Hijackthis log and other reports... [RESOLVED]

And here is the report from my uninstall list...

Adobe Acrobat 5.0
Adobe Flash Player ActiveX
Adobe Reader 8.1.1
Adobe® Photoshop® Album Starter Edition 3.2
AVG 7.5
AVG Anti-Spyware 7.5
Bluetooth Stack for Windows
BPS PC Internet Firewall Security 1.0.0.2
Companion wizard
EPSON Printer Software
Google Earth
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java™ 6 Update 2
Java™ 6 Update 3
Java™ SE Runtime Environment 6 Update 1
Macrogaming SweetIM 2.0
Macromedia Shockwave Player
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Morpheus 5.5 (remove only)
Motivational Messages Scenic Reflections Screen Saver
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Panda ActiveScan
PaperPort 7.01
PC Connectivity Solution
Realtek AC'97 Audio
Screensavers Installer Version 3
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB946026)
SiS VGA Utilities
Smart Link 56K Modem
Sonic MyDVD
Sonic RecordNow!
SpeedTouch USB Software
SUPERAntiSpyware Free Edition
SweetIM For Internet Explorer 3.0b
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Visioneer 4800 USB
Windows Driver Package - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)
Windows Driver Package - Nokia Modem (02/15/2007 3.1)
Windows Driver Package - Nokia Modem (02/15/2007 3.1)
Windows Driver Package - Nokia Modem (11/03/2006 6.82.0.1)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086

If some1 could please take a look at the reports I have listed, and offer any suggestions on how to get rid of my problem, I would greatly appreciate it

Thanks in advance for any help,

Kath

Hi there and sorry for the delay - I would like a fresh look at your system if I may

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Hello Essexboy, no need to apologise, thankyou for the reply, I appreciate the help. Here are the following reports as requested...

Deckard's System Scanner v20071014.68
Run by kath on 2008-03-04 13:01:00
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
51: 2008-03-04 13:01:08 UTC - RP182 - Deckard's System Scanner Restore Point
50: 2008-02-24 19:58:18 UTC - RP181 - Software Distribution Service 3.0
49: 2008-02-24 17:13:29 UTC - RP180 - Installed SUPERAntiSpyware Free Edition
48: 2008-02-24 15:21:31 UTC - RP179 - Geeks to go
47: 2008-02-19 12:18:14 UTC - RP178 - Removed MSN Messenger 7.5


-- First Restore Point --
1: 2007-07-11 22:56:26 UTC - RP132 - Software Distribution Service 3.0


Backed up registry hives.
Performed disk cleanup.

Percentage of Memory in Use: 81% (more than 75%).
Total Physical Memory: 447 MiB (512 MiB recommended).


-- HijackThis (run as kath.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:03:45, on 04/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\Explorer.EXE
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\ScanSoft\PaperPort\Config\Ereg\REMIND32.EXE
D:\Documents and Settings\kath\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\kath.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh....ar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.imesh....ar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer Provided by Wanadoo
R3 - URLSearchHook: (no name) - {D7CA8119-3A83-4773-A2A8-651342AD6CB1} - C:\WINDOWS\system32\kcqh.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: PaltalkWebLogin - {502C3BA4-2C3E-4317-BC29-C0445E82B1F9} - C:\Program Files\Common Files\Paltalk\PaltalkWebLogin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {D7CA8119-3A83-4773-A2A8-651342AD6CB1} - C:\WINDOWS\system32\kcqh.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] ~"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Henl] "C:\WINDOWS\MANTEC~1\tracert.exe" -vt ndrv
O4 - HKCU\..\Run: [Ppt] C:\Program Files\Common Files\?ecurity\d?dplay.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\DOCUME~1\kath\LOCALS~1\Temp\SSUPDATE.EXE Software\SUPERAntiSpyware.com\SUPERAntiSpyware
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program Files\ScanSoft\PaperPort\Config\Ereg\REMIND32.EXE
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...p1.0.0.15-3.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97F14982-F96E-48E2-B10F-DA7A7648EAD2}: NameServer = 193.36.79.100 193.36.79.101
O20 - AppInit_DLLs:
O20 - Winlogon Notify: winowl32 - winowl32.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 12053 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys
R1 Tosrfcom (Bluetooth RFCOMM from TOSHIBA) - c:\windows\system32\drivers\tosrfcom.sys <Not Verified; TOSHIBA Corporation; Bluetooth RFCOMM Driver>
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>
R3 tosporte (Bluetooth Port Driver from Toshiba) - c:\windows\system32\drivers\tosporte.sys <Not Verified; TOSHIBA Corporation; TOSHIBA Bluetooth Port Emulation Driver>

