Hey thanks for responding to my posting.
I think I have some new problems i downloaded severaly apyware and adware removals and my computer went back to normal for a while then today after i downloaded the service pack 1 for windows vista I have had a whole new set of problems. I get a message from symantec email proxy saying Symantec email proxy can not scan your email messages because your network is not properly configured. Then I get anotehher mesage from Backweb Error sayin cannot start HP conections: sockets init failed
Then i get another message from windows saying failed to connect to windows service message. Also windows hp center did not open I am using windows vista by the way.
when i run the task manager it says under users tab my name of computer id it says 2 status it says active client name nothing is there and session it says console
when i go to connect to a network it says connection status unknown the dependence service or group failed to start so i can not even connect to the internet anymore here is my hijack this and combofix any help or advice would be greatly appreciated
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:14:31 PM, on 6/30/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\ESI\QuataFire610\QuataPan.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://ie.redirect.h...a...n&pf=laptopR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ServicioSpeedy] C:\Program Files\Telefonica\Speedy\SATCfgApp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Control Panel.lnk = C:\Program Files\ESI\QuataFire610\QuataPan.exe
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O10 - Broken Internet access because of LSP chain gap (#1 in chain of 12 missing)
O13 - Gopher Prefix:
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx
O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) -
https://h20364.www2....DataManager.CABO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zon...nt.cab56907.cabO16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/SCRABBLE/Images/armhelper.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 12280 bytes
Combofix
ComboFix 08-06-20.4 - Anthony 2008-06-30 16:43:28.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1172 [GMT -4:00]
Running from: C:\Users\Anthony\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Users\Anthony\AppData\Local\Microsoft\Windows\Temporary Internet Files\bestwiner.stt
C:\Windows\system32\hljwugsf.bin
C:\Windows\system32\MSINET.oca
C:\Windows\system32\x64
.
((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-30 )))))))))))))))))))))))))))))))
.
2008-06-30 02:05 . 2008-06-30 02:05 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-30 00:51 . 2008-06-30 00:51 <DIR> d-------- C:\PerfLogs
2008-06-30 00:15 . 2008-06-30 00:06 152,576 --a------ C:\Windows\System32\SPWizUI.dll
2008-06-30 00:15 . 2008-06-30 00:06 47,560 --a------ C:\Windows\System32\SPReview.exe
2008-06-29 02:57 . 2008-06-29 02:58 <DIR> d-------- C:\41f03397be02059d5c94
2008-06-29 02:54 . 2008-01-18 23:33 193,024 --a------ C:\Windows\System32\recdisc.exe
2008-06-29 02:53 . 2008-01-18 23:36 6,656 --a------ C:\Windows\System32\sdspres.dll
2008-06-29 02:52 . 2008-01-18 23:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
2008-06-29 02:51 . 2008-01-18 23:36 142,336 --a------ C:\Windows\System32\spp.dll
2008-06-29 02:51 . 2008-01-18 23:36 28,160 --a------ C:\Windows\System32\sxproxy.dll
2008-06-29 02:47 . 2008-01-18 23:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-06-29 02:46 . 2008-01-18 23:33 5,714,432 --a------ C:\Windows\System32\logon.scr
2008-06-29 02:44 . 2008-01-18 23:36 2,153,472 --a------ C:\Windows\System32\oobefldr.dll
2008-06-29 02:43 . 2008-01-18 23:38 4,595,712 --a------ C:\Windows\System32\AuthFWSnapin.dll
2008-06-29 02:42 . 2008-01-18 23:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-06-29 02:40 . 2008-01-18 23:33 3,216,896 --a------ C:\Windows\System32\WinSAT.exe
2008-06-29 02:38 . 2008-01-18 23:36 2,588,160 --a------ C:\Windows\System32\UIHub.dll
