[markrr]

Thanks in anticipation of your help again. After dowloading Spybot and since removed, Internet Explorer takes 3 + minutes to load and 3+ minutes to go from site to site. The whole system is also slow.

Following all the directions/scans has not helped to repair the system.

Thanks

Mark



AVG Anti-Spyware - Scan Report
---------------------------------------------------------

"+ Created at: 8:41:05 PM 3/4/2008"

"+ Scan result: "



:mozilla.12:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.14:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\Mark Recktenwald\Cookies\mark_recktenwal d@247realmedia[2].txt -> TrackingCookie.247realmedia : Clea ned .
:mozilla.109:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.2o7 : Cleaned.
:mozilla.44:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.45:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.46:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.47:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.48:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.49:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.50:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.91:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.162:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Adbrite : Cleaned.
:mozilla.52:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.53:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.54:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.65:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.66:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.67:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.68:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.69:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.78:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.41:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.42:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\Mark Recktenwald\Cookies\mark_recktenwal [email protected][1].txt -> TrackingCookie.Netflame : Cl ean ed.
:mozilla.141:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Overture : Cleaned.
:mozilla.56:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.57:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.58:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.59:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.60:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.61:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.62:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.156:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Realmedia : Cleaned.
:mozilla.157:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Realmedia : Cleaned.
:mozilla.33:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.34:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.35:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.36:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.37:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.38:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.95:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.96:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.84:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.85:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.86:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.87:C:\Documents and Settings\Mark Recktenwald\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.167:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Tacoda : Cleaned.
:mozilla.168:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Tacoda : Cleaned.
:mozilla.169:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Tacoda : Cleaned.
:mozilla.171:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Trafficmp : Cleaned.
:mozilla.172:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Trafficmp : Cleaned.
:mozilla.173:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Tribalfusion : Cleaned.
:mozilla.193:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\Mark Recktenwald\Cookies\mark_recktenwal [email protected][2].txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.185:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Yieldmanager : Cleaned.
:mozilla.186:C:\Documents and Settings\Mark Recktenwald\Applicatio n Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\cookies.tx t - > TrackingCookie.Yieldmanager : Cleaned.
C:\WINDOWS\SYSTEM32\wnstssv.exe -> Trojan.Small : Cleaned.


::Report end

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/05/2008 at 09:31 AM

Application Version : 4.0.1154

Core Rules Database Version : 3414
Trace Rules Database Version: 1406

Scan type : Complete Scan
Total Scan Time : 02:39:14

Memory items scanned : 562
Memory threats detected : 0
Registry items scanned : 5562
Registry threats detected : 11
File items scanned : 60047
File threats detected : 4

Adware.SafeGuardProtect
HKLM\Software\Classes\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}#AppID
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}\InprocServer32
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}\InprocServer32#ThreadingModel
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}\ProgID
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}\Programmable
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}\TypeLib
HKCR\CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}\VersionIndependentProgID
C:\WINDOWS\SYSTEM32\SFG_32FE.DLL

Trojan.SmitFraud Variant
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77701e16-9bfe-4b63-a5b4-7bd156758a37}

Adware.Tracking Cookie
C:\Documents and Settings\Mark Recktenwald\Cookies\[email protected][1].txt
C:\Documents and Settings\Mark Recktenwald\Cookies\mark_recktenwald@247realmedia[1].txt

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{31414675-6CBE-4639-8F67-8C2E395D7683}\RP2087\A0272254.EXE

Panda Activescan
Incident Status Location

Spyware:spyware/betterinet Not disinfected c:\windows\inf\biini.inf
Adware:adware/sidesearch Not disinfected c:\windows\sepsd.bin
Adware:adware/dyfuca Not disinfected c:\windows\STWSI
Adware:adware/ncase Not disinfected Windows Registry

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:09:36 PM, on 3/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\MMKeybd.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Netropa\Traymon.exe
C:\Program Files\Netropa\OSD.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8111
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ComcastSUPPORT] C:\Program Files\Support.com\bin\tgkill.exe /cleaneahtioga /start
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: WindowsUpdate39693[1].exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Blubster Support - file://C:\Program Files\BlubsterSupport\System\Temp\blubstershop_script0.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {0940F5CD-7FBC-460A-ABB1-4DA430AF201C} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {42255A63-5A4E-499E-AB02-B6EEA29F55C9} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {DF5F11CD-D3C0-4BA6-A3F6-CD20EEAE53A1} - http://www.comcastsupport.com (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://www.lordandtaylor.com
O15 - Trusted Zone: http://www.vanguard.com
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...96/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,26/mcgdmgr.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzill...ller/dwnldr.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai...uditControl.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - https://www.powerpak...sses/CFJava.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O19 - User stylesheet: (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - http://vail.snow.com...02.1024x768.jpg
O24 - Desktop Component 1: (no name) - http://vail.snow.com....05.800x600.jpg
O24 - Desktop Component 2: (no name) - http://s1.thetravist...aldwin).wmv.gif

--
End of file - 12478 bytes

[Advertisements]

Hi,
Welcome to the site

I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

I want you to show hidden files. There are instructions HERE to help you do this.
You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in Safe Mode so you will be unable to access this thread at that time.
Please dont use any of the tools without specific instructions. Some of them are dangerous (and could leave your computer in worse condition that it is when infected) if used incorrectly.
These instuctions should be read first, then followed. If you do not understand something, don't be afraid to ask, or see if I'm on chat.

