents and settings\Katie Dong\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\gxvxchrqaomkkltimrnyqvxenkrjomlwxyuod.sys
c:\windows\system32\drivers\gxvxcxtudjnoejkdaysmkoloaqhgeppppbrsi.sys
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxcktuirqpxexypekyaptgppfsqppyaseun.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gxvxcserv.sys

((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
.

2009-05-06 13:27 . 2009-05-06 13:27 -------- d-sh--w c:\documents and settings\Katie Dong\IETldCache
2009-05-06 13:20 . 2009-05-06 13:20 -------- d-----w c:\windows\ie8updates
2009-05-06 13:16 . 2009-05-06 13:18 -------- dc-h--w c:\windows\ie8
2009-05-06 13:16 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-06 13:10 . 2009-05-06 13:10 -------- d-----w c:\documents and settings\Katie Dong\Shared
2009-05-06 13:10 . 2009-05-06 13:11 -------- d-----w c:\documents and settings\Katie Dong\Incomplete
2009-05-06 13:09 . 2009-05-06 13:10 -------- d-----w c:\documents and settings\Katie Dong\Application Data\LimeWire
2009-05-06 13:08 . 2009-05-06 13:07 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-06 13:05 . 2009-05-06 13:05 -------- d-----w c:\documents and settings\Katie Dong\Application Data\acccore
2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\Katie Dong\Local Settings\Application Data\AOL OCP
2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\Katie Dong\Local Settings\Application Data\AOL
2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\All Users\Application Data\acccore
2009-05-06 13:03 . 2009-05-06 13:04 -------- d-----w c:\program files\AIM6
2009-05-05 21:03 . 2009-05-05 21:38 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-05 20:57 . 2009-05-05 21:24 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-05 20:51 . 2009-05-05 20:51 -------- d-----w c:\program files\Trend Micro
2009-05-05 17:40 . 2009-05-05 17:40 -------- d-----w c:\documents and settings\Katie Dong\Application Data\Malwarebytes
2009-05-05 17:34 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-05 17:34 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-05 17:34 . 2009-05-05 17:34 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-05 17:34 . 2009-05-05 20:05 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-16 17:50 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-16 17:50 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 17:50 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-16 17:50 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 17:50 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 17:50 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 17:50 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 17:50 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 17:50 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 17:49 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-16 17:49 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-06 22:12 . 2009-04-06 22:12 -------- d-----w c:\program files\iPod
2009-04-06 22:11 . 2009-04-06 22:14 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-06 22:11 . 2009-04-06 22:14 -------- d-----w c:\program files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 16:27 . 2007-09-22 22:33 -------- d-----w c:\program files\Symantec AntiVirus
2009-05-06 13:07 . 2007-09-22 21:48 -------- d-----w c:\program files\Java
2009-05-06 13:03 . 2007-09-22 21:17 -------- d-----w c:\program files\Common Files\AOL
2009-04-06 22:12 . 2007-09-22 22:01 -------- d-----w c:\program files\Common Files\Apple
2009-03-23 21:59 . 2007-09-22 22:02 -------- d-----w c:\program files\QuickTime
2009-03-20 18:50 . 2009-03-20 18:50 3358720 ----a-w c:\windows\system32\GPhotos.scr
2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 08:34 . 2002-03-05 16:56 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2002-07-23 23:24 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2002-07-23 23:23 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2002-02-26 21:58 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2002-07-23 23:23 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2002-07-23 23:24 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2002-07-23 23:24 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2002-07-23 23:24 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2002-07-23 23:24 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2002-07-23 23:24 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2002-07-23 23:24 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-09 12:10 . 2002-07-23 23:24 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2007-09-22 19:34 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2002-07-23 23:24 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2002-07-23 23:23 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-07-23 23:25 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2001-08-17 13:48 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2002-07-23 23:24 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 2002-07-23 23:24 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2002-07-23 23:24 35328 ----a-w c:\windows\system32\sc.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"00THotkey"="c:\windows\System32\00THotkey.exe" [2002-04-16 01:35 249856]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-01-23 49152]
"ezShieldProtector for Px"="c:\windows\System32\ezSP_Px.exe" [2002-08-20 40960]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2002-05-31 163840]
"TMESBS.EXE"="c:\program files\TOSHIBA\TME3\TMESBS32.EXE" [2002-08-02 77824]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2002-07-09 126976]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2001-11-14 147456]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-08-16 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-08-16 557056]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-03-15 125632]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-08-18 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-07 185872]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
"000StTHK"="000StTHK.exe" - c:\windows\system32\000StTHK.exe [2001-06-24 03:28 24576]
"TFNF5"="TFNF5.exe" - c:\windows\system32\TFNF5.exe [2002-06-26 73728]
"Tpwrtray"="TPWRTRAY.EXE" - c:\windows\system32\TPWRTRAY.EXE [2002-03-20 217088]
"TFncKy"="TFncKy.exe" [BU]
"TDispVol"="TDispVol.exe" - c:\windows\system32\TDispVol.exe [2002-03-02 98304]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2002-08-15 438272]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-4-7 217190]
VPN Client.lnk - c:\windows\Installer\{4C271126-C295-4828-A901-5910AE0C258B}\Icon3E5562ED7.ico [2008-10-13 6144]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\Blitz\\WinNotif.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [7/25/2002 1:54 PM 6082]
R2 Tmesbs;Tmesbs32;c:\program files\Toshiba\TME3\tmesbs32.exe [8/5/2002 7:10 PM 77824]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/27/2009 9:10 PM 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [3/14/2007 10:48 PM 116416]
S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2/7/2002 7:24 PM 25420]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
HKLM-Run-AAWTray - c:\program files\Lavasoft\Ad-Aware 2007\AAWTray.exe
HKLM-Run-TcmTray - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?hl=en
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
FF - ProfilePath - c:\documents and settings\Katie Dong\Application Data\Mozilla\Firefox\Profiles\p1rsz0ax.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Katie Dong\Application Data\Mozilla\Firefox\Profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 12:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(944)
c:\windows\system32\athgina.dll
c:\windows\system32\athcfg11.dll
c:\windows\system32\athcfg11Res.dll
.
Completion time: 2009-05-06 12:35
ComboFix-quarantined-files.txt 2009-05-06 16:34