S0 SiSRaid - c:\windows\system32\drivers\sisraid.sys <Not Verified; Silicon Integrated Systems; SiS 180 Controller>
S1 eeCtrl (Symantec Eraser Control driver) - c:\program files\common files\symantec shared\eengine\eectrl.sys (file missing)
S2 FILESpy - c:\??\c:\program files\bullguard\filespy.sys (file missing)
S3 DrvFltIp - c:\program files\bpspcinternetfirewallsecurity\drvfltip.sys
S3 toshidpt (TOSHIBA Bluetooth HID port driver) - c:\windows\system32\drivers\toshidpt.sys <Not Verified; TOSHIBA Corporation.; TOSHIBA Bluetooth HID Mini Port Driver>
S3 Tosrfbd (Bluetooth RFBUS from TOSHIBA) - c:\windows\system32\drivers\tosrfbd.sys <Not Verified; TOSHIBA CORPORATION; Bluetooth BUS Driver(WindowsXP,Windows2000)>
S3 Tosrfbnp (Bluetooth RFBNEP from TOSHIBA) - c:\windows\system32\drivers\tosrfbnp.sys <Not Verified; TOSHIBA Corporation; Bluetooth RFBNEP Driver from TOSHIBA>
S3 Tosrfhid (Bluetooth RFHID from TOSHIBA) - c:\windows\system32\drivers\tosrfhid.sys <Not Verified; TOSHIBA Corporation.; Bluetooth HID Driver from TOSHIBA>
S3 tosrfnds (Bluetooth Personal Area Network from TOSHIBA) - c:\windows\system32\drivers\tosrfnds.sys <Not Verified; TOSHIBA Corporation.; Bluetooth BNEP Driver from TOSHIBA>
S3 TosRfSnd (Bluetooth Audio Device (WDM) from TOSHIBA) - c:\windows\system32\drivers\tosrfsnd.sys <Not Verified; TOSHIBA Corporation; Bluetooth Audio Driver>
S3 Tosrfusb (Bluetooth USB Controller) - c:\windows\system32\drivers\tosrfusb.sys <Not Verified; TOSHIBA CORPORATION; Bluetooth USB Miniport Driver(Windows2000,WindowsXP)>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 CLCapSvc (CyberLink Background Capture Service (CBCS)) - "c:\apps\powercinema\kernel\tv\clcapsvc.exe" <Not Verified; ; CLCapSvc Module>
R2 CLSched (CyberLink Task Scheduler (CTS)) - "c:\apps\powercinema\kernel\tv\clsched.exe" <Not Verified; ; CLSched Module>
R2 CyberLink Media Library Service - "c:\program files\cyberlink\shared files\clml_ntservice\clmlserver.exe" <Not Verified; Cyberlink; Cyberlink Media Library Server>
R2 EPSONStatusAgent2 (EPSON Printer Status Agent2) - c:\program files\common files\epson\ebapi\sagent2.exe <Not Verified; SEIKO EPSON CORPORATION; EPSON Bidirectional Printer>
R2 GenericHidService (Generic Service for HID Keyboard Input Collections) - c:\apps\hidservice\hidservice.exe

S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2008-02-04 and 2008-03-04 -----------------------------

2008-03-04 13:00:27 0 d-------- D:\Deckard
2008-02-26 15:55:05 0 d-------- D:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-24 20:12:32 0 d-------- C:\Program Files\Trend Micro
2008-02-24 19:03:32 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-02-24 17:14:13 0 d-------- D:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-24 17:13:35 0 d-------- D:\Documents and Settings\kath\Application Data\SUPERAntiSpyware.com
2008-02-24 17:13:35 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-02-24 17:12:04 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-24 15:34:42 0 d-------- D:\Documents and Settings\Administrator\Application Data\Grisoft
2008-02-24 15:33:15 0 dr------- D:\Documents and Settings\Administrator\Favorites
2008-02-24 15:33:15 0 dr------- D:\Documents and Settings\Administrator\Desktop
2008-02-24 15:33:15 0 d--hs---- D:\Documents and Settings\Administrator\Cookies
2008-02-24 15:33:15 0 dr-h----- D:\Documents and Settings\Administrator\Application Data
2008-02-24 15:33:15 0 d-------- D:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-02-24 15:33:15 0 d-------- D:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-24 15:33:15 0 d-------- D:\Documents and Settings\Administrator\Application Data\Real
2008-02-24 15:33:15 0 d---s---- D:\Documents and Settings\Administrator\Application Data\Microsoft
2008-02-24 15:33:15 0 d-------- D:\Documents and Settings\Administrator\Application Data\Macromedia
2008-02-24 15:33:15 0 d-------- D:\Documents and Settings\Administrator\Application Data\Identities
2008-02-24 15:33:15 0 d-------- D:\Documents and Settings\Administrator\Application Data\AOL
2008-02-24 15:33:14 0 d--h----- D:\Documents and Settings\Administrator\Templates
2008-02-24 15:33:14 0 dr------- D:\Documents and Settings\Administrator\Start Menu
2008-02-24 15:33:14 0 dr-h----- D:\Documents and Settings\Administrator\SendTo
2008-02-24 15:33:14 0 dr-h----- D:\Documents and Settings\Administrator\Recent
2008-02-24 15:33:14 0 d--h----- D:\Documents and Settings\Administrator\PrintHood
2008-02-24 15:33:14 0 d--h----- D:\Documents and Settings\Administrator\NetHood
2008-02-24 15:33:14 0 dr------- D:\Documents and Settings\Administrator\My Documents
2008-02-24 15:33:14 0 d--h----- D:\Documents and Settings\Administrator\Local Settings
2008-02-24 15:33:13 786432 --ah----- D:\Documents and Settings\Administrator\NTUSER.DAT
2008-02-24 15:25:37 0 d-------- D:\Documents and Settings\kath\Application Data\Grisoft
2008-02-12 16:32:09 0 d-------- D:\Documents and Settings\LocalService.NT AUTHORITY.001\Application Data\AVG7
2008-02-12 16:32:03 0 d-------- D:\Documents and Settings\kath\Application Data\HbTools
2008-02-12 16:31:10 0 d-------- C:\Program Files\filesubmit
2008-02-12 15:42:48 708608 --a------ D:\Documents and Settings\NetworkService.NT AUTHORITY.001\ntuser.dat
2008-02-12 15:42:48 708608 --a------ D:\Documents and Settings\LocalService.NT AUTHORITY.001\ntuser.dat
2008-02-12 15:42:48 4059136 --a------ D:\Documents and Settings\kath\ntuser.dat