[sarahw]

Hi,
Welcome to the site

I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

I want you to show hidden files. There are instructions HERE to help you do this.
You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in Safe Mode so you will be unable to access this thread at that time.
Please dont use any of the tools without specific instructions. Some of them are dangerous (and could leave your computer in worse condition that it is when infected) if used incorrectly.
These instuctions should be read first, then followed. If you do not understand something, don't be afraid to ask, or see if I'm on chat.

[sarahw]

Download ComboFix from Here or Here to your Desktop.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

[markrr]

As requested

Thanks

Mark

ComboFix 08-03-07.4 - Mark Recktenwald 2008-03-08 7:02:56.1 - NTFSx86
Running from: C:\Documents and Settings\Mark Recktenwald\Local Settings\Temporary Internet Files\Content.IE5\BN04KPY5\ComboFix[1].exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-08 to 2008-03-08 )))))))))))))))))))))))))))))))
.

2008-03-05 17:26 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2008-03-05 17:04 . 2008-03-05 17:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 12:35 . 2008-03-05 18:52 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2008-03-05 12:35 . 2008-03-05 12:35 <DIR> d-------- C:\WINDOWS\LastGood
2008-03-05 12:35 . 2008-03-05 17:00 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2008-03-05 12:35 . 2008-03-05 17:00 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2008-03-05 12:35 . 2008-03-05 17:00 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2008-03-05 06:45 . 2008-03-05 06:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-05 06:43 . 2008-03-05 18:13 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-03-05 06:43 . 2008-03-05 06:43 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\SUPERAntiSpyware.com
2008-03-05 06:36 . 2008-03-05 06:36 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-04 18:36 . 2008-03-04 18:36 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\Grisoft
2008-03-04 18:34 . 2008-03-04 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-04 18:34 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-03-03 18:15 . 2008-03-03 18:15 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\McAfee
2008-03-03 17:34 . 2008-03-03 17:34 <DIR> d-------- C:\Program Files\NoAdware3
2008-03-02 09:33 . 2008-03-03 17:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 23:11 --------- d-----w C:\Program Files\Netropa
2008-03-05 23:07 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2008-03-05 23:06 --------- d-----w C:\Program Files\iTunes
2008-03-05 23:00 --------- d-----w C:\Program Files\Google
2008-03-04 11:32 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-04 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-03 23:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-03-03 22:55 --------- d-----w C:\Program Files\McAfee
2008-03-03 22:34 --------- d-----w C:\Program Files\Lavasoft
2008-03-03 22:33 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\Lavasoft
2008-02-06 14:51 171,400 ----a-w C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-03 17:17 --------- d-----w C:\Program Files\QuickTime
2008-01-16 17:27 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-16 17:27 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-01-16 17:25 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\Logitech
2008-01-16 17:24 --------- d-----w C:\Program Files\Common Files\LogiShared
2008-01-16 17:23 127,034 ------r C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-01-16 17:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-16 17:23 --------- d-----w C:\Program Files\Logitech
2008-01-16 17:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-16 17:20 --------- d-----w C:\Program Files\Common Files\Logitech
2008-01-16 17:19 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\InstallShield
2008-01-16 17:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-01-16 17:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-12-18 09:51 179,584 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mrxdav.sys
2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2005-10-22 19:28 65,784 ----a-w C:\Documents and Settings\Mark Recktenwald\Application Data\GDIPFONTCACHEV1.DAT
2005-10-05 01:31 1,507,328 ----a-w C:\Documents and Settings\Mark Recktenwald\DesktopDoctor1.0.exe
2005-09-03 18:45 560 ----a-w C:\Documents and Settings\Mark Recktenwald\PCDOC.BAT
2003-10-25 01:33 0 ----a-w C:\Documents and Settings\Mark Recktenwald\ub.dat
2003-10-25 01:33 0 ----a-w C:\Documents and Settings\Mark Recktenwald\ad.dat
2004-11-26 15:25 189,499,780 --sha-w C:\WINDOWS\SECURITY\Database\rbaniw.bak1
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\Money Express.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-03 06:44 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 16:31 655360]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 02:00 90112]
"AHQInit"="C:\Program Files\Creative\SBLive\Program\AHQInit.exe" [2001-03-28 03:00 102400]
"DellTouch"="C:\WINDOWS\MMKeybd.exe" [2001-09-05 14:28 163840]
"dlder"="" []
"ComcastSUPPORT"="C:\Program Files\Support.com\bin\tgkill.exe" [2001-11-21 01:49 57344]
"ViewMgr"="C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-10 23:15 111816]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [ ]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 14:52 849280]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42 267064]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 10:22 20480]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

C:\Documents and Settings\Mark Recktenwald\Start Menu\Programs\Startup\
WindowsUpdate39693[1].exe [2004-11-08 17:17:38 0]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Camio Viewer 2000.lnk - C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe [2001-12-12 21:08:39 49152]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-01-16 12:23:54 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-16 12:19:48 692224]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 0 (0x0)
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoDispAppearancePage"= 0 (0x0)
"NoColorChoice"= 0 (0x0)
"NoSizeChoice"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispCPL"= 0 (0x0)
"NoVisualStyleChoice"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"disableregistrytools"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRun"= 0 (0x0)
"NoLogoff"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoActiveDesktop"= 0 (0x0)
"NoThemesTab"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ :\WINDOWS\system32\srrstr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDRealtime]
C:\WINDOWS\realtime.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Support.com\\bin\\tgcmd.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\Savings Bond Wizard\\SBWizard.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=