Pre-Run: 31,291,203,584 bytes free
Post-Run: 32,754,552,832 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

194 --- E O F --- 2009-04-17 14:22

DDS (Ver_09-03-16.01) - NTFSx86
Run by Katie Dong at 12:41:46.34 on Wed 05/06/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.30 [GMT -4:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\acs.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Katie Dong\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig?hl=en
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [00THotkey] c:\windows\system32\00THotkey.exe
mRun: [000StTHK] 000StTHK.exe
mRun: [TFNF5] TFNF5.exe
mRun: [Tpwrtray] TPWRTRAY.EXE
mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [TFncKy] TFncKy.exe /Type 03
mRun: [TDispVol] TDispVol.exe
mRun: [TMESBS.EXE] c:\program files\toshiba\tme3\TMESBS32.EXE /Client
mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
mRun: [nwiz] nwiz.exe /installquiet
mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{4c271126-c295-4828-a901-5910ae0c258b}\Icon3E5562ED7.ico
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190488614312
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\katied~1\applic~1\mozilla\firefox\profiles\p1rsz0ax.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\katie dong\application data\mozilla\firefox\profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

============= SERVICES / DRIVERS ===============

R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [2002-7-25 6082]
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-11-21 192104]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-11-21 169576]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2007-3-14 1816768]
R2 Tmesbs;Tmesbs32;c:\program files\toshiba\tme3\tmesbs32.exe [2002-8-5 77824]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\naveng.sys [2009-4-24 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\navex15.sys [2009-4-24 876144]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2007-3-14 116416]
S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2002-2-7 25420]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

