[soer10705]

Hey guys,
I recently got infected with something! Here's what happened so far:
1. JIT debugger was popping up, but it hasnt returned in 2 days. I dont know if I actually did anything to get it off my machine.
2. Any and all links within search engines get redirected.
3. I get a few pop up tabs, but not frequently.
4. Firefox is working normally, minus the redirects. IE has totally stopped working. The program briefly tries to open, but closes. It is not running in the TSKMAN.

I have followed the steps in the Guide to completion, even though HiJackThis returned 0 bad entries. I will copy the results of all tasks below.

Any help will be greatly appreciated!!

Thanks!!!

Malwarebytes' Anti-Malware 1.44
Database version: 3878
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3/17/2010 10:04:17 PM
mbam-log-2010-03-17 (22-04-17).txt

Scan type: Quick Scan
Objects scanned: 163668
Time elapsed: 9 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-17 21:10:21
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\skyem\LOCALS~1\Temp\awlyypow.sys


---- System - GMER 1.0.15 ----

SSDT 8A2B1120 ZwAlertResumeThread
SSDT 8A2B0FD0 ZwAlertThread
SSDT 8A36E900 ZwAllocateVirtualMemory
SSDT 8A339CD8 ZwConnectPort
SSDT 8A2FB6B8 ZwCreateMutant
SSDT 8A36F778 ZwCreateThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xAE3F0350]
SSDT 8A2B06E8 ZwFreeVirtualMemory
SSDT 8A2B12D0 ZwImpersonateAnonymousToken
SSDT 8A2B11F8 ZwImpersonateThread
SSDT 8A374A88 ZwMapViewOfSection
SSDT 8A3F9C70 ZwOpenEvent
SSDT 8A2B0610 ZwOpenProcessToken
SSDT 8A2B0A50 ZwOpenThreadToken
SSDT 8A37BF58 ZwQueryValueKey
SSDT 8A2B0100 ZwResumeThread
SSDT 8A2B0B28 ZwSetContextThread
SSDT 8A2B0898 ZwSetInformationProcess
SSDT 8A2B0CE0 ZwSetInformationThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xAE3F0580]
SSDT 8A3DBE90 ZwSuspendProcess
SSDT 8A2B0E90 ZwSuspendThread
SSDT 8A2B0538 ZwTerminateProcess
SSDT 8A2B0DB8 ZwTerminateThread
SSDT 8A2B07C0 ZwUnmapViewOfSection
SSDT 8A36DF30 ZwWriteVirtualMemory

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device -> \Driver\atapi \Device\Harddisk0\DR0 8A56FCA1

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet003\Control\Session Manager@PendingFileRenameOperations ???5?????5????d??#??"NetBT" "Tcpip" "{0B3616E4-1B82-4177-B7C1-8C1CF5FDE4F9}"?"NetBT" "Tcpip" "{3424C1E5-7052-42D9-9F5F-4B3AEF19AFBF}"?"NetBT" "Tcpip" "{B1F44653-09B5-4162-9B13-626BF9F3C282}"?"NetBT" "Tcpip" "{7BDFF552-44E3-4AB3-A78C-D8DB4C538523}"?"NetBT" "Tcpip" "{7C2058C4-F529-417D-99F1-80EE97CC975E}"?"NetBT" "Tcpip" "NdisWanIp"??CC-4567-8CDF-7C7941C2FE1E}"?"NetBT" "Tcpip" "{7BDFF552-44E3-4AB3-A78C-D8DB4C538523}"?"NetBT" "Tcpip" "{7C2058C4-F529-417D-99F1-80EE97CC975E}"?"NetBT" "Tcpip" "NdisWanIp"??A??system32\DRIVERS\silabenm.sys????????5?????????eda???????4?-?5?5?5?????#?#???????????4???????3???????????L?g??????<??5???1????h?????system32\DRIVERS\silabser.sys?????\??5??????????????Silicon Labs CP210x USB to UART Bridge Driver????5?5?5?5?5?5?5???????5???e??????Extended Base??????5?????5??INTEL_USB???"Tcpip" "{0B3616E4-1B82-4177-B7C1-8C1CF5FDE4F9}"?"Tcpip" "{3424C1E5-7052-42D9-9F5F-4B3AEF19AFBF}"?"Tcpip" "{B1F44653-09B5-4162-9B13-626BF9F3C282}"?"Tcpip" "{7BDFF552-44E3-4AB3-A78C-D8DB4C538523}"?"Tcpip" "{7C205