2008-06-29 02:27 . 2008-06-29 02:31 <DIR> d-------- C:\
07d462a7df11e081b5df437d6d2c38ce
2008-06-29 02:27 . 2008-01-18 23:33 44,032 --a------ C:\Windows\System32\cbsra.exe
2008-06-29 02:26 . 2008-06-30 00:17 327,680 --a------ C:\Windows\SPInstall.etl
2008-06-29 01:21 . 2008-06-29 01:23 <DIR> d-------- C:\Program Files\Panda Security
2008-06-29 00:24 . 2008-06-29 00:24 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-06-29 00:24 . 2008-06-29 00:24 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-06-29 00:23 . 2008-06-29 00:23 <DIR> d-------- C:\Users\Anthony\AppData\Roaming\SUPERAntiSpyware.com
2008-06-29 00:23 . 2008-06-29 00:23 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-06-28 22:52 . 2008-06-28 22:52 <DIR> d-------- C:\Users\Anthony\AppData\Roaming\Malwarebytes
2008-06-28 22:52 . 2008-06-28 22:52 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-06-28 22:52 . 2008-06-28 22:52 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-06-28 22:52 . 2008-06-29 00:04 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-28 22:52 . 2008-06-28 14:16 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-06-28 22:52 . 2008-06-28 14:16 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-06-28 20:53 . 2008-06-28 20:53 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-28 20:43 . 2008-06-28 21:06 <DIR> d-------- C:\Users\Anthony\.housecall6.6
2008-06-28 18:56 . 2008-06-30 16:04 <DIR> d-------- C:\Users\Anthony\AppData\Roaming\Spyware Terminator
2008-06-28 18:56 . 2008-06-30 16:08 <DIR> d-------- C:\Users\All Users\Spyware Terminator
2008-06-28 18:56 . 2008-06-30 16:08 <DIR> d-------- C:\ProgramData\Spyware Terminator
2008-06-28 18:56 . 2008-06-28 18:58 <DIR> d-------- C:\Program Files\Crawler
2008-06-28 18:56 . 2008-06-28 18:56 141,312 --a------ C:\Windows\System32\drivers\sp_rsdrv2.sys
2008-06-28 18:55 . 2008-06-30 16:08 <DIR> d-------- C:\Program Files\Spyware Terminator
2008-06-28 18:01 . 2008-06-28 18:06 <DIR> d-------- C:\Users\All Users\Lavasoft
2008-06-28 18:01 . 2008-06-28 18:06 <DIR> d-------- C:\ProgramData\Lavasoft
2008-06-28 18:01 . 2008-06-28 18:01 <DIR> d-------- C:\Program Files\Lavasoft
2008-06-28 18:00 . 2008-06-29 00:20 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-28 17:20 . 2008-06-28 17:20 <DIR> d-------- C:\Windows\System32\vi
2008-06-28 17:20 . 2008-06-29 00:04 <DIR> d-------- C:\Windows\System32\gI5
2008-06-28 17:20 . 2008-06-28 17:20 <DIR> d-------- C:\Temp\syschk3
2008-06-28 17:20 . 2008-06-30 16:43 <DIR> d-------- C:\Temp
2008-06-28 17:20 . 2008-06-28 17:20 537 --a------ C:\Users\Anthony\414.bat
2008-06-27 23:55 . 2008-06-27 23:55 <DIR> d-------- C:\Users\Anthony\AppData\Roaming\iWin
2008-06-27 23:54 . 2008-06-28 00:55 <DIR> d-------- C:\Program Files\Risk_at
2008-06-27 23:38 . 2008-06-27 23:38 <DIR> d-------- C:\Program Files\ReflexiveArcade
2008-06-27 22:09 . 2008-06-27 22:09 <DIR> d-------- C:\Users\All Users\Trymedia
2008-06-27 22:09 . 2008-06-27 22:09 <DIR> d-------- C:\ProgramData\Trymedia
2008-06-27 22:09 . 2008-06-27 23:18 <DIR> d-------- C:\Program Files\Games
2008-06-22 00:34 . 2008-06-22 03:10 <DIR> d-------- C:\Program Files\Scrabble_at
2008-06-22 00:23 . 2008-06-22 00:23 <DIR> d-------- C:\Users\Anthony\AppData\Roaming\GamesCafe
2008-06-22 00:23 . 2008-06-22 00:23 4,096 --a------ C:\Windows\d3dx.dat
2008-06-22 00:22 . 2008-06-22 00:27 <DIR> d-------- C:\Program Files\CLUEClassic_at
2008-06-21 22:58 . 2008-06-22 03:10 <DIR> d-------- C:\Program Files\Monopoly_at
2008-06-21 22:29 . 2008-06-21 22:29 <DIR> d-------- C:\Users\Anthony\AppData\Roaming\SpinTop
2008-06-21 22:29 . 2008-06-22 00:27 <DIR> d-a------ C:\Users\All Users\TEMP
2008-06-21 22:29 . 2008-06-22 00:27 <DIR> d-a------ C:\ProgramData\TEMP
2008-06-15 13:23 . 2008-04-23 00:42 428,544 --a------ C:\Windows\System32\EncDec.dll
2008-06-15 13:23 . 2008-04-23 00:42 293,376 --a------ C:\Windows\System32\psisdecd.dll
