[Rolando]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:51 PM, on 5/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4081022
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [8169Diag] C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe /hw
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoft...s/as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1224862191296
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.h...ctDetection.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe

--
End of file - 9396 bytes

[Advertisements]

ComboFix 09-05-26.05 - David Evaul 05/27/2009 13:59.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2249 [GMT -5:00]
Running from: g:\statement of fees 200809\ComboFix.exe
AV: Panda Internet Security 2008 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
FW: Panda Internet Security 2008 *disabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}
.

((((((((((((((((((((((((( Files Created from 2009-04-27 to 2009-05-27 )))))))))))))))))))))))))))))))
.

2009-05-27 13:36 . 2009-05-27 13:36 -------- d-----w c:\program files\ERUNT
2009-05-20 16:50 . 2009-05-20 16:50 0 ----a-w c:\windows\nsreg.dat
2009-05-20 16:50 . 2009-05-20 16:50 -------- d-----w c:\documents and settings\David Evaul\Local Settings\Application Data\Mozilla
2009-05-19 21:18 . 2009-05-19 21:18 71204 ---ha-w c:\windows\system32\mlfcache.dat
2009-05-19 21:02 . 2009-05-19 21:02 -------- d-----w c:\program files\iPod
2009-05-19 21:02 . 2009-05-19 21:02 -------- d-----w c:\program files\iTunes
2009-05-19 21:02 . 2009-05-19 21:02 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-19 20:36 . 2001-08-18 03:36 5632 ----a-w c:\windows\system32\ptpusb.dll
2009-05-19 20:36 . 2008-04-14 10:42 159232 ----a-w c:\windows\system32\ptpusd.dll
2009-05-19 20:36 . 2008-04-14 05:15 15104 -c--a-w c:\windows\system32\dllcache\usbscan.sys
2009-05-19 20:36 . 2008-04-14 05:15 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-05-15 19:27 . 2009-05-15 19:27 -------- d-sh--w c:\documents and settings\David Evaul\IECompatCache
2009-05-15 19:27 . 2009-05-15 19:27 -------- d-sh--w c:\documents and settings\David Evaul\PrivacIE
2009-05-15 19:23 . 2009-05-15 19:23 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-15 19:22 . 2009-05-15 19:22 -------- d-sh--w c:\documents and settings\David Evaul\IETldCache
2009-05-15 19:20 . 2009-05-15 19:20 -------- d-----w c:\windows\ie8updates
2009-05-15 19:20 . 2009-04-25 05:30 102400 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-15 19:18 . 2009-05-15 19:19 -------- dc-h--w c:\windows\ie8
2009-05-15 19:10 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-15 19:10 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-05-15 19:10 . 2009-02-06 10:39 35328 -c----w c:\windows\system32\dllcache\sc.exe
2009-05-15 19:10 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-15 19:10 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-05-15 19:10 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-05-15 19:10 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-15 19:10 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-15 19:10 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-15 19:10 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-15 19:10 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-15 15:33 . 2009-05-15 16:25 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-14 19:57 . 2009-05-15 16:27 -------- d-----w c:\program files\MoSo Anti-Malware
2009-05-14 18:01 . 2009-05-27 17:26 117760 ----a-w c:\documents and settings\David Evaul\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-14 17:05 . 2009-05-14 17:05 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-14 17:05 . 2009-05-15 21:49 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-14 17:05 . 2009-05-14 17:05 -------- d-----w c:\documents and settings\David Evaul\Application Data\SUPERAntiSpyware.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 18:05 . 2008-10-24 16:44 385572 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck
2009-05-27 18:05 . 2008-10-24 16:44 1204 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck
2009-05-27 18:05 . 2008-10-24 16:40 385572 ----a-w c:\windows\system32\drivers\APPFCONT.DAT
2009-05-27 18:05 . 2008-10-24 16:40 1204 ----a-w c:\windows\system32\drivers\APPFLTR.CFG
2009-05-27 17:50 . 2009-05-27 17:50 -------- d-----w c:\program files\Trend Micro
2009-05-27 17:16 . 2009-05-27 17:16 -------- d-----w c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-05-27 15:14 . 2009-05-27 15:14 -------- d-----w c:\documents and settings\Administrator\Application Data\Windows Search
2009-05-27 13:40 . 2009-01-26 22:43 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-27 13:39 . 2009-02-16 20:39 3371383 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-26 18:20 . 2009-01-26 22:43 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 18:19 . 2009-01-26 22:43 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-19 22:10 . 2008-10-24 18:47 -------- d-----w c:\documents and settings\David Evaul\Application Data\Apple Computer
2009-05-19 21:18 . 2008-11-30 16:48 -------- d-----w c:\program files\Safari
2009-05-19 21:02 . 2008-10-24 18:46 -------- d-----w c:\program files\Common Files\Apple
2009-05-14 18:04 . 2008-10-24 15:57 -------- d-----w c:\program files\CCleaner
2009-05-14 18:02 . 2008-10-24 15:55 -------- d-----w c:\program files\Diskeeper Corporation
2009-04-23 16:22 . 2008-10-22 06:38 141568 ----a-w c:\windows\system32\drivers\Rtenicxp.sys