*Newly Created Service* - AJEOYRJWEAHU
*Newly Created Service* - RKPAVPROC
*Newly Created Service* - SDTHOOK
.
Contents of the 'Scheduled Tasks' folder
"2008-03-04 23:13:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-15 06:00:01 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-03-03 06:00:04 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2007-06-09 19:36:49 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"
- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
"2008-03-08 12:16:03 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 07:13:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HFXBZGRK]
"ImagePath"="\??\C:\WINDOWS\system32\hfxbzgrk.qdh"
.
Completion time: 2008-03-08 7:21:54
.
2008-02-13 08:07:36 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:28:39 AM, on 3/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\MMKeybd.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Netropa\Traymon.exe
C:\Program Files\Netropa\OSD.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8111
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ComcastSUPPORT] C:\Program Files\Support.com\bin\tgkill.exe /cleaneahtioga /start
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: WindowsUpdate39693[1].exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Blubster Support - file://C:\Program Files\BlubsterSupport\System\Temp\blubstershop_script0.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {0940F5CD-7FBC-460A-ABB1-4DA430AF201C} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {42255A63-5A4E-499E-AB02-B6EEA29F55C9} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {DF5F11CD-D3C0-4BA6-A3F6-CD20EEAE53A1} - http://www.comcastsupport.com (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://www.lordandtaylor.com
O15 - Trusted Zone: http://www.vanguard.com
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...96/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,26/mcgdmgr.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzill...ller/dwnldr.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai...uditControl.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - https://www.powerpak...sses/CFJava.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O19 - User stylesheet: (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - http://vail.snow.com...02.1024x768.jpg
O24 - Desktop Component 1: (no name) - http://vail.snow.com....05.800x600.jpg
O24 - Desktop Component 2: (no name) - http://s1.thetravist...aldwin).wmv.gif

--
End of file - 12313 bytes

[sarahw]

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\Documents and Settings\Mark Recktenwald\ub.dat
C:\Documents and Settings\Mark Recktenwald\ad.dat
C:\WINDOWS\SECURITY\Database\rbaniw.bak1
C:\Documents and Settings\Mark Recktenwald\PCDOC.BAT
C:\Documents and Settings\Mark Recktenwald\DesktopDoctor1.0.exe
C:\Documents and Settings\Mark Recktenwald\Application Data\GDIPFONTCACHEV1.DAT

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

[markrr]

Thanks

Mark

ComboFix 08-03-07.4 - Mark Recktenwald 2008-03-08 9:40:48.2 - NTFSx86
Running from: C:\Documents and Settings\Mark Recktenwald\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Mark Recktenwald\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Mark Recktenwald\ad.dat
C:\Documents and Settings\Mark Recktenwald\Application Data\GDIPFONTCACHEV1.DAT
C:\Documents and Settings\Mark Recktenwald\DesktopDoctor1.0.exe
C:\Documents and Settings\Mark Recktenwald\PCDOC.BAT
C:\Documents and Settings\Mark Recktenwald\ub.dat
C:\WINDOWS\SECURITY\Database\rbaniw.bak1
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Mark Recktenwald\ad.dat
C:\Documents and Settings\Mark Recktenwald\Application Data\GDIPFONTCACHEV1.DAT
C:\Documents and Settings\Mark Recktenwald\DesktopDoctor1.0.exe
C:\Documents and Settings\Mark Recktenwald\PCDOC.BAT
C:\Documents and Settings\Mark Recktenwald\ub.dat
C:\WINDOWS\SECURITY\Database\rbaniw.bak1

.
((((((((((((((((((((((((( Files Created from 2008-02-08 to 2008-03-08 )))))))))))))))))))))))))))))))
.