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----




OTL logfile created on: 3/17/2010 10:07:35 PM - Run 1
OTL by OldTimer - Version 3.1.37.2 Folder = C:\Documents and Settings\skyem\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 46.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 45.02 Gb Free Space | 60.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SKYEM135LT
Current User Name: skyem
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/03/17 22:05:42 | 000,556,032 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\skyem\Desktop\OTL.exe
PRC - [2010/01/15 23:09:37 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2008/10/22 23:49:24 | 000,188,416 | ---- | M] () -- c:\altera\81\quartus\bin\jtagserver.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/10/08 14:27:02 | 000,794,624 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2007/10/08 14:18:04 | 000,995,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2007/10/08 14:15:50 | 000,356,352 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2007/10/08 14:13:36 | 001,101,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2007/10/08 14:09:26 | 000,659,456 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2007/10/08 14:06:44 | 001,183,744 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007/10/08 14:01:54 | 000,483,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2006/11/13 14:39:52 | 001,289,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\wcescomm.exe
PRC - [2006/11/13 14:39:34 | 000,199,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\rapimgr.exe
PRC - [2006/09/27 20:33:44 | 000,125,168 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\VPTray.exe
PRC - [2006/09/27 20:33:38 | 000,116,464 | ---- | M] (symantec) -- C:\Program Files\Symantec AntiVirus\SavRoam.exe
PRC - [2006/09/27 20:33:32 | 001,813,232 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe
PRC - [2006/09/27 20:33:22 | 000,031,472 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe
PRC - [2006/07/19 19:26:12 | 000,169,632 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
PRC - [2006/07/19 19:26:06 | 000,192,160 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
PRC - [2006/07/19 19:26:04 | 000,052,896 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2006/04/11 17:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
PRC - [2006/01/02 17:41:22 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/03/07 11:55:06 | 000,414,720 | ---- | M] (Intuit, Inc.) -- C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe
PRC - [1999/09/30 22:31:38 | 000,869,376 | ---- | M] (Fred's Software) -- C:\Printkey2000.exe


========== Modules (SafeList) ==========

MOD - [2010/03/17 22:05:42 | 000,556,032 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\skyem\Desktop\OTL.exe


========== Win32 Services (SafeList) ==========

SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Disabled | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/10/22 23:49:24 | 000,188,416 | ---- | M] () [Auto | Running] -- c:\altera\81\quartus\bin\jtagserver.exe -- (JTAGServer)
SRV - [2007/10/08 14:27:02 | 000,794,624 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) Intel®
SRV - [2007/10/08 14:15:50 | 000,356,352 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) Intel®
SRV - [2007/10/08 14:06:44 | 001,183,744 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) Intel®
SRV - [2007/10/08 14:01:54 | 000,483,328 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) Intel®
SRV - [2007/06/28 20:01:48 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2006/09/27 20:33:38 | 000,116,464 | ---- | M] (symantec) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2006/09/27 20:33:32 | 001,813,232 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2006/09/27 20:33:22 | 000,031,472 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2006/09/02 16:36:33 | 002,528,960 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE -- (LiveUpdate)
SRV - [2006/08/07 16:03:02 | 000,214,720 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2006/07/19 19:26:12 | 000,169,632 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2006/07/19 19:26:06 | 000,192,160 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2006/04/11 17:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)
SRV - [2005/11/14 01:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/03/07 11:55:04 | 000,579,072 | ---- | M] (Intuit, Inc.) [Disabled | Stopped] -- C:\WINDOWS\TIREMOTE\TIRemoteService.exe -- (TIRmtSvc)
SRV - [2005/03/07 11:38:08 | 000,311,374 | ---- | M] (Intuit Track-It!) [Disabled | Stopped] -- C:\WINDOWS\TIREMOTE\wuser32.exe -- (TIRmtCtl)
SRV - [2003/03/09 21:31:02 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo....fr=ytff-tyc&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-tyc"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-tyc"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..keyword.URL: "http://search.yahoo....fr=ytff-tyc&p="
FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1"

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/16 00:41:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/16 00:40:52 | 000,000,000 | ---D | M]