2009-04-18 14:21 . 2009-03-06 23:16 -------- d-----w c:\program files\a-squared Free
2009-04-16 02:58 . 2009-04-16 02:58 69632 ----a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 4.28.17.0\SetupAdmin.exe
2009-04-02 21:29 . 2009-04-02 21:29 75048 ----a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-30 22:02 . 2009-03-30 22:02 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-30 22:01 . 2009-03-30 22:01 -------- d-----w c:\program files\Bonjour
2009-03-30 22:01 . 2009-03-30 22:00 -------- d-----w c:\program files\QuickTime
2009-03-28 21:45 . 2008-10-22 03:56 84464 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-28 21:45 . 2009-03-28 21:45 -------- d-----w c:\documents and settings\David Evaul\Application Data\Intuit
2009-03-28 21:45 . 2009-03-28 21:45 -------- d-----w c:\program files\Common Files\AnswerWorks 5.0
2009-03-28 21:44 . 2009-03-28 21:44 -------- d-----w c:\documents and settings\All Users\Application Data\Intuit
2009-03-28 21:44 . 2009-03-28 21:44 -------- d-----w c:\program files\Common Files\Intuit
2009-03-28 21:43 . 2009-03-28 21:43 -------- d-----w c:\program files\TurboTax
2009-03-19 21:32 . 2009-03-19 21:32 23400 ----a-w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 21:32 . 2008-10-24 18:47 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 09:34 . 2008-04-25 16:16 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 09:34 . 2008-04-25 16:16 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 09:33 . 2008-04-25 16:16 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 09:33 . 2008-04-25 16:16 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 09:32 . 2008-04-25 16:16 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 09:32 . 2008-04-25 16:16 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 09:31 . 2008-04-25 16:16 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 09:31 . 2008-04-25 16:16 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 09:31 . 2008-04-25 16:16 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 09:22 . 2008-04-25 16:16 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2008-04-25 16:16 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-06 04:59 . 2009-03-30 21:59 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-06 04:59 . 2009-03-30 21:59 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-03-03 17:18 . 2008-12-17 22:08 73728 ----a-w c:\windows\system32\RtNicProp32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-15 1830128]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"8169Diag"="c:\program files\Realtek\Diagnostics Utility\8169Diag.exe" [2008-02-26 909312]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" [2007-11-23 406832]
"SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2008\Inicio.exe" [2007-07-11 27952]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-01-31 16860672]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2007-02-16 00:02 50736 ----a-w c:\windows\system32\avldr.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/3/2009 4:52 PM 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [10/24/2008 11:40 AM 71608]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [10/24/2008 11:40 AM 51256]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [10/24/2008 11:40 AM 21816]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [10/24/2008 11:40 AM 191672]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [10/24/2008 11:40 AM 132664]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [12/22/2008 11:06 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/22/2008 11:05 AM 55024]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [10/24/2008 11:39 AM 38968]
R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [10/24/2008 11:40 AM 37304]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [10/24/2008 11:40 AM 30648]
R2 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [10/24/2008 11:40 AM 24760]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [10/24/2008 11:39 AM 178872]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?]
R3 NETIMFLT01050097;PANDA NDIS IM Filter Miniport v1.5.0.97;c:\windows\system32\drivers\netimflt.sys [10/24/2008 11:40 AM 143160]
R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/22/2008 11:06 AM 7408]
S2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [10/21/2008 10:51 PM 8960]
S3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [10/21/2008 10:51 PM 11264]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [10/21/2008 10:51 PM 16640]

--- Other Services/Drivers In Memory ---

*Deregistered* - sdthook

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Panda Security\Panda Internet Security 2008\pavlsp.dll
FF - ProfilePath - c:\documents and settings\David Evaul\Application Data\Mozilla\Firefox\Profiles\ogztdy0m.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-27 14:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\avldr.dll

- - - - - - - > 'explorer.exe'(27068)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-27 14:01
ComboFix-quarantined-files.txt 2009-05-27 19:01
ComboFix2.txt 2009-05-27 18:09

Pre-Run: 288,033,173,504 bytes free
Post-Run: 288,015,142,912 bytes free

208 --- E O F --- 2009-03-13 08:01

[Rolando]

ComboFix 09-05-26.05 - David Evaul 05/27/2009 13:59.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2249 [GMT -5:00]
Running from: g:\statement of fees 200809\ComboFix.exe
AV: Panda Internet Security 2008 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
FW: Panda Internet Security 2008 *disabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}
.