-- Find3M Report ---------------------------------------------------------------

2008-02-27 17:37:41 0 d-------- D:\Documents and Settings\kath\Application Data\Yahoo!
2008-02-26 15:52:39 0 d-------- C:\Program Files\Common Files\Adobe
2008-02-26 15:45:33 0 d-------- C:\Program Files\Yahoo!
2008-02-24 19:25:01 0 d-------- C:\Program Files\Common Files\Paltalk
2008-02-24 18:52:58 0 d-------- C:\Program Files\Common Files
2008-02-24 17:04:40 0 d-------- C:\Program Files\Common Files\?ecurity
2008-02-12 16:31:10 0 d-------- C:\Program Files\Morpheus
2008-02-12 15:50:32 0 d-------- D:\Documents and Settings\kath\Application Data\AVG7
2008-01-31 21:47:05 0 d-------- D:\Documents and Settings\kath\Application Data\Adobe
2008-01-30 23:18:49 0 d-------- C:\Program Files\Macrogaming


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D7CA8119-3A83-4773-A2A8-651342AD6CB1}]
C:\WINDOWS\system32\kcqh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [04/08/2004 14:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [04/08/2004 14:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [04/08/2004 14:00]
"SoundMan"="SOUNDMAN.EXE" [20/01/2005 20:04 C:\WINDOWS\SOUNDMAN.EXE]
"SiSPower"="SiSPower.dll" [04/01/2005 16:54 C:\WINDOWS\system32\SiSPower.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 00:11]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [26/11/2004 11:43]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [11/05/2005 13:48]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02/12/2005 01:08]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [26/01/2004 11:38]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [31/01/2008 21:35]
"Pando"="C:\Program Files\Pando Networks\Pando\Pando.exe" []
"@"="" []
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [27/12/2006 16:53]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [09/03/2007 10:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 19:51]
"BluetoothAuthenticationAgent"="bthprops.cpl" [04/08/2004 14:00 C:\WINDOWS\system32\bthprops.cpl]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11/06/2007 09:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="~C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13/10/2004 16:24]
"Henl"="C:\WINDOWS\MANTEC~1\tracert.exe" []
"Ppt"="C:\Program Files\Common Files\?ecurity\d?dplay.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 14:00]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [27/12/2006 16:53]
"PPWebCap"="C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe" [17/05/2001 10:21]
"SUPERAntiSpyware"="D:\DOCUME~1\kath\LOCALS~1\Temp\SSUPDATE.exe" []

D:\Documents and Settings\kath\Start Menu\Programs\Startup\
reminder-ScanSoft Product Registration.lnk - C:\Program Files\ScanSoft\PaperPort\Config\Ereg\REMIND32.EXE [08/05/2007 13:27:39]

D:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [21/12/2004 19:42:22]
EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [18/01/2006 17:33:59]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [02/12/2005 00:51:43]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20/12/2006 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winowl32]
winowl32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Modem Booster]
C:\Program Files\inKline Global\Modem Booster\ModemBtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster]
C:\Program Files\inKline Global\PC Booster\pcbooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ




-- End of Deckard's System Scanner: finished at 2008-03-04 13:04:45 ------------


Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 2.93GHz
Percentage of Memory in Use: 79%
Physical Memory (total/avail): 446.73 MiB / 90.57 MiB
Pagefile Memory (total/avail): 1050.96 MiB / 668.22 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1922.45 MiB

C: is Fixed (NTFS) - 29.99 GiB total, 21.55 GiB free.
D: is Fixed (NTFS) - 111.24 GiB total, 108.71 GiB free.
E: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST3160021A - 149.05 GiB - 3 partitions
\PARTITION0 - Unknown - 7.81 GiB
\PARTITION1 (bootable) - Installable File System - 29.99 GiB - C:
\PARTITION2 - Installable File System - 111.24 GiB - D:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.
AntivirusOverride is set.
FirewallOverride is set.