[2010/03/16 00:41:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Mozilla\Extensions
[2010/03/17 15:32:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Mozilla\Firefox\Profiles\xxuuf5n9.default\extensions
[2010/03/16 01:05:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\skyem\Application Data\Mozilla\Firefox\Profiles\xxuuf5n9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/16 01:44:34 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\skyem\Application Data\Mozilla\Firefox\Profiles\xxuuf5n9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/03/17 15:32:38 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008/11/04 18:10:48 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll
[2007/03/09 19:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: ([2002/08/29 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {6F4F95AF-1647-4B72-A632-055405455423} - No CLSID value found.
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [Track-It! Workstation Manager Service Monitor] C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe (Intuit, Inc.)
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\skyem\Start Menu\Programs\Startup\Shortcut to Printkey2000.lnk = C:\Printkey2000.exe (Fred's Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceStartMenuLogOff = 1
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1D9EFA3B-4E85-41A8-9092-14012CD447C9} http://192.168.0.196...amPlayerWeb.ocx (NetCamPlayerWeb Control)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} http://us.dl1.yimg.c...nst_current.cab (YInstStarter Class)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.micr...922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://mwmus.webex....bex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hi-tech.local
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\skyem\My Documents\Notes\ohms law.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\skyem\My Documents\Notes\ohms law.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/19 11:33:00 | 000,000,026 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2160ecf0-9a59-11dd-9f55-00188bc2199a}\Shell - "" = AutoRun
O33 - MountPoints2\{2160ecf0-9a59-11dd-9f55-00188bc2199a}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2160ecf0-9a59-11dd-9f55-00188bc2199a}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010/03/09 15:15:09 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17736316556935168)

========== Files/Folders - Created Within 14 Days ==========

[2010/03/17 22:05:41 | 000,556,032 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\skyem\Desktop\OTL.exe
[2010/03/17 19:36:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/03/17 19:35:43 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/03/17 19:33:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\AdobeUM
[2010/03/17 19:32:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/03/17 19:32:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/03/16 18:01:29 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/03/16 11:32:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/03/16 02:15:10 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\skyem\IECompatCache
[2010/03/16 02:06:48 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\skyem\IETldCache
[2010/03/16 01:54:06 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/03/16 01:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skyem\Application Data\Malwarebytes
[2010/03/16 01:27:45 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/16 01:27:43 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/16 01:27:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/03/16 01:27:42 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/16 01:19:01 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/03/16 01:19:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/03/16 01:10:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skyem\Local Settings\Application Data\Threat Expert
[2010/03/16 00:53:15 | 001,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll.old
[2010/03/16 00:51:01 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/03/16 00:45:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/03/16 00:24:33 | 000,000,000 | ---D | C] -- C:\Program Files\CA Yahoo! Anti-Spy
[2010/03/09 19:17:46 | 000,000,000 | ---D | C] -- C:\VHD
[2010/03/08 11:38:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skyem\My Documents\Lantronix
[2010/03/05 17:56:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2010/03/05 01:42:52 | 000,000,000 | ---D | C] -- C:\Program Files\Computer Alarm Clock
[2010/03/04 18:45:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skyem\Application Data\UltraVNC
[2009/07/06 11:23:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Intel
[2009/07/06 11:23:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Intel
[2009/04/23 17:24:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/04/23 17:24:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Yahoo!
[2008/06/07 07:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/04/15 12:06:39 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/04/15 12:06:39 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/03/17 22:05:42 | 000,556,032 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\skyem\Desktop\OTL.exe
[2010/03/17 21:42:17 | 000,012,540 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/17 21:42:16 | 000,012,540 | ---- | M] () -- C:\WINDOWS\System32\wpa.bak
[2010/03/17 21:41:55 | 000,525,448 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/17 21:41:55 | 000,444,156 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/17 21:41:55 | 000,072,248 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/17 21:37:28 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/17 21:37:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/17 19:36:47 | 013,369,344 | ---- | M] () -- C:\Documents and Settings\skyem\ntuser.dat
[2010/03/17 19:22:39 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\skyem\ntuser.ini
[2010/03/17 13:01:28 | 000,000,830 | ---- | M] () -- C:\Documents and Settings\skyem\Desktop\Shortcut to Tech Trip Log 2010.xls.lnk
[2010/03/16 11:59:54 | 000,167,936 | ---- | M] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/16 09:21:44 | 000,000,865 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/03/16 09:21:44 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/16 09:21:44 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010/03/16 02:30:50 | 000,002,435 | ---- | M] () -- C:\Documents and Settings\skyem\Desktop\DeviceInstaller.lnk
[2010/03/16 01:57:18 | 000,000,873 | ---- | M] () -- C:\WINDOWS\System32\spupdsvc.inf
[2010/03/16 01:24:15 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/03/16 00:40:56 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/15 22:52:55 | 000,009,220 | -HS- | M] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\4GCn8U7
[2010/03/15 22:52:55 | 000,009,220 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\4GCn8U7
[2010/03/15 18:00:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/03/15 10:20:27 | 000,268,906 | ---- | M] () -- C:\Relation.err
[2010/03/13 20:18:46 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/03/12 13:30:08 | 000,000,352 | ---- | M] () -- C:\WINDOWS\FS1fsmss.ini
[2010/03/10 17:40:20 | 000,001,762 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google SketchUp 7.lnk
[2010/03/10 13:06:46 | 000,002,048 | ---- | M] () -- C:\Led_Sys.CFG
[2010/03/10 11:54:51 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_silabser_01007.Wdf
[2010/03/10 11:54:50 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/03/10 11:54:49 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/03/09 01:21:32 | 000,560,793 | ---- | M] () -- C:\Documents and Settings\skyem\My Documents\VBA-28-8832-ARE.pdf
[2010/03/08 22:34:00 | 000,002,269 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ohms Law 2.lnk