((((((((((((((((((((((((( Files Created from 2009-04-27 to 2009-05-27 )))))))))))))))))))))))))))))))
.

2009-05-27 13:36 . 2009-05-27 13:36 -------- d-----w c:\program files\ERUNT
2009-05-20 16:50 . 2009-05-20 16:50 0 ----a-w c:\windows\nsreg.dat
2009-05-20 16:50 . 2009-05-20 16:50 -------- d-----w c:\documents and settings\David Evaul\Local Settings\Application Data\Mozilla
2009-05-19 21:18 . 2009-05-19 21:18 71204 ---ha-w c:\windows\system32\mlfcache.dat
2009-05-19 21:02 . 2009-05-19 21:02 -------- d-----w c:\program files\iPod
2009-05-19 21:02 . 2009-05-19 21:02 -------- d-----w c:\program files\iTunes
2009-05-19 21:02 . 2009-05-19 21:02 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-19 20:36 . 2001-08-18 03:36 5632 ----a-w c:\windows\system32\ptpusb.dll
2009-05-19 20:36 . 2008-04-14 10:42 159232 ----a-w c:\windows\system32\ptpusd.dll
2009-05-19 20:36 . 2008-04-14 05:15 15104 -c--a-w c:\windows\system32\dllcache\usbscan.sys
2009-05-19 20:36 . 2008-04-14 05:15 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-05-15 19:27 . 2009-05-15 19:27 -------- d-sh--w c:\documents and settings\David Evaul\IECompatCache
2009-05-15 19:27 . 2009-05-15 19:27 -------- d-sh--w c:\documents and settings\David Evaul\PrivacIE
2009-05-15 19:23 . 2009-05-15 19:23 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-15 19:22 . 2009-05-15 19:22 -------- d-sh--w c:\documents and settings\David Evaul\IETldCache
2009-05-15 19:20 . 2009-05-15 19:20 -------- d-----w c:\windows\ie8updates
2009-05-15 19:20 . 2009-04-25 05:30 102400 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-15 19:18 . 2009-05-15 19:19 -------- dc-h--w c:\windows\ie8
2009-05-15 19:10 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-15 19:10 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-05-15 19:10 . 2009-02-06 10:39 35328 -c----w c:\windows\system32\dllcache\sc.exe
2009-05-15 19:10 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-15 19:10 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-05-15 19:10 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-05-15 19:10 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-15 19:10 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-15 19:10 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-15 19:10 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-15 19:10 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-15 15:33 . 2009-05-15 16:25 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-14 19:57 . 2009-05-15 16:27 -------- d-----w c:\program files\MoSo Anti-Malware
2009-05-14 18:01 . 2009-05-27 17:26 117760 ----a-w c:\documents and settings\David Evaul\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-14 17:05 . 2009-05-14 17:05 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-14 17:05 . 2009-05-15 21:49 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-14 17:05 . 2009-05-14 17:05 -------- d-----w c:\documents and settings\David Evaul\Application Data\SUPERAntiSpyware.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 18:05 . 2008-10-24 16:44 385572 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck
2009-05-27 18:05 . 2008-10-24 16:44 1204 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck
2009-05-27 18:05 . 2008-10-24 16:40 385572 ----a-w c:\windows\system32\drivers\APPFCONT.DAT
2009-05-27 18:05 . 2008-10-24 16:40 1204 ----a-w c:\windows\system32\drivers\APPFLTR.CFG
2009-05-27 17:50 . 2009-05-27 17:50 -------- d-----w c:\program files\Trend Micro
2009-05-27 17:16 . 2009-05-27 17:16 -------- d-----w c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-05-27 15:14 . 2009-05-27 15:14 -------- d-----w c:\documents and settings\Administrator\Application Data\Windows Search
2009-05-27 13:40 . 2009-01-26 22:43 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-27 13:39 . 2009-02-16 20:39 3371383 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-26 18:20 . 2009-01-26 22:43 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 18:19 . 2009-01-26 22:43 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-19 22:10 . 2008-10-24 18:47 -------- d-----w c:\documents and settings\David Evaul\Application Data\Apple Computer
2009-05-19 21:18 . 2008-11-30 16:48 -------- d-----w c:\program files\Safari
2009-05-19 21:02 . 2008-10-24 18:46 -------- d-----w c:\program files\Common Files\Apple
2009-05-14 18:04 . 2008-10-24 15:57 -------- d-----w c:\program files\CCleaner
2009-05-14 18:02 . 2008-10-24 15:55 -------- d-----w c:\program files\Diskeeper Corporation
2009-04-23 16:22 . 2008-10-22 06:38 141568 ----a-w c:\windows\system32\drivers\Rtenicxp.sys
2009-04-18 14:21 . 2009-03-06 23:16 -------- d-----w c:\program files\a-squared Free
2009-04-16 02:58 . 2009-04-16 02:58 69632 ----a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 4.28.17.0\SetupAdmin.exe