=============== Created Last 30 ================

2009-05-06 12:16 <DIR> a-dshr-- C:\cmdcons
2009-05-06 12:15 161,792 a------- c:\windows\SWREG.exe
2009-05-06 12:15 98,816 a------- c:\windows\sed.exe
2009-05-06 12:15 <DIR> --d----- C:\ComboFix
2009-05-06 09:27 <DIR> --dsh--- c:\documents and settings\katie dong\IETldCache
2009-05-06 09:20 <DIR> --d----- c:\windows\ie8updates
2009-05-06 09:16 <DIR> -cd-h--- c:\windows\ie8
2009-05-06 09:16 105,984 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Shared
2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Incomplete
2009-05-06 09:09 <DIR> --d----- c:\docume~1\katied~1\applic~1\LimeWire
2009-05-06 09:08 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-06 09:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\acccore
2009-05-06 09:03 <DIR> --d----- c:\program files\AIM6
2009-05-05 17:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-05-05 16:57 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-05-05 16:51 <DIR> --d----- c:\program files\Trend Micro
2009-05-05 13:40 <DIR> --d----- c:\docume~1\katied~1\applic~1\Malwarebytes
2009-05-05 13:34 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-05-05 13:34 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-05 13:34 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-05 13:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-16 13:50 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
2009-04-16 13:50 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
2009-04-16 13:50 110,592 -c------ c:\windows\system32\dllcache\services.exe
2009-04-16 13:50 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
2009-04-16 13:50 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 13:50 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 13:50 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 13:50 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
2009-04-16 13:50 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
2009-04-16 13:49 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-16 13:49 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
2009-04-16 13:49 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-04-06 18:12 <DIR> --d----- c:\program files\iPod
2009-04-06 18:11 <DIR> --d----- c:\program files\iTunes
2009-04-06 18:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

==================== Find3M ====================

2009-03-20 14:50 3,358,720 a------- c:\windows\system32\GPhotos.scr
2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-07 19:02 2,066,048 a------- c:\windows\system32\ntkrnlpa.exe
2009-02-06 07:11 110,592 a------- c:\windows\system32\services.exe
2009-02-06 07:08 2,189,056 a------- c:\windows\system32\ntoskrnl.exe
2009-02-06 06:39 35,328 a------- c:\windows\system32\sc.exe
2008-05-07 20:36 39,280 ac------ c:\docume~1\katied~1\applic~1\GDIPFONTCACHEV1.DAT
2008-09-14 14:57 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

============= FINISH: 12:42:20.83 ===============

ihatemalware · May 6, 2009

hmm i just did some random google searches and clicked around for a bit. haven't been redirected yet... AMAZING!!!!

this may be the happiest day of my life!

Blade81 · May 7, 2009

Good to hear that symptoms are disappearing

However, there're still some steps to take.

Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:

Run Spybot-S&D in Advanced Mode
If it is not already set to do this, go to the Mode menu
select
Advanced Mode
On the left hand side, click on Tools
Then click on the Resident icon in the list
Uncheck
Resident TeaTimer
and OK any prompts.
Restart your computer

Open notepad and copy/paste the text in the quotebox below into it:

Code:

Folder::
c:\documents and settings\Katie Dong\Application Data\LimeWire

DDS::
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=-

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

Uninstall old Adobe Reader versions and get the latest one here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader!

Uninstall Java(TM) 6 Update 2 and Adobe Flash Player 9 ActiveX.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

ihatemalware · May 7, 2009

i got through all the steps except Kaspersky online scanner. i started it before i left home this morning, came back 4 hours later and it was still updating slowly... this computer is old but is generally not that slow and i've pretty fast cable connection... i gave up and stopped it for now. is there a problem...?

Blade81 · May 8, 2009

i got through all the steps except Kaspersky online scanner. i started it before i left home this morning, came back 4 hours later and it was still updating slowly

Hi

Do you mean that it was updating or scanning? Scanning may take quite a long time if there's lots of files on hard drive and if it hasn't been defragmented lately. Antivirus protection running background may also slow down the process.