FW: BullGuard v4.5 v7.2 (Softwin) Disabled
AV: BullGuard v4.5 v7.2 (Softwin) Disabled Outdated
AV: AVG 7.5.516 v7.5.516 (Grisoft)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"="%ProgramFiles%\\AOL 9.0\\aol.exe:*:Enabled:AOL"
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:PANDORA"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"D:\\StubInstaller.exe"="D:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\WinAntiVirus Pro 2006\\Updater.exe"="C:\\Program Files\\WinAntiVirus Pro 2006\\Updater.exe:*:Enabled:updater.exe"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=D:\Documents and Settings\All Users
APPDATA=D:\Documents and Settings\kath\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=SN049651320328
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=D:
HOMEPATH=\Documents and Settings\kath
LOGONSERVER=\\SN049651320328
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\PROGRAM FILES\COMMON FILES\ULEAD SYSTEMS\MPEG;C:\PROGRA~1\COMMON~1\SONICS~1\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0401
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=D:\DOCUME~1\kath\LOCALS~1\Temp
TMP=D:\DOCUME~1\kath\LOCALS~1\Temp
USERDOMAIN=SN049651320328
USERNAME=kath
USERPROFILE=D:\Documents and Settings\kath
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI


-- User Profiles ---------------------------------------------------------------

kath (admin)
Administrator (new local, admin)


-- Add/Remove Programs ---------------------------------------------------------

--> "c:\apps\skype\phone\unins000.exe"
--> "C:\Program Files\Common Files\aolshare\Coach\AolCInUn.exe" -lang="en-uk"
--> C:\PROGRA~1\COMMON~1\AOL\ACS\AcsUninstall.exe /c
--> C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\UNWISE.EXE C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\INSTALL.LOG
--> C:\Program Files\Common Files\AOL\Screensaver\uninst_ygpss.exe
--> C:\Program Files\Common Files\aolshare\Aolunins_uk.exe
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\Program Files\Learn2.com\StRunner\stuninst.exe
--> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
--> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
--> C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
--> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
--> msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
--> MsiExec.exe /I{8B543A39-9401-44F4-B572-069E64C15189}
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.EXE" -uninstall
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F9CFBD8-8F77-4DCD-8CB5-CDD5F653C872}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4F1DA6BF-3614-48A1-9970-9E90F646789E}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5A065EA0-0EEC-4E94-A2A0-40812576C122}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E06E4F4E-72D6-4497-BFFD-BCB43077C2F4}\Setup.exe" -l0x9 -uninst
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5AFA4872-16B2-419E-ADCA-8E96E739115D}\setup.exe" -l0x9
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Adobe® Photoshop® Album Starter Edition 3.2 --> MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
Bluetooth Stack for Windows --> MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
BPS PC Internet Firewall Security 1.0.0.2 --> "C:\Program Files\BPSPCInternetFirewallSecurity\unins000.exe"
Companion wizard --> C:\Program Files\Common Files\Companion Wizard\compwiz.exe -u
EPSON Printer Software --> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
Google Earth --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9 -removeonly
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
J2SE Runtime Environment 5.0 Update 10 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150020}
J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Java™ 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java™ 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Macrogaming SweetIM 2.0 --> MsiExec.exe /X{D9BBFA60-4514-4F08-A78F-91957F957495}
Macromedia Shockwave Player --> MsiExec.exe /X{7D1D6A24-65D4-454C-8815-4F08A5FFF12C}
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works --> MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}
Morpheus 5.5 (remove only) --> "C:\Program Files\Morpheus\UninstMorpheus.exe"
Motivational Messages Scenic Reflections Screen Saver --> sstunst3.exe Motivational Messages Scenic Reflections
MSN --> C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
Panda ActiveScan --> C:\WINDOWS\system32\ASUninst.exe Panda ActiveScan
PaperPort 7.01 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ScanSoft\PaperPort\Config\DeIsL1.isu" -y -c"C:\Program Files\ScanSoft\PaperPort\UnInstl2.dll"
PC Connectivity Solution --> MsiExec.exe /I{99A40651-0BC2-4095-8F9A-A40FAB224FEF}
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Screensavers Installer Version 3 --> "C:\Program Files\Screensavers.com\SSSUninst.exe"
Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
SiS VGA Utilities --> Rundll32 SiSInst.dll,Uninstall VGA,R,oem3.inf
Smart Link 56K Modem --> C:\WINDOWS\Modio\SLAMR2KO\Setup.exe /Remove
Sonic MyDVD --> MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow! --> MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
SpeedTouch USB Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}\Setup.exe" /l0009 -Control_Panel
SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
SweetIM For Internet Explorer 3.0b --> MsiExec.exe /X{F6D63A65-BD23-46F3-B9A3-87F442423481}
Visioneer 4800 USB --> C:\WINDOWS\twain_32\VIZSCAN\4800\UNWISE.EXE C:\WINDOWS\twain_32\VIZSCAN\4800\INSTALL.LOG
Windows Driver Package - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccswpddri_044C8712DB44F83D9DE6C376991EE9254E0A69E4\pccswpddriver.inf
Windows Driver Package - Nokia Modem (02/15/2007 3.1) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccs_bluet_F12A08B6F776984A95553486F64C541356F86E38\pccs_bluetooth.inf
Windows Driver Package - Nokia Modem (02/15/2007 3.1) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccs_bluet_8B37DC72918CCD58A6EC20373AF6242B037A293B\pccs_bluetooth.inf
Windows Driver Package - Nokia Modem (11/03/2006 6.82.0.1) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_4EFFAAE27A08EDFDE145390033D8EF099DA65567\nokbtmdm.inf
Windows Media Encoder 9 Series --> MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Yahoo! Browser Services --> C:\PROGRA~1\Yahoo!\Common\UNIN_Y~1.EXE /S
Yahoo! Toolbar --> C:\PROGRA~1\Yahoo!\Common\unyt.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type12886 / Error
Event Submitted/Written: 02/28/2008 06:15:25 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application Iedit.exe, version 10.0.3.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type12683 / Error
Event Submitted/Written: 02/10/2008 09:45:20 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application Iedit.exe, version 10.0.3.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type12659 / Error
Event Submitted/Written: 02/07/2008 10:00:49 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application wmplayer.exe, version 11.0.5721.5145, faulting module wininet.dll, version 7.0.6000.16574, fault address 0x00064933.
Processing media-specific event for [wmplayer.exe!ws!]