2008-06-15 13:23 . 2008-04-23 00:41 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-06-15 13:23 . 2008-01-19 03:33 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-06-15 13:23 . 2008-01-19 03:33 69,632 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-06-15 13:23 . 2008-04-23 00:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-06-15 11:23 . 2008-05-09 21:33 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
2008-06-15 11:22 . 2008-03-07 22:08 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-06-15 11:22 . 2008-03-08 00:21 1,695,744 --a------ C:\Windows\System32\gameux.dll
2008-06-15 11:22 . 2008-04-24 22:12 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-06-15 11:22 . 2008-04-26 04:08 1,314,816 --a------ C:\Windows\System32\quartz.dll
2008-06-15 11:22 . 2008-04-25 00:35 826,880 --a------ C:\Windows\System32\wininet.dll
2008-06-14 20:39 . 2008-06-14 20:39 <DIR> d-------- C:\Program Files\Telefonica
2008-06-14 20:39 . 2003-03-18 15:02 58,938 --a------ C:\Windows\System32\temp.007
2008-06-14 20:39 . 2003-03-18 15:02 58,938 --a------ C:\Windows\System32\temp.006
2008-06-14 20:39 . 1996-11-17 11:00 18,192 --a------ C:\Windows\System32\~GLH000e.TMP
2008-06-09 18:28 . 2003-03-18 15:02 58,938 --a------ C:\Windows\System32\temp.005
2008-06-09 18:28 . 2003-03-18 15:02 58,938 --a------ C:\Windows\System32\temp.004
2008-06-09 18:28 . 1996-11-17 11:00 18,192 --a------ C:\Windows\System32\~GLH000d.TMP
2008-06-09 18:10 . 2008-06-30 16:30 196,608 --a------ C:\Windows\System32\Ikeext.etl
2008-06-09 17:49 . 2003-03-18 15:02 58,938 --a------ C:\Windows\System32\temp.003
2008-06-09 17:48 . 2003-03-18 15:02 58,938 --a------ C:\Windows\System32\temp.002
2008-06-09 17:48 . 1996-11-17 11:00 18,192 --a------ C:\Windows\System32\~GLH000c.TMP
2008-06-09 13:45 . 2003-03-18 15:02 58,938 --a------ C:\Windows\System32\temp.001
2008-06-09 13:45 . 2003-03-18 15:02 58,938 --a------ C:\Windows\System32\temp.000
2008-06-09 13:45 . 2003-03-18 15:02 24,576 --a------ C:\Windows\System32\msxml3a.dll
2008-06-09 13:45 . 1996-11-17 11:00 18,192 --a------ C:\Windows\System32\~GLH000b.TMP
2008-05-27 15:48 . 2008-05-27 15:49 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\Windows\System32\lsdelete.exe
2008-05-08 18:52 . 2008-05-08 18:52 <DIR> d-------- C:\Users\Anthony\AppData\Roaming\Template
2008-05-08 18:52 . 2008-05-08 19:02 222 --a------ C:\Users\Anthony\AppData\Roaming\wklnhst.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 05:06 174 --sha-w C:\Program Files\desktop.ini
2008-06-30 04:55 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-30 04:55 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-06-30 04:55 --------- d-----w C:\Program Files\Windows Mail
2008-06-30 04:55 --------- d-----w C:\Program Files\Windows Journal
2008-06-30 04:55 --------- d-----w C:\Program Files\Windows Defender
2008-06-30 04:55 --------- d-----w C:\Program Files\Windows Collaboration
2008-06-30 04:55 --------- d-----w C:\Program Files\Windows Calendar
2008-06-30 04:22 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-06-30 04:22 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-06-24 23:41 --------- d-----w C:\Users\Anthony\AppData\Roaming\IMVU
2008-06-22 17:53 --------- d-----w C:\Program Files\IMVU
2008-06-18 04:08 --------- d-----w C:\ProgramData\Microsoft Help
2008-06-15 17:20 --------- d-----w C:\ProgramData\Viewpoint
2008-06-15 17:20 --------- d-----w C:\Program Files\AIM6
2008-06-15 17:19 --------- d-----w C:\ProgramData\AOL
2008-06-15 17:18 --------- d-----w C:\ProgramData\AOL Downloads
2008-06-15 15:14 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-06-15 15:14 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-06-15 15:14 10,671 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-06-15 15:14 --------- d-----w C:\Program Files\Symantec
2008-06-15 15:14 --------- d-----w C:\Program Files\Norton Internet Security
2008-06-15 15:14 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-09 23:52 --------- d-----w C:\ProgramData\WildTangent
2008-06-02 22:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-27 20:05 --------- d-----w C:\ProgramData\Skype