2008-03-05 17:26 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2008-03-05 17:04 . 2008-03-05 17:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 12:35 . 2008-03-05 18:52 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2008-03-05 12:35 . 2008-03-05 12:35 <DIR> d-------- C:\WINDOWS\LastGood
2008-03-05 12:35 . 2008-03-05 17:00 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2008-03-05 12:35 . 2008-03-05 17:00 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2008-03-05 12:35 . 2008-03-05 17:00 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2008-03-05 06:45 . 2008-03-05 06:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-05 06:43 . 2008-03-05 18:13 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-03-05 06:43 . 2008-03-05 06:43 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\SUPERAntiSpyware.com
2008-03-05 06:36 . 2008-03-05 06:36 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-04 18:36 . 2008-03-04 18:36 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\Grisoft
2008-03-04 18:34 . 2008-03-04 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-04 18:34 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-03-03 18:15 . 2008-03-03 18:15 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\McAfee
2008-03-03 17:34 . 2008-03-03 17:34 <DIR> d-------- C:\Program Files\NoAdware3
2008-03-02 09:33 . 2008-03-03 17:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 23:11 --------- d-----w C:\Program Files\Netropa
2008-03-05 23:07 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2008-03-05 23:06 --------- d-----w C:\Program Files\iTunes
2008-03-05 23:00 --------- d-----w C:\Program Files\Google
2008-03-04 11:32 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-04 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-03 23:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-03-03 22:55 --------- d-----w C:\Program Files\McAfee
2008-03-03 22:34 --------- d-----w C:\Program Files\Lavasoft
2008-03-03 22:33 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\Lavasoft
2008-02-06 14:51 171,400 ----a-w C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-03 17:17 --------- d-----w C:\Program Files\QuickTime
2008-01-16 17:27 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-16 17:27 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-01-16 17:25 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\Logitech
2008-01-16 17:24 --------- d-----w C:\Program Files\Common Files\LogiShared
2008-01-16 17:23 127,034 ------r C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-01-16 17:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-16 17:23 --------- d-----w C:\Program Files\Logitech
2008-01-16 17:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-16 17:20 --------- d-----w C:\Program Files\Common Files\Logitech
2008-01-16 17:19 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\InstallShield
2008-01-16 17:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-01-16 17:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-12-18 09:51 179,584 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mrxdav.sys
2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\Money Express.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-03 06:44 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 16:31 655360]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 02:00 90112]
"AHQInit"="C:\Program Files\Creative\SBLive\Program\AHQInit.exe" [2001-03-28 03:00 102400]
"DellTouch"="C:\WINDOWS\MMKeybd.exe" [2001-09-05 14:28 163840]
"dlder"="" []
"ComcastSUPPORT"="C:\Program Files\Support.com\bin\tgkill.exe" [2001-11-21 01:49 57344]
"ViewMgr"="C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-10 23:15 111816]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 14:52 849280]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42 267064]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 10:22 20480]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

C:\Documents and Settings\Mark Recktenwald\Start Menu\Programs\Startup\
WindowsUpdate39693[1].exe [2004-11-08 17:17:38 0]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Camio Viewer 2000.lnk - C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe [2001-12-12 21:08:39 49152]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-01-16 12:23:54 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-16 12:19:48 692224]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"disableregistrytools"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ :\WINDOWS\system32\srrstr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDRealtime]
C:\WINDOWS\realtime.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Support.com\\bin\\tgcmd.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\Savings Bond Wizard\\SBWizard.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=


*Newly Created Service* - AJEOYRJWEAHU
*Newly Created Service* - RKPAVPROC
*Newly Created Service* - SDTHOOK
.
Contents of the 'Scheduled Tasks' folder
"2008-03-04 23:13:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-15 06:00:01 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-03-03 06:00:04 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2007-06-09 19:36:49 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"
- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
"2008-03-08 14:56:17 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 09:50:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HFXBZGRK]
"ImagePath"="\??\C:\WINDOWS\system32\hfxbzgrk.qdh"
.
Completion time: 2008-03-08 10:00:07
ComboFix-quarantined-files.txt 2008-03-08 14:59:55
ComboFix2.txt 2008-03-08 12:21:58
.
2008-02-13 08:07:36 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:31:31 AM, on 3/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\MMKeybd.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Netropa\Traymon.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\internet explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8111
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ComcastSUPPORT] C:\Program Files\Support.com\bin\tgkill.exe /cleaneahtioga /start
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: WindowsUpdate39693[1].exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Blubster Support - file://C:\Program Files\BlubsterSupport\System\Temp\blubstershop_script0.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {0940F5CD-7FBC-460A-ABB1-4DA430AF201C} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {42255A63-5A4E-499E-AB02-B6EEA29F55C9} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {DF5F11CD-D3C0-4BA6-A3F6-CD20EEAE53A1} - http://www.comcastsupport.com (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://www.lordandtaylor.com
O15 - Trusted Zone: http://www.vanguard.com
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...96/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,26/mcgdmgr.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzill...ller/dwnldr.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai...uditControl.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - https://www.powerpak...sses/CFJava.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O19 - User stylesheet: (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - http://vail.snow.com...02.1024x768.jpg
O24 - Desktop Component 1: (no name) - http://vail.snow.com....05.800x600.jpg
O24 - Desktop Component 2: (no name) - http://s1.thetravist...aldwin).wmv.gif

--
End of file - 12256 bytes

[sarahw]

Hi, I'd like to check our progress. We'll run a few scans
1.
First download AVG Anti-Spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program

• Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
• Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
• On the main screen select the icon "Update" then select the "Update now" link.
  • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.


2.
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only
Do not Run it yet, we will use it later. Save it somewhere you will remember, like your desktop.


3.
Reboot into Safe Mode by continuously tapping the F8 key as soon as the computer begins to boot. A menu should come up where you will be given the option to enter Safe Mode.


4.
Please open ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.


5.

• IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
• Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
• AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
• Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.

6.
Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Edited by sarahw, 08 March 2008 - 10:25 AM.

[markrr]

I could not get the AVG file to open in a readable format, since I am a neophyte to this, so I attached it as it came over from the safe mode. If you could instruct me how to do so, I would be happy to run the scan over and submit it.