Event Record #/Type12628 / Error
Event Submitted/Written: 02/03/2008 09:33:30 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type12627 / Error
Event Submitted/Written: 02/03/2008 09:32:03 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application wmplayer.exe, version 11.0.5721.5145, faulting module wininet.dll, version 7.0.6000.16574, fault address 0x00064933.
Processing media-specific event for [wmplayer.exe!ws!]



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type35537 / Error
Event Submitted/Written: 03/04/2008 01:03:57 PM
Event ID/Source: 7016 / Service Control Manager
Event Description:
The SmartLinkService service has reported an invalid current state 0.

Event Record #/Type35521 / Error
Event Submitted/Written: 03/04/2008 00:53:19 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
The following boot-start or system-start driver(s) failed to load:
eeCtrl

Event Record #/Type35520 / Error
Event Submitted/Written: 03/04/2008 00:53:19 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The FILESpy service failed to start due to the following error:
%%123

Event Record #/Type35501 / Error
Event Submitted/Written: 03/03/2008 06:14:04 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
The following boot-start or system-start driver(s) failed to load:
eeCtrl

Event Record #/Type35500 / Error
Event Submitted/Written: 03/03/2008 06:14:04 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The FILESpy service failed to start due to the following error:
%%123



-- End of Deckard's System Scanner: finished at 2008-03-04 13:04:45 ------------

Hi again a nice little mixture there - so to work

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R3 - URLSearchHook: (no name) - {D7CA8119-3A83-4773-A2A8-651342AD6CB1} - C:\WINDOWS\system32\kcqh.dll (file missing)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {D7CA8119-3A83-4773-A2A8-651342AD6CB1} - C:\WINDOWS\system32\kcqh.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKCU\..\Run: [Henl] "C:\WINDOWS\MANTEC~1\tracert.exe" -vt ndrv
O4 - HKCU\..\Run: [Ppt] C:\Program Files\Common Files\?ecurity\d?dplay.exe
O20 - Winlogon Notify: winowl32 - winowl32.dll (file missing)

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java™ 6 Update 2
Java™ SE Runtime Environment 6 Update 1

Please note any other programs that you dont recognize in that list in your next response

THEN

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  Purity

• Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

FINALLY FOR NOW

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Logs required : OTMoveit and Combofix

Hello again Essexboy, my apologies for the delay, thankyou for the continued help.

Here are the following reports as requested...

[Custom Input]
< Purity >
C:\WINDOWS\Αdobe\Αdobe moved successfully.
Folder move failed. C:\WINDOWS\Αdobe scheduled to be moved on reboot.
C:\WINDOWS\Fοnts moved successfully.
C:\WINDOWS\Ѕуmantec\Ѕуmantec moved successfully.
C:\WINDOWS\Ѕуmantec moved successfully.
C:\Program Files\Common Files\ѕecurity moved successfully.
C:\Program Files\Common Files\ѕystem32 moved successfully.
D:\Documents and Settings\kath\My Documents\Fοnts moved successfully.
D:\Documents and Settings\kath\My Documents\Fоnts moved successfully.
D:\Documents and Settings\kath\Application Data\sеcurity moved successfully.
D:\Documents and Settings\kath\Application Data\ѕystem32 moved successfully.