2008-05-27 20:05 --------- d-----w C:\Program Files\Skype
2008-05-27 19:53 --------- d-----w C:\Program Files\MSBuild
2008-04-29 15:20 15,648 ----a-w C:\Windows\system32\drivers\NSDriver.sys
2008-04-29 15:19 15,648 ----a-w C:\Windows\system32\drivers\Awrtrd.sys
2008-04-29 15:19 12,960 ----a-w C:\Windows\system32\drivers\Awrtpd.sys
2008-03-08 04:19 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-03-08 04:19 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-03-08 04:19 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-03-08 04:19 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-03-08 01:58 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-18 23:33 1233920]
"HPAdvisor"="C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2006-11-21 20:36 1474560]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-18 23:36 2153472 C:\Windows\System32\oobefldr.dll]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-03-27 15:22 4670968]
"Aim6"="" []
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-18 23:33 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-18 23:38 1008184]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-15 01:02 815104]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"osCheck"="c:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 09:18 22696]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-11-24 19:33 167936]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 14:58 159744]
"HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-06-05 09:12 71176]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2006-10-18 13:56 317152]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2006-10-18 13:32 472800]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2006-12-18 02:19 77824]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-02-26 18:54 131072]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-02-26 18:54 151552]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-02-26 18:54 126976]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 20:51 583048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"ServicioSpeedy"="C:\Program Files\Telefonica\Speedy\SATCfgApp.exe" [2004-11-15 12:32 45056]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-06-28 18:56 1817600]
"Malwarebytes Anti-Malware Reboot"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-06-28 14:16 1171064]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2006-11-07 21:39 44128]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Control Panel.lnk - C:\Program Files\ESI\QuataFire610\QuataPan.exe [2007-12-25 23:20:48 634880]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Connections.lnk - C:\Program Files\HP Connections\6811507\Program\HP Connections.exe [2006-12-18 02:02:11 34520]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 05:33:46 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"DisableTaskMgr"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{986DBCC3-258C-478A-B7BC-99F1DB270CF8}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F629E84D-94B6-4C41-872B-5620E934DE41}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{708E4799-8618-4D37-BB83-7435029E4E1B}"= UDP:C:\Program Files\HP\QuickPlay\QP.exe:QP
"{54A94869-6808-4372-B4AB-250AB0111E97}"= TCP:C:\Program Files\HP\QuickPlay\QP.exe:QP
"{7D5DA446-5191-41B4-8CA8-AABE993A2C4D}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{6C384080-1347-4BDB-BB76-09B21B18A5F0}"= C:\Program Files\HP Connections\6811507\Program\HP Connections:HP Connections