If it was updating then program should had given some error message if it couldn't connect the server.

If Kaspersky online scanner still doesn't run then let's try ESET online scanner.

* Go here to run an online scanner from ESET.

Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is UNchecked and the option Scan unwanted applications is checkmarked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic, along with other logs requested for in previous post.

ihatemalware · May 8, 2009

kasperksy was still really slow (updating, not scanning), so i ran ESET instead.

here are the logs: ESET, ComboFix, DDS. in that order.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
Language set:1033
# version=3
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.5286
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-05-08 10:23:49
# local_time=2009-05-08 06:23:49 (-0500, Eastern Daylight Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# conflict_mask=8
# scanned=63039
# found=0
# cleaned=0
# scan_time=6174

ComboFix 09-05-06.08 - Katie Dong 05/07/2009 11:44.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.126 [GMT -4:00]
Running from: c:\documents and settings\Katie Dong\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Katie Dong\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Katie Dong\Application Data\LimeWire
c:\documents and settings\Katie Dong\Application Data\LimeWire\414splashfree.png
c:\documents and settings\Katie Dong\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Katie Dong\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Katie Dong\Application Data\LimeWire\gnutella.net
c:\documents and settings\Katie Dong\Application Data\LimeWire\installation.props
c:\documents and settings\Katie Dong\Application Data\LimeWire\library.dat
c:\documents and settings\Katie Dong\Application Data\LimeWire\limewire.props
c:\documents and settings\Katie Dong\Application Data\LimeWire\mojito.props
c:\documents and settings\Katie Dong\Application Data\LimeWire\questions.props
c:\documents and settings\Katie Dong\Application Data\LimeWire\responses.cache
c:\documents and settings\Katie Dong\Application Data\LimeWire\simpp.xml
c:\documents and settings\Katie Dong\Application Data\LimeWire\spam.dat
c:\documents and settings\Katie Dong\Application Data\LimeWire\tables.props
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\logo.png
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\notsearching.png
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\searching.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\splash.png
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\splashpro.png
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\version.xml
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\video.xsd

.
((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.