========== Files Created - No Company Name ==========

[2010/03/17 13:01:28 | 000,000,830 | ---- | C] () -- C:\Documents and Settings\skyem\Desktop\Shortcut to Tech Trip Log 2010.xls.lnk
[2010/03/16 01:57:18 | 000,000,873 | ---- | C] () -- C:\WINDOWS\System32\spupdsvc.inf
[2010/03/16 00:53:17 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010/03/16 00:40:56 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/15 22:48:12 | 000,009,220 | -HS- | C] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\4GCn8U7
[2010/03/15 22:48:12 | 000,009,220 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\4GCn8U7
[2010/03/15 08:55:21 | 013,369,344 | ---- | C] () -- C:\Documents and Settings\skyem\ntuser.dat
[2010/03/10 17:40:20 | 000,001,762 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google SketchUp 7.lnk
[2010/03/10 11:54:51 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_silabser_01007.Wdf
[2010/03/10 11:54:50 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/03/09 01:15:24 | 000,560,793 | ---- | C] () -- C:\Documents and Settings\skyem\My Documents\VBA-28-8832-ARE.pdf
[2009/10/09 15:52:38 | 000,038,496 | ---- | C] () -- C:\Documents and Settings\skyem\Application Data\Microsoft Excel.ADR
[2009/06/22 15:26:31 | 002,052,096 | ---- | C] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\filesync.metadata
[2009/04/27 17:26:58 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/04/27 17:26:58 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009/03/30 17:55:55 | 000,519,808 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2008/12/17 17:09:10 | 000,000,752 | ---- | C] () -- C:\WINDOWS\AnimatorDV.INI
[2008/12/16 01:09:25 | 000,000,651 | ---- | C] () -- C:\WINDOWS\Calendar.INI
[2008/11/25 15:33:22 | 000,000,319 | ---- | C] () -- C:\WINDOWS\SWWATER.INI
[2008/10/31 12:51:51 | 000,000,228 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/07/16 13:44:23 | 000,000,352 | ---- | C] () -- C:\WINDOWS\FS1fsmss.ini
[2008/06/11 13:50:47 | 000,146,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\CprDrvr.sys
[2008/06/09 13:28:39 | 000,000,353 | ---- | C] () -- C:\WINDOWS\Sandboxfsmss.ini
[2008/06/09 13:00:36 | 000,000,092 | ---- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini
[2008/06/06 18:27:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2008/05/16 11:51:06 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\skyem\Application Data\$_hpcst$.hpc
[2008/05/13 15:54:04 | 000,000,035 | ---- | C] () -- C:\WINDOWS\FSSERVERfsmss.ini
[2008/05/13 14:35:33 | 000,167,936 | ---- | C] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/05/13 13:57:54 | 000,002,044 | ---- | C] () -- C:\WINDOWS\Comp2000.ini
[2008/05/13 13:57:43 | 000,235,520 | ---- | C] () -- C:\WINDOWS\System32\W048T32W.DLL
[2008/05/13 13:57:43 | 000,137,216 | ---- | C] () -- C:\WINDOWS\System32\W043T32W.DLL
[2008/05/13 13:57:43 | 000,128,000 | ---- | C] () -- C:\WINDOWS\System32\W046T32W.DLL
[2008/05/13 13:57:43 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\W770T32W.DLL
[2008/05/13 13:57:42 | 000,202,752 | ---- | C] () -- C:\WINDOWS\System32\W042T32W.DLL
[2008/05/13 13:57:42 | 000,202,240 | ---- | C] () -- C:\WINDOWS\System32\W019T32W.DLL
[2008