Thanks

Mark

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, March 09, 2008 10:22:01 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 9/03/2008
Kaspersky Anti-Virus database records: 617942
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 60922
Number of viruses found: 4
Number of infected objects: 186
Number of suspicious objects: 0
Duration of the scan process: 01:41:46

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\logout.edb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{BDA9C472-3243-4703-910A-42F76B454C77}.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{E4E48A0A-40A4-4674-90BE-21285B438D89}.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR5.tmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-3-8-2008( 16-54-8 ).LOG Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Local Settings\Application Data\Mozilla\Firefox\Profiles\gqvwzh0b.default\Cache\F1C22451d01 Infected: Trojan-Downloader.Win32.Zlob.hvj skipped
C:\Documents and Settings\Mark Recktenwald\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Local Settings\History\History.IE5\MSHist012008030820080309\index.dat Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Local Settings\Temp\Perflib_Perfdata_214.dat Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe/data0014/NHInstall.exe Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe/data0014/v2.0.2.cab/NHUninstaller.exe Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe/data0014/v2.0.2.cab/NHelper.dll Infected: not-a-virus:AdWare.Win32.NavExcel.d skipped
C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe/data0014/v2.0.2.cab/NHUpdater.exe Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe/data0014/v2.0.2.cab Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe/data0014 Infected: not-a-virus:AdWare.Win32.NavExcel.b skipped
C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe NSIS: infected - 6 skipped
C:\Documents and Settings\Mark Recktenwald\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Mark Recktenwald\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\chandir.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\chandir.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\chn.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\chn.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\D0000000.FCS Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\inuse.txt Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\L0000004.FCS Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\main.log Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs_die.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs_die.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs_ext.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs_ext.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\storydb.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Mark Recktenwald\Data\storydb.idx Object is locked skipped
C:\Program Files\Support.com\backup\HO\HOSTS\1374_507f15238_/HOSTS Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\HOSTS\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\HOSTS\2104_540edd995_/HOSTS Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\HOSTS\2104_540edd995_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20031230-181709.backup\1374_507f15238_/hosts.20031230-181709.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20031230-181709.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20031230-195628.backup\1374_507f15238_/hosts.20031230-195628.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20031230-195628.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20031231-185926.backup\1374_507f15238_/hosts.20031231-185926.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20031231-185926.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040101-114407.backup\1374_507f15238_/hosts.20040101-114407.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040101-114407.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040101-131119.backup\1374_507f15238_/hosts.20040101-131119.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040101-131119.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040102-180614.backup\1374_507f15238_/hosts.20040102-180614.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040102-180614.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040103-203318.backup\1374_507f15238_/hosts.20040103-203318.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040103-203318.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040104-233555.backup\1374_507f15238_/hosts.20040104-233555.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040104-233555.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040105-200715.backup\1374_507f15238_/hosts.20040105-200715.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040105-200715.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040107-172552.backup\1374_507f15238_/hosts.20040107-172552.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040107-172552.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040109-180523.backup\1374_507f15238_/hosts.20040109-180523.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040109-180523.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040110-034358.backup\1374_507f15238_/hosts.20040110-034358.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040110-034358.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040115-212927.backup\1374_507f15238_/hosts.20040115-212927.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040115-212927.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040117-171623.backup\1374_507f15238_/hosts.20040117-171623.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040117-171623.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040120-064303.backup\1374_507f15238_/hosts.20040120-064303.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040120-064303.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040124-122221.backup\1374_507f15238_/hosts.20040124-122221.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040124-122221.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040125-231040.backup\1374_507f15238_/hosts.20040125-231040.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040125-231040.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040205-054211.backup\1374_507f15238_/hosts.20040205-054211.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040205-054211.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040206-205631.backup\1374_507f15238_/hosts.20040206-205631.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040206-205631.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040220-063806.backup\1374_507f15238_/hosts.20040220-063806.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040220-063806.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040224-182206.backup\1374_507f15238_/hosts.20040224-182206.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040224-182206.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040309-061217.backup\1374_507f15238_/hosts.20040309-061217.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040309-061217.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040313-092847.backup\1374_507f15238_/hosts.20040313-092847.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040313-092847.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040320-161903.backup\1374_507f15238_/hosts.20040320-161903.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040320-161903.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040328-105829.backup\1374_507f15238_/hosts.20040328-105829.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040328-105829.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040403-133711.backup\1374_507f15238_/hosts.20040403-133711.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040403-133711.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040403-160440.backup\1374_507f15238_/hosts.20040403-160440.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040403-160440.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040410-000901.backup\1374_507f15238_/hosts.20040410-000901.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040410-000901.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040412-213056.backup\1374_507f15238_/hosts.20040412-213056.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040412-213056.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040412-220249.backup\1374_507f15238_/hosts.20040412-220249.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040412-220249.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040416-162145.backup\1374_507f15238_/hosts.20040416-162145.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040416-162145.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040502-050232.backup\1374_507f15238_/hosts.20040502-050232.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040502-050232.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040521-155649.backup\1374_507f15238_/hosts.20040521-155649.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040521-155649.