2009-05-06 16:48 . 2009-05-06 16:48 -------- d-sh--w c:\documents and settings\Katie Dong\PrivacIE
2009-05-06 13:27 . 2009-05-06 13:27 -------- d-sh--w c:\documents and settings\Katie Dong\IETldCache
2009-05-06 13:20 . 2009-05-06 13:20 -------- d-----w c:\windows\ie8updates
2009-05-06 13:16 . 2009-05-06 13:18 -------- dc-h--w c:\windows\ie8
2009-05-06 13:16 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-06 13:10 . 2009-05-06 13:10 -------- d-----w c:\documents and settings\Katie Dong\Shared
2009-05-06 13:10 . 2009-05-06 13:11 -------- d-----w c:\documents and settings\Katie Dong\Incomplete
2009-05-06 13:08 . 2009-05-06 13:07 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-06 13:05 . 2009-05-06 13:05 -------- d-----w c:\documents and settings\Katie Dong\Application Data\acccore
2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\Katie Dong\Local Settings\Application Data\AOL OCP
2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\Katie Dong\Local Settings\Application Data\AOL
2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\All Users\Application Data\acccore
2009-05-06 13:03 . 2009-05-06 13:04 -------- d-----w c:\program files\AIM6
2009-05-05 21:03 . 2009-05-05 21:38 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-05 20:57 . 2009-05-05 21:24 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-05 20:51 . 2009-05-05 20:51 -------- d-----w c:\program files\Trend Micro
2009-05-05 17:40 . 2009-05-05 17:40 -------- d-----w c:\documents and settings\Katie Dong\Application Data\Malwarebytes
2009-05-05 17:34 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-05 17:34 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-05 17:34 . 2009-05-05 17:34 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-05 17:34 . 2009-05-05 20:05 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-16 17:50 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-16 17:50 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 17:50 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-16 17:50 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 17:50 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 17:50 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 17:50 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 17:50 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 17:50 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 17:49 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-16 17:49 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-07 15:42 . 2007-09-22 22:33 -------- d-----w c:\program files\Symantec AntiVirus
2009-05-06 13:07 . 2007-09-22 21:48 -------- d-----w c:\program files\Java
2009-05-06 13:03 . 2007-09-22 21:17 -------- d-----w c:\program files\Common Files\AOL
2009-04-06 22:14 . 2009-04-06 22:11 -------- d-----w c:\program files\iTunes
2009-04-06 22:12 . 2009-04-06 22:12 -------- d-----w c:\program files\iPod
2009-04-06 22:12 . 2007-09-22 22:01 -------- d-----w c:\program files\Common Files\Apple
2009-03-23 21:59 . 2007-09-22 22:02 -------- d-----w c:\program files\QuickTime
2009-03-20 18:50 . 2009-03-20 18:50 3358720 ----a-w c:\windows\system32\GPhotos.scr
2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 08:34 . 2002-03-05 16:56 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2002-07-23 23:24 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2002-07-23 23:23 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2002-02-26 21:58 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2002-07-23 23:23 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2002-07-23 23:24 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2002-07-23 23:24 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2002-07-23 23:24 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2002-07-23 23:24 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2002-07-23 23:24 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2002-07-23 23:24 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-09 12:10 . 2002-07-23 23:24 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2007-09-22 19:34 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2002-07-23 23:24 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2002-07-23 23:23 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-07-23 23:25 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2001-08-17 13:48 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-05-06_16.32.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-07 15:37 . 2009-05-07 15:37 16384 c:\windows\Temp\Perflib_Perfdata_118.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"00THotkey"="c:\windows\System32\00THotkey.exe" [2002-04-16 01:35 249856]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-01-23 49152]
"ezShieldProtector for Px"="c:\windows\System32\ezSP_Px.exe" [2002-08-20 40960]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2002-05-31 163840]
"TMESBS.EXE"="c:\program files\TOSHIBA\TME3\TMESBS32.EXE" [2002-08-02 77824]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2002-07-09 126976]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2001-11-14 147456]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-08-16 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-08-16 557056]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-03-15 125632]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-08-18 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-07 185872]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
"000StTHK"="000StTHK.exe" - c:\windows\system32\000StTHK.exe [2001-06-24 03:28 24576]
"TFNF5"="TFNF5.exe" - c:\windows\system32\TFNF5.exe [2002-06-26 73728]
"TFncKy"="TFncKy.exe" [BU]
"TDispVol"="TDispVol.exe" - c:\windows\system32\TDispVol.exe [2002-03-02 98304]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2002-08-15 438272]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-4-7 217190]
VPN Client.lnk - c:\windows\Installer\{4C271126-C295-4828-A901-5910AE0C258B}\Icon3E5562ED7.ico [2008-10-13 6144]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\Blitz\\WinNotif.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [7/25/2002 1:54 PM 6082]
R2 Tmesbs;Tmesbs32;c:\program files\Toshiba\TME3\tmesbs32.exe [8/5/2002 7:10 PM 77824]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/27/2009 9:10 PM 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [3/14/2007 10:48 PM 116416]
S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2/7/2002 7:24 PM 25420]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?hl=en
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
FF - ProfilePath - c:\documents and settings\Katie Dong\Application Data\Mozilla\Firefox\Profiles\p1rsz0ax.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Katie Dong\Application Data\Mozilla\Firefox\Profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-07 11:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(944)
c:\windows\system32\athgina.dll
c:\windows\system32\athcfg11.dll
c:\windows\system32\athcfg11Res.dll
.
Completion time: 2009-05-07 11:52
ComboFix-quarantined-files.txt 2009-05-07 15:51
ComboFix2.txt 2009-05-06 16:35