OTMoveIt2 v1.0.20 log created on 03062008_134544


ComboFix 08-03-05.3 - kath 2008-03-06 13:58:46.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.139 [GMT 0:00]
Running from: D:\Documents and Settings\kath\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\compwiz.exe
C:\Program Files\Common Files\companion wizard\log.txt
C:\WA6P
C:\WINDOWS\dobe~1
C:\WINDOWS\dobe~1\csrss.exe
C:\WINDOWS\system32\stera.log
D:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006
D:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006\AVScheduler.dat
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\2876150.sdf
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\ASPL1.dat
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\domains.txt
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\hstat\33d7.dat
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\12457
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\251440
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\27060
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\44229
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\44878
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\95704
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\dynamic\ustat\33d7.dat
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\ads.cdf
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\btntrans.idx
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\btntrans1.dat
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\business_promo.htm
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\buttondir.txt
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\components.cdf
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_1000.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_2000.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_3000.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bar.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bbar1.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_logos.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_other.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_weather.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\default.cdf
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_511745-514279.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz1.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz10.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz11.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz12.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz13.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz14.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz15.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz16.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz17.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz18.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz19.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz2.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz20.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz3.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz4.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz5.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz6.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz7.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz8.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz9.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_categorize.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_comparison.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_em_PROFL_CA_flow_b_IEB.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_explorer-Mails.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_explorer-people.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_favorites.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_Games.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_Hide.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_hotbarcom.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_Hotmail.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_hsskin.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_jemster.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_jemsterie.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_jemsteruk.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_jobsearch.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_Mails.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_new.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_premium.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_reun.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_ringtones.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_SearchBoxTrapper.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_searchfor.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_searchgo.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_weather.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Default_yellowpages.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\email-def-511724-548964.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\email-def-511724-9595.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\email-t1-bg.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\hotbar-premium-hotbar-premium.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\hotbar-premium.cdf
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\hotbar_promo.htm
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\icons2.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\keywords.idx
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\keywords1.dat
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\layout.cdf
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\linkpathlegal.txt
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\progress.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\s_icons_buttons.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\sales_buttons.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\t2_bg.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\theweb.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\top7.cdf
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\Top7_theweb.mnu
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\1\tsd_bg.res
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\ads.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans1.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\business_promo.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\buttondir.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\country.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_1000.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_2000.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_3000.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bar.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bbar1.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_logos.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_other.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_weather.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\default.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\email-t1-bg.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\hotbar-premium.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\hotbar_promo.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\icons2.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\keywords.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\keywords1.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\layout.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\linkpathlegal.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\progress.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\s_icons_buttons.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\sales_buttons.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\samplegroups2.txt
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\samplegroups2.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\t2_bg.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\top7.xip
D:\Documents and Settings\kath.SN049651320328\Application Data\HbTools\v3.0\HbTools\static\DownLoad\tsd_bg.xip
D:\Documents and Settings\kath\Application Data\HbTools
D:\Documents and Settings\kath\err.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FOPN


((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 )))))))))))))))))))))))))))))))
.

2008-02-26 15:55 . 2008-02-26 15:55 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-24 20:12 . 2008-02-24 20:12 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-24 19:03 . 2008-02-24 19:42 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-24 19:03 . 2008-02-24 19:03 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-24 19:03 . 2008-02-24 19:03 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-24 19:03 . 2008-02-24 19:03 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-24 17:14 . 2008-02-24 17:14 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-24 17:13 . 2008-02-24 17:13 <DIR> d-------- D:\Documents and Settings\kath\Application Data\SUPERAntiSpyware.com
2008-02-24 17:13 . 2008-03-04 12:55 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-24 17:12 . 2008-02-24 17:12 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-24 15:34 . 2008-02-24 15:34 <DIR> d-------- D:\Documents and Settings\Administrator\Application Data\Grisoft
2008-02-24 15:33 . 2005-12-02 01:02 <DIR> d-------- D:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-02-24 15:33 . 2005-12-02 01:04 <DIR> d-------- D:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-24 15:33 . 2005-12-02 01:16 <DIR> d-------- D:\Documents and Settings\Administrator\Application Data\AOL
2008-02-24 15:25 . 2008-02-24 15:25 <DIR> d-------- D:\Documents and Settings\kath\Application Data\Grisoft
2008-02-24 15:25 . 2007-05-30 12:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-12 16:32 . 2008-02-12 16:32 <DIR> d-------- D:\Documents and Settings\LocalService.NT AUTHORITY.001\Application Data\AVG7
2008-02-12 16:31 . 2008-02-12 16:31 <DIR> d-------- C:\Program Files\filesubmit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-06 13:39 --------- d-----w C:\Program Files\Java
2008-02-27 17:37 --------- d-----w D:\Documents and Settings\kath\Application Data\Yahoo!
2008-02-26 15:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-26 15:45 --------- d-----w D:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-26 15:45 --------- d-----w C:\Program Files\Yahoo!
2008-02-24 19:25 --------- d-----w C:\Program Files\Common Files\Paltalk
2008-02-12 16:31 --------- d-----w C:\Program Files\Morpheus
2008-02-12 15:50 --------- d-----w D:\Documents and Settings\kath\Application Data\AVG7
2008-01-30 23:34 --------- d-----w D:\Documents and Settings\All Users\Application Data\avg7
2008-01-30 23:18 --------- d-----w C:\Program Files\Macrogaming
2006-07-17 11:37 0 ----a-w D:\Documents and Settings\kath\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="~C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 16:53 73840]
"PPWebCap"="C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe" [2001-05-17 10:21 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 14:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"SoundMan"="SOUNDMAN.EXE" [2005-01-20 20:04 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SiSPower"="SiSPower.dll" [2005-01-04 16:54 49152 C:\WINDOWS\system32\SiSPower.dll]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 11:43 90112]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-05-11 13:48 127118]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-12-02 01:08 180269]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-31 21:35 579072]
"Pando"="C:\Program Files\Pando Networks\Pando\Pando.exe" [ ]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 16:53 73840]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [ ]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-18 20:50 219136]