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040527-165542.backup\1374_507f15238_/hosts.20040527-165542.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040527-165542.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040601-202040.backup\1374_507f15238_/hosts.20040601-202040.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040601-202040.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040606-070652.backup\1374_507f15238_/hosts.20040606-070652.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040606-070652.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040609-173915.backup\1374_507f15238_/hosts.20040609-173915.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040609-173915.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040615-192022.backup\1374_507f15238_/hosts.20040615-192022.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040615-192022.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20040914-053147.backup\1374_507f15238_/hosts.20040914-053147.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20040914-053147.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041001-234853.backup\1374_507f15238_/hosts.20041001-234853.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041001-234853.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041016-060431.backup\1374_507f15238_/hosts.20041016-060431.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041016-060431.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041023-071825.backup\1374_507f15238_/hosts.20041023-071825.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041023-071825.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041116-124048.backup\1374_507f15238_/hosts.20041116-124048.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041116-124048.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041121-170502.backup\1374_507f15238_/hosts.20041121-170502.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041121-170502.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041123-052204.backup\1374_507f15238_/hosts.20041123-052204.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041123-052204.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041124-172431.backup\1374_507f15238_/hosts.20041124-172431.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041124-172431.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041125-110317.backup\1374_507f15238_/hosts.20041125-110317.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041125-110317.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041126-003342.backup\1374_507f15238_/hosts.20041126-003342.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041126-003342.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041126-062846.backup\1374_507f15238_/hosts.20041126-062846.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041126-062846.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041126-125247.backup\1374_507f15238_/hosts.20041126-125247.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041126-125247.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041129-063930.backup\1374_507f15238_/hosts.20041129-063930.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041129-063930.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041201-095129.backup\1374_507f15238_/hosts.20041201-095129.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041201-095129.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041201-200841.backup\1374_507f15238_/hosts.20041201-200841.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041201-200841.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041211-141549.backup\1374_507f15238_/hosts.20041211-141549.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041211-141549.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041214-181827.backup\1374_507f15238_/hosts.20041214-181827.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041214-181827.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20041218-173724.backup\1374_507f15238_/hosts.20041218-173724.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20041218-173724.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.20050108-085222.backup\1374_507f15238_/hosts.20050108-085222.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.20050108-085222.backup\1374_507f15238_ CAB: infected - 1 skipped
C:\Program Files\Support.com\backup\HO\hosts.bak0\1304_5ac2945d1_/hosts.bak0 Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\Program Files\Support.com\backup\HO\hosts.bak0\1304_5ac2945d1_ CAB: infected - 1 skipped
C:\System Volume Information\_restore{31414675-6CBE-4639-8F67-8C2E395D7683}\RP2092\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20031230-181709.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20031230-195628.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20031231-185926.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040101-114407.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040101-131119.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040102-180614.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040103-203318.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040104-233555.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040105-200715.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040107-172552.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040109-180523.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040110-034358.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040115-212927.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040117-171623.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040120-064303.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040124-122221.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040125-231040.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040205-054211.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040206-205631.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040220-063806.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040224-182206.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040309-061217.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040313-092847.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040320-161903.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040328-105829.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040403-133711.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040403-160440.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040410-000901.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040412-213056.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040412-220249.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040416-162145.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040502-050232.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040521-155649.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040527-165542.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040601-202040.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040606-070652.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040609-173915.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040615-192022.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20040914-053147.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041001-234853.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041016-060431.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041023-071825.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041116-124048.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041121-170502.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041123-052204.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041124-172431.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041125-110317.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041126-003342.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041126-062846.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041126-125247.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041129-063930.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041201-095129.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041201-200841.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041211-141549.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041214-181827.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20041218-173724.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20050108-085222.backup Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bak0 Infected: Trojan-Clicker.Win32.Qhost.a skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\temp\mcafee_bEQm66PvStoXgb8 Object is locked skipped
C:\WINDOWS\temp\mcafee_IugwbFovd4apIZc Object is locked skipped
C:\WINDOWS\temp\mcafee_mJRQ8Pvd73c7THN Object is locked skipped
C:\WINDOWS\temp\mcmsc_72KzADff9axfqI8 Object is locked skipped
C:\WINDOWS\temp\mcmsc_ApfYHEwqmYsM2op Object is locked skipped
C:\WINDOWS\temp\mcmsc_bMsvycJEySL4lSd Object is locked skipped
C:\WINDOWS\temp\mcmsc_NPH2E6kqmub88Hf Object is locked skipped
C:\WINDOWS\temp\mcmsc_SJWsSGsEr6B9jxQ Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Attached Files