Pre-Run: 32,699,383,808 bytes free
Post-Run: 32,698,560,512 bytes free

228 --- E O F --- 2009-04-17 14:22

DDS (Ver_09-03-16.01) - NTFSx86
Run by Katie Dong at 18:31:33.11 on Fri 05/08/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.126 [GMT -4:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\acs.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Katie Dong\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig?hl=en
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [00THotkey] c:\windows\system32\00THotkey.exe
mRun: [000StTHK] 000StTHK.exe
mRun: [TFNF5] TFNF5.exe
mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [TFncKy] TFncKy.exe /Type 03
mRun: [TDispVol] TDispVol.exe
mRun: [TMESBS.EXE] c:\program files\toshiba\tme3\TMESBS32.EXE /Client
mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
mRun: [nwiz] nwiz.exe /installquiet
mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{4c271126-c295-4828-a901-5910ae0c258b}\Icon3E5562ED7.ico
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190488614312
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\katied~1\applic~1\mozilla\firefox\profiles\p1rsz0ax.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\katie dong\application data\mozilla\firefox\profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

============= SERVICES / DRIVERS ===============

R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [2002-7-25 6082]
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\naveng.sys [2009-4-24 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\navex15.sys [2009-4-24 876144]
S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2002-2-7 25420]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

=============== Created Last 30 ================

2009-05-08 16:37 <DIR> --d----- c:\program files\ESET
2009-05-06 12:48 <DIR> --dsh--- c:\documents and settings\katie dong\PrivacIE
2009-05-06 12:16 <DIR> a-dshr-- C:\cmdcons
2009-05-06 12:15 161,792 a------- c:\windows\SWREG.exe
2009-05-06 12:15 98,816 a------- c:\windows\sed.exe
2009-05-06 09:27 <DIR> --dsh--- c:\documents and settings\katie dong\IETldCache
2009-05-06 09:20 <DIR> --d----- c:\windows\ie8updates
2009-05-06 09:16 <DIR> -cd-h--- c:\windows\ie8
2009-05-06 09:16 105,984 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Shared
2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Incomplete
2009-05-06 09:08 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-06 09:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\acccore
2009-05-06 09:03 <DIR> --d----- c:\program files\AIM6
2009-05-05 17:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-05-05 16:57 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-05-05 16:51 <DIR> --d----- c:\program files\Trend Micro
2009-05-05 13:40 <DIR> --d----- c:\docume~1\katied~1\applic~1\Malwarebytes
2009-05-05 13:34 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-05-05 13:34 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-05 13:34 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-05 13:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-16 13:50 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
2009-04-16 13:50 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
2009-04-16 13:50 110,592 -c------ c:\windows\system32\dllcache\services.exe
2009-04-16 13:50 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
2009-04-16 13:50 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 13:50 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 13:50 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 13:50 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
2009-04-16 13:50 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
2009-04-16 13:49 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-16 13:49 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
2009-04-16 13:49 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe

==================== Find3M ====================

2009-03-20 14:50 3,358,720 a------- c:\windows\system32\GPhotos.scr
2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-07 19:02 2,066,048 a------- c:\windows\system32\ntkrnlpa.exe
2008-05-07 20:36 39,280 ac------ c:\docume~1\katied~1\applic~1\GDIPFONTCACHEV1.DAT
2008-09-14 14:57 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

============= FINISH: 18:33:03.43 ===============

Blade81 · May 8, 2009

Looking better now

How's the system running?

Blade81 · May 15, 2009

Due to inactivity, this thread will now be closed.

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.

Search Rerouting Malware

ihatemalware

New member

Blade81

Security Expert: Emeritus

ihatemalware

New member

Blade81

Security Expert: Emeritus

ihatemalware

New member

ihatemalware

New member

Blade81

Security Expert: Emeritus

ihatemalware

New member

Blade81

Security Expert: Emeritus

ihatemalware

New member

Blade81

Security Expert: Emeritus

Blade81

Security Expert: Emeritus