D:\Documents and Settings\kath\Start Menu\Programs\Startup\
reminder-ScanSoft Product Registration.lnk - C:\Program Files\ScanSoft\PaperPort\Config\Ereg\REMIND32.EXE [2007-05-08 13:27:39 45056]

D:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-21 19:42:22 45056]
EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2006-01-18 17:33:59 128000]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-12-02 00:51:43 331776]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Modem Booster]
C:\Program Files\inKline Global\Modem Booster\ModemBtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 16:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster]
C:\Program Files\inKline Global\PC Booster\pcbooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\StubInstaller.exe"=

R2 UMAXPCLS;Print Port Scanner Driver;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys [2001-08-17 12:58]
S2 FILESpy;FILESpy;C:C:\Program Files\BullGuard\filespy.sys []
S3 DrvFltIp;DrvFltIp;C:\Program Files\BPSPCInternetFirewallSecurity\DrvFltIp.sys [2003-07-08 15:20]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-06 14:04:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-03-06 14:07:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-06 14:07:37
.
2008-02-14 00:01:25 --- E O F ---

No problems on the timing - just a little to go now by the looks of it

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
D:\StubInstaller.exe

3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

THEN

To clear the orphans

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Logas required : Combofix and MBAM plus how is your system running now

Hi again Essexboy, today I have done all the things u suggested. I then tried to install yahoo messenger, and unfortunately I am still getting the error message, and I am unable to run the program. I really do not know what else to do. I thank you very much for all your help, it is greatly appreciated.

Here are the reports as requested in your previous post...

I really dont know if there is anything else that we can try, but if there is anything else that you could possibly think of that may be able to resolve this problem I would massively appreciate any more suggestions.

Thankyou again for all your help up to now...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:35:34, on 10/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\ScanSoft\PaperPort\Config\Ereg\REMIND32.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: PaltalkWebLogin - {502C3BA4-2C3E-4317-BC29-C0445E82B1F9} - C:\Program Files\Common Files\Paltalk\PaltalkWebLogin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program Files\ScanSoft\PaperPort\Config\Ereg\REMIND32.EXE
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com...obat/nos/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97F14982-F96E-48E2-B10F-DA7A7648EAD2}: NameServer = 193.36.79.100 193.36.79.101
O20 - AppInit_DLLs:
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 10219 bytes

ComboFix 08-03-05.3 - kath 2008-03-10 21:11:37.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.94 [GMT 0:00]
Running from: D:\Documents and Settings\kath\Desktop\ComboFix.exe
Command switches used :: D:\Documents and Settings\kath\Desktop\CFScript.txt
* Created a new restore point

FILE ::
D:\StubInstaller.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\StubInstaller.exe

.
((((((((((((((((((((((((( Files Created from 2008-02-10 to 2008-03-10 )))))))))))))))))))))))))))))))
.

2008-03-10 21:09 . 2008-03-10 21:09 0 --a------ D:\Documents and Settings\kath\.exe
2008-02-26 15:55 . 2008-02-26 15:55 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-24 20:12 . 2008-02-24 20:12 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-24 19:03 . 2008-02-24 19:42 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-24 19:03 . 2008-02-24 19:03 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-24 19:03 . 2008-02-24 19:03 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-24 19:03 . 2008-02-24 19:03 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-24 17:14 . 2008-02-24 17:14 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-24 17:13 . 2008-02-24 17:13 <DIR> d-------- D:\Documents and Settings\kath\Application Data\SUPERAntiSpyware.com
2008-02-24 17:13 . 2008-03-04 12:55 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-24 17:12 . 2008-02-24 17:12 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-24 15:34 . 2008-02-24 15:34 <DIR> d-------- D:\Documents and Settings\Administrator\Application Data\Grisoft
2008-02-24 15:33 . 2005-12-02 01:02 <DIR> d-------- D:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-02-24 15:33 . 2005-12-02 01:04 <DIR> d-------- D:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-24 15:33 . 2005-12-02 01:16 <DIR> d-------- D:\Documents and Settings\Administrator\Application Data\AOL
2008-02-24 15:25 . 2008-02-24 15:25 <DIR> d-------- D:\Documents and Settings\kath\Application Data\Grisoft
2008-02-24 15:25 . 2007-05-30 12:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-12 16:32 . 2008-02-12 16:32 <DIR> d-------- D:\Documents and Settings\LocalService.NT AUTHORITY.001\Application Data\AVG7
2008-02-12 16:31 . 2008-02-12 16:31 <DIR> d-------- C:\Program Files\filesubmit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-10 21:09 0 ----a-w D:\Documents and Settings\kath\.exe
2008-03-07 21:06 --------- d-----w D:\Documents and Settings\All Users\Application Data\avg7
2008-03-06 13:39 --------- d-----w C:\Program Files\Java
2008-02-27 17:37 --------- d-----w D:\Documents and Settings\kath\Application Data\Yahoo!
2008-02-26 15:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-26 15:45 --------- d-----w D:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-26 15:45 --------- d-----w C:\Program Files\Yahoo!
2008-02-24 19:25 --------- d-----w C:\Program Files\Common Files\Paltalk
2008-02-12 16:31 --------- d-----w C:\Program Files\Morpheus
2008-02-12 15:50 --------- d-----w D:\Documents and Settings\kath\Application Data\AVG7
2008-01-30 23:18 --------- d-----w C:\Program Files\Macrogaming
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2006-07-17 11:37 0 ----a-w D:\Documents and Settings\kath\Application Data\wklnhst.dat
2001-06-27 07:09 61,440 ----a-w C:\WINDOWS\inf\i386\onetUSD.dll
2001-06-26 07:11 36,864 ----a-w C:\WINDOWS\inf\i386\Wiamicro.dll
2001-05-14 09:19 51,984 ----a-w C:\WINDOWS\inf\i386\Wiafbdrv.dll
2001-01-18 15:13 12,400 ----a-w C:\WINDOWS\inf\i386\usbscan.sys
.