2009-04-02 21:29 . 2009-04-02 21:29 75048 ----a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-30 22:02 . 2009-03-30 22:02 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-30 22:01 . 2009-03-30 22:01 -------- d-----w c:\program files\Bonjour
2009-03-30 22:01 . 2009-03-30 22:00 -------- d-----w c:\program files\QuickTime
2009-03-28 21:45 . 2008-10-22 03:56 84464 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-28 21:45 . 2009-03-28 21:45 -------- d-----w c:\documents and settings\David Evaul\Application Data\Intuit
2009-03-28 21:45 . 2009-03-28 21:45 -------- d-----w c:\program files\Common Files\AnswerWorks 5.0
2009-03-28 21:44 . 2009-03-28 21:44 -------- d-----w c:\documents and settings\All Users\Application Data\Intuit
2009-03-28 21:44 . 2009-03-28 21:44 -------- d-----w c:\program files\Common Files\Intuit
2009-03-28 21:43 . 2009-03-28 21:43 -------- d-----w c:\program files\TurboTax
2009-03-19 21:32 . 2009-03-19 21:32 23400 ----a-w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 21:32 . 2008-10-24 18:47 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 09:34 . 2008-04-25 16:16 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 09:34 . 2008-04-25 16:16 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 09:33 . 2008-04-25 16:16 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 09:33 . 2008-04-25 16:16 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 09:32 . 2008-04-25 16:16 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 09:32 . 2008-04-25 16:16 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 09:31 . 2008-04-25 16:16 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 09:31 . 2008-04-25 16:16 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 09:31 . 2008-04-25 16:16 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 09:22 . 2008-04-25 16:16 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2008-04-25 16:16 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-06 04:59 . 2009-03-30 21:59 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-06 04:59 . 2009-03-30 21:59 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-03-03 17:18 . 2008-12-17 22:08 73728 ----a-w c:\windows\system32\RtNicProp32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-15 1830128]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"8169Diag"="c:\program files\Realtek\Diagnostics Utility\8169Diag.exe" [2008-02-26 909312]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" [2007-11-23 406832]
"SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2008\Inicio.exe" [2007-07-11 27952]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-01-31 16860672]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2007-02-16 00:02 50736 ----a-w c:\windows\system32\avldr.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/3/2009 4:52 PM 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [10/24/2008 11:40 AM 71608]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [10/24/2008 11:40 AM 51256]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [10/24/2008 11:40 AM 21816]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [10/24/2008 11:40 AM 191672]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [10/24/2008 11:40 AM 132664]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [12/22/2008 11:06 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/22/2008 11:05 AM 55024]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [10/24/2008 11:39 AM 38968]
R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [10/24/2008 11:40 AM 37304]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [10/24/2008 11:40 AM 30648]
R2 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [10/24/2008 11:40 AM 24760]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [10/24/2008 11:39 AM 178872]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?]
R3 NETIMFLT01050097;PANDA NDIS IM Filter Miniport v1.5.0.97;c:\windows\system32\drivers\netimflt.sys [10/24/2008 11:40 AM 143160]
R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/22/2008 11:06 AM 7408]
S2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [10/21/2008 10:51 PM 8960]
S3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [10/21/2008 10:51 PM 11264]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [10/21/2008 10:51 PM 16640]

--- Other Services/Drivers In Memory ---

*Deregistered* - sdthook

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Panda Security\Panda Internet Security 2008\pavlsp.dll
FF - ProfilePath - c:\documents and settings\David Evaul\Application Data\Mozilla\Firefox\Profiles\ogztdy0m.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-27 14:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\avldr.dll

- - - - - - - > 'explorer.exe'(27068)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-27 14:01
ComboFix-quarantined-files.txt 2009-05-27 19:01
ComboFix2.txt 2009-05-27 18:09

Pre-Run: 288,033,173,504 bytes free
Post-Run: 288,015,142,912 bytes free

208 --- E O F --- 2009-03-13 08:01