•  avg1Report_Scan_20080309_121111.txt   2.86KB   90 downloads

[sarahw]

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe
  C:\Program Files\Support.com\backup\HO\HOSTS
  C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
• Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
• Close OTMoveIt

*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.
**If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")

Click "Exit" to close OTMoveIt.

[markrr]

Thanks

Mark


C:\Documents and Settings\Mark Recktenwald\My Documents\setup.exe moved successfully.
C:\Program Files\Support.com\backup\HO\HOSTS moved successfully.
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts moved successfully.

OTMoveIt2 v1.0.20 log created on 03092008_223118

[sarahw]

Hi,
It's looking good.
Can you please post a fresh Hijack This log and run combofix again.

[markrr]

As requested

Thanks

Mark

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:13:35 AM, on 3/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\MMKeybd.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Netropa\Traymon.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8111
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ComcastSUPPORT] C:\Program Files\Support.com\bin\tgkill.exe /cleaneahtioga /start
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: WindowsUpdate39693[1].exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Blubster Support - file://C:\Program Files\BlubsterSupport\System\Temp\blubstershop_script0.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {0940F5CD-7FBC-460A-ABB1-4DA430AF201C} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {42255A63-5A4E-499E-AB02-B6EEA29F55C9} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {DF5F11CD-D3C0-4BA6-A3F6-CD20EEAE53A1} - http://www.comcastsupport.com (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://www.lordandtaylor.com
O15 - Trusted Zone: http://www.vanguard.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...96/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,26/mcgdmgr.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzill...ller/dwnldr.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai...uditControl.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - https://www.powerpak...sses/CFJava.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O19 - User stylesheet: (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - http://vail.snow.com...02.1024x768.jpg
O24 - Desktop Component 1: (no name) - http://vail.snow.com....05.800x600.jpg
O24 - Desktop Component 2: (no name) - http://s1.thetravist...aldwin).wmv.gif

--
End of file - 12494 bytes


ComboFix 08-03-07.4 - Mark Recktenwald 2008-03-09 23:34:26.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.29 [GMT -4:00]
Running from: C:\Documents and Settings\Mark Recktenwald\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-10 to 2008-03-10 )))))))))))))))))))))))))))))))
.

2008-03-09 23:25 . 2008-03-09 23:25 6,736 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\PROCEXP90.SYS
2008-03-09 22:31 . 2008-03-09 22:31 <DIR> d-------- C:\_OTMoveIt
2008-03-09 08:24 . 2008-03-09 08:24 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-03-09 08:24 . 2008-03-09 08:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-05 18:26 . 2007-06-05 11:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2008-03-05 18:04 . 2008-03-05 18:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 13:35 . 2008-03-05 19:52 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2008-03-05 13:35 . 2008-03-05 18:00 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2008-03-05 13:35 . 2008-03-05 18:00 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2008-03-05 13:35 . 2008-03-05 18:00 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2008-03-05 07:45 . 2008-03-05 07:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-05 07:43 . 2008-03-05 19:13 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-03-05 07:43 . 2008-03-05 07:43 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\SUPERAntiSpyware.com
2008-03-05 07:36 . 2008-03-05 07:36 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-04 19:36 . 2008-03-04 19:36 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\Grisoft
2008-03-04 19:34 . 2008-03-04 19:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-04 19:34 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-03-03 19:15 . 2008-03-03 19:15 <DIR> d-------- C:\Documents and Settings\Mark Recktenwald\Application Data\McAfee
2008-03-03 18:34 . 2008-03-03 18:34 <DIR> d-------- C:\Program Files\NoAdware3
2008-03-02 10:33 . 2008-03-03 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 23:11 --------- d-----w C:\Program Files\Netropa
2008-03-05 23:07 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2008-03-05 23:06 --------- d-----w C:\Program Files\iTunes
2008-03-05 23:00 --------- d-----w C:\Program Files\Google
2008-03-04 11:32 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-04 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-03 23:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-03-03 22:55 --------- d-----w C:\Program Files\McAfee
2008-03-03 22:34 --------- d-----w C:\Program Files\Lavasoft
2008-03-03 22:33 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\Lavasoft
2008-02-06 14:51 171,400 ----a-w C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-03 17:17 --------- d-----w C:\Program Files\QuickTime
2008-01-16 17:27 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-16 17:27 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-01-16 17:25 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\Logitech
2008-01-16 17:24 --------- d-----w C:\Program Files\Common Files\LogiShared
2008-01-16 17:23 127,034 ------r C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-01-16 17:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-16 17:23 --------- d-----w C:\Program Files\Logitech
2008-01-16 17:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-16 17:20 --------- d-----w C:\Program Files\Common Files\Logitech
2008-01-16 17:19 --------- d-----w C:\Documents and Settings\Mark Recktenwald\Application Data\InstallShield
2008-01-16 17:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-01-16 17:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
.

((((((((((((((((((((((((((((( snapshot@2008-03-08_ 7.19.56.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 13:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 12:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2005-05-24 16:27:16 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 19:47:20 94,208 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 19:49:54 950,272 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2007-11-14 08:16:54 60,908 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-03-09 16:23:09 60,908 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2007-11-14 08:16:54 398,616 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-03-09 16:23:09 398,616 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
- 2000-08-31 13:00:00 161,792 ----a-w C:\WINDOWS\SYSTEM32\swreg.exe
+ 2000-08-31 12:00:00 161,792 ----a-w C:\WINDOWS\SYSTEM32\swreg.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\Money Express.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-03 07:44 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 17:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 17:31 655360]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 03:00 90112]
"AHQInit"="C:\Program Files\Creative\SBLive\Program\AHQInit.exe" [2001-03-28 04:00 102400]
"DellTouch"="C:\WINDOWS\MMKeybd.exe" [2001-09-05 15:28 163840]
"dlder"="" []
"ComcastSUPPORT"="C:\Program Files\Support.com\bin\tgkill.exe" [2001-11-21 02:49 57344]
"ViewMgr"="C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-11 00:15 111816]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 15:52 849280]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]