((((((((((((((((((((((((((((( snapshot@2008-03-06_14.07.03.92 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-06 13:52:13 53,220 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-03-10 21:11:04 53,220 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-06 13:52:13 381,124 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-03-10 21:11:04 381,124 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="~C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 16:53 73840]
"PPWebCap"="C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe" [2001-05-17 10:21 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 14:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"SoundMan"="SOUNDMAN.EXE" [2005-01-20 20:04 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SiSPower"="SiSPower.dll" [2005-01-04 16:54 49152 C:\WINDOWS\system32\SiSPower.dll]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 11:43 90112]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-05-11 13:48 127118]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-12-02 01:08 180269]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-31 21:35 579072]
"Pando"="C:\Program Files\Pando Networks\Pando\Pando.exe" [ ]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 16:53 73840]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [ ]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-18 20:50 219136]

D:\Documents and Settings\kath\Start Menu\Programs\Startup\
reminder-ScanSoft Product Registration.lnk - C:\Program Files\ScanSoft\PaperPort\Config\Ereg\REMIND32.EXE [2007-05-08 13:27:39 45056]

D:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-21 19:42:22 45056]
EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2006-01-18 17:33:59 128000]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-12-02 00:51:43 331776]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Modem Booster]
C:\Program Files\inKline Global\Modem Booster\ModemBtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 16:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster]
C:\Program Files\inKline Global\PC Booster\pcbooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 UMAXPCLS;Print Port Scanner Driver;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys [2001-08-17 12:58]
S2 FILESpy;FILESpy;C:C:\Program Files\BullGuard\filespy.sys []
S3 DrvFltIp;DrvFltIp;C:\Program Files\BPSPCInternetFirewallSecurity\DrvFltIp.sys [2003-07-08 15:20]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-10 21:14:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-10 21:15:45
ComboFix-quarantined-files.txt 2008-03-10 21:15:29
ComboFix2.txt 2008-03-06 14:07:45
.
2008-02-14 00:01:25 --- E O F ---


Malwarebytes' Anti-Malware 1.08
Database version: 475

Scan type: Quick Scan
Objects scanned: 31293
Time elapsed: 3 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareBot (Rogue.SpywareBot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.Softomate) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\ClickToFindandFixErrors_RON.ico (Malware.Trace) -> Quarantined and deleted successfully.

OK lets get the clearance out of the way and I will attack your problem from a different direction

Now the best part of the day ----- Your log now appears clean

Double click OTMoveit once again and you should see a CleanUp! button, press that button, you may get prompted by your firewall that OTMoveit wants to contact the internet, allow this, a cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself



Now to get you off to a good start we will re-set your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your your restore point but this is my method:

1. Select Start > All Programs > Accessories > System tools > System Restore.
2. On the dialogue box that appears select Create a Restore Point
3. Click NEXT
4. Enter a name e.g. Clean
5. Click CREATE

You now have a clean restore point, to get rid of the bad ones:

1. Select Start > All Programs > Accessories > System tools > Disk Cleanup.
2. In the Drop down box that appears select your main drive e.g. C
3. Click OK
4. The System will do some calculation and the display a dialogue box with TABS
5. Select the More Options Tab.
6. At the bottom will be a system restore box with a CLEANUP button click this
7. Accept the Warning and select OK again, the program will close and you are done



Now that you are clean, to help protect your computer in the future I recommend that you get the following free program:

• SpywareBlaster to help prevent spyware from installing in the first place.
• SuperAntispyware Run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?


Keep safe

OK then I have been doing a little research on this and I would like you to try something for me

1. Uninstall SweetIM For Internet Explorer 3.0b
2. Uninstall Yahoo Messenger
3. Reboot
4. Reinstall Yahoo messenger

Let me know if that works

Essexboy, thankyou so much, the problem has now stopped. I can run messenger again without any errors

My greatest gratitude goes out to you, I appreciate it very much

A relative of mine has also used this site, and was helped with a problem of his and he has suggestd that we make a donation to the site. Im am going to speak with him further and there will be a donation from both of us to follow shortly. It wont be a massive sum, but we hope that it can contiribute in a small way and give at least a little back to the site

My biggest thanks again

Kath

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.