"{E3C0C252-0A38-4361-AF59-1D8FB0E983C5}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{E77BB2B5-46F0-4DFC-961D-332C4023D99F}"= TCP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{B140A5A1-8FFE-44B1-804E-C4DB0150BB5E}"= UDP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{EFE4B2F2-9DAD-441F-B249-26F7546828FE}"= TCP:C:\Program Files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{8418196E-2324-4FC8-9146-ABEC4B16444F}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{02FF0AB7-62F2-451D-9EC5-1BE315AAC2E1}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D6FBBB6A-F9D7-423F-ACDB-7B402A3175D4}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{2FAC9CA2-5D93-4E24-A619-61A342200713}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{009D3011-BCB6-4E33-95E9-869B1644CA82}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{736206B0-1487-4C58-A8FD-32920215B143}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{2411EBD5-3F4A-41D8-A065-3CF5352A949B}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{1BA64FBF-9B3E-4A81-BBBD-BF723D8CD8FA}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{879B56AE-7DB5-4EE2-8FCD-BFD14E5A04AB}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{2C04200A-8E81-4790-BD2A-C32C9561A8F4}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{52FEA2E2-1952-4785-98DF-BDD8D941F7E6}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{EC74C13F-85D8-4C2A-8931-C1C9F7DA5219}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{CFE60B9A-3479-40F4-8217-9C936C3CD11D}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{F7E73997-8BC9-4BD9-8F79-1F915C68D4F6}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{2309CB30-3BBE-4FD3-9EAF-0B64B1958345}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{604F5CF6-ED23-4378-8288-83AA814960E9}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{A54C2ABA-1A68-4336-B83D-9E785A8E2B49}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{9E0B6EE7-3FD8-455C-8687-F9A98E3E70E7}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{6561F3CE-3793-42EA-B1AC-8AEE4DC31BAD}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{98570D65-15F6-45C2-89B5-2D8D1AFC14E3}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{B1C320A6-F881-4FCF-9A20-62F4654B631B}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{C5D0A87F-3361-4EA7-95ED-C5B4F9346261}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{0567E9F0-BC66-4899-AE8A-2EFC75139EDD}"= UDP:C:\Program Files\AIM6\aim6.exe:AIM
"{2B963BA5-5FE0-4F42-BB4A-9053CA3C481F}"= TCP:C:\Program Files\AIM6\aim6.exe:AIM
"TCP Query User{C0025760-D972-493F-ACC5-DB2008AA939A}C:\\program files\\camfrog\\camfrog video chat\\camfrog video chat.exe"= UDP:C:\program files\camfrog\camfrog video chat\camfrog video chat.exe:Camfrog Client Module
"UDP Query User{FD97C478-F252-4ABF-9878-E372D228CF3A}C:\\program files\\camfrog\\camfrog video chat\\camfrog video chat.exe"= TCP:C:\program files\camfrog\camfrog video chat\camfrog video chat.exe:Camfrog Client Module
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20070718.002\IDSvix86.sys [2007-05-30 17:53]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\Windows\system32\drivers\sp_rsdrv2.sys [2008-06-28 18:56]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-02-26 18:54]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 20:55]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7216adf9-5d4f-11dc-91a4-001b241e5061}]
\shell\AutoRun\command - F:\system\viewer\Viewer.exe
\shell\View your videos\command - F:\system\viewer\Viewer.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8509413f-da6f-11dc-a056-001b241e5061}]
\shell\Auto\command - Start.exe
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ab096ac-083c-11dc-ad86-001b241e5061}]
\shell\AutoRun\command - F:\setupSNK.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce0bcd6b-d29f-11dc-acb3-001b241e5061}]
\shell\AutoRun\command - G:\LaunchU3.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-06-24 20:03:00 C:\Windows\Tasks\EasyShare Registration Task.job"
- C:\Windows\system32\rundll32.exeZC:\PROGRA~2\Kodak\EasyShareSetup\$REGIS~1\Registration_7.5.20.2.sxt _RegistrationOffer@16
"2008-06-30 05:15:06 C:\Windows\Tasks\User_Feed_Synchronization-{15610ED6-3B8B-45FC-B7E3-50D7FFCF0C34}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-06-30 16:49:05
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-30 16:50:38
ComboFix-quarantined-files.txt 2008-06-30 20:50:15
Pre-Run: 67,402,092,544 bytes free
Post-Run: 68,920,688,640 bytes free
296 --- E O F --- 2008-06-26 15:55:28