C:\Documents and Settings\Mark Recktenwald\Start Menu\Programs\Startup\
WindowsUpdate39693[1].exe [2004-11-08 18:17:38 0]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Camio Viewer 2000.lnk - C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe [2001-12-12 22:08:39 49152]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-01-16 13:23:54 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-16 13:19:48 692224]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 03:01:04 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ :\WINDOWS\system32\srrstr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDRealtime]
C:\WINDOWS\realtime.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Support.com\\bin\\tgcmd.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\Savings Bond Wizard\\SBWizard.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2001-08-17 15:52]
R2 mrtRate;mrtRate;C:\WINDOWS\system32\drivers\mrtRate.sys [1999-11-05 19:43]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2001-08-31 02:40]
S2 HFXBZGRK;HFXBZGRK;C:\WINDOWS\system32\hfxbzgrk.qdh []
S3 ati2mpaa;ati2mpaa;C:\WINDOWS\system32\DRIVERS\ati2mpaa.sys [2001-08-17 14:48]
S3 USB200M;Linksys USB 2.0 Network Adapter ver.2;C:\WINDOWS\system32\DRIVERS\USB200M2.sys [2005-04-21 02:30]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-04 23:13:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-15 06:00:01 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-03-03 06:00:04 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2007-06-09 19:36:49 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"
- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
"2008-03-10 03:46:09 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-09 23:42:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HFXBZGRK]
"ImagePath"="\??\C:\WINDOWS\system32\hfxbzgrk.qdh"
.
Completion time: 2008-03-09 23:47:20
ComboFix-quarantined-files.txt 2008-03-10 03:47:08
ComboFix2.txt 2008-03-08 15:00:14
ComboFix3.txt 2008-03-08 12:21:58
.
2008-02-13 08:07:36 --- E O F ---

[sarahw]

Hi,

Did you add these sites into your trusted zone?
http://www.lordandtaylor.com
http://www.vanguard.com



Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below:

O4 - HKLM\..\Run: [ComcastSUPPORT] C:\Program Files\Support.com\bin\tgkill.exe /cleaneahtioga /start


[*] Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.


Open OTMoveIt2 nd copy the following into the top box as per the above instructions:
C:\Program Files\Support.com\bin\tgkill.exe
Click the red MoveIt! button. Copy the reults with a fresh Hijack This log and tell me how the computer is running.

[markrr]

I added Vanguard and Lordandtaylor to trusted sites. Should I remove?

System is running better.

You have been very helpful.

Anytjinmg else I need to do?

Thank You

Mark

C:\Program Files\Support.com\bin\tgkill.exe moved successfully.

OTMoveIt2 v1.0.20 log created on 03102008_005332

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:54:08 AM, on 3/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\MMKeybd.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Netropa\Traymon.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Mark Recktenwald\Desktop\OTMoveIt2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8111
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: WindowsUpdate39693[1].exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Blubster Support - file://C:\Program Files\BlubsterSupport\System\Temp\blubstershop_script0.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {0940F5CD-7FBC-460A-ABB1-4DA430AF201C} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {42255A63-5A4E-499E-AB02-B6EEA29F55C9} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {DF5F11CD-D3C0-4BA6-A3F6-CD20EEAE53A1} - http://www.comcastsupport.com (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://www.lordandtaylor.com
O15 - Trusted Zone: http://www.vanguard.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...96/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,26/mcgdmgr.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzill...ller/dwnldr.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai...uditControl.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - https://www.powerpak...sses/CFJava.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O19 - User stylesheet: (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - http://vail.snow.com...02.1024x768.jpg
O24 - Desktop Component 1: (no name) - http://vail.snow.com....05.800x600.jpg
O24 - Desktop Component 2: (no name) - http://s1.thetravist...aldwin).wmv.gif

--
End of file - 12474 bytes

[sarahw]

Congratulations, your log is now clean.

A well protected computer should have at least an Anti Virus and Firewall, an Anti Spyware is also great addition to your computers security. Here is a list of tools I like to recommend to people that will help ensure safe surfing on the internet, and to help you from getting infected again.
Note: DO NOT install more than one antivirus or Firewall program. They will conflict, and provide less protection, not more. Uninstall any existing Anti Virus\Firewall programs if you're going to install a new one.


Free Online Scans:
Free Active X and Java based online scans. You can use these scans from other companies and it will not interfere with your current Anti Virus. If you find that you are infected, post a Hijack This log in the forums.

• Kapersky online scan
• Panda Online Scan
• F-Secure Online Scan
• TrendMicro HouseCall online scan
• Bit Defender online scan

Free Temp Cleaners:
Use these tools to clean temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. ATF cleaner recommended.

• CCleaner
• ATF Cleaner

Free Firewall Downloads:
You must have a Firewall installed on your computer. This helps stop anything from leaving or entering your computer without your permission.

• ZoneAlarm
• Kerio Firewall

Free Anti Spyware Downloads:
An Antispyware is a great tool that can help remove infections along side your Anti Virus. Some include real time protection, scheduled scans and automatic definition updates.

• AVG Antispyware
• A-Squared Antispyware
• SpywareGuard
• SpywareBlaster
• SpywareTerminator
• Spybot Search & Destroy
• Ad Aware

Free Anti Virus Downloads:
A must have for all computers. Avast! recommended.

• SpywareTerminator With ClamAV Enabled.
• AntiVir
• Avast!
• Grisoft AVG
• Bit Defender Free
• a² Free
• Comodo BOClean
• SuperAntiSpyware

Other:

• SpywareGuard
  Works as a Spyware "Shield" to protect your computer from getting malware in the first place.
• IE-SpyAd
  This tool puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
• Memtest86
  Great memory testing software.
• CPU-Z
  This application gives detailed information about your system in a nice layout
• Speedfan
  Returns and monitors system temperatures.
• Windows Updates
  It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

You can now Rehide your system files by using the reversal of these instructions HERE



To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read THIS article by Tony Klein.


If you have any other problems or questions be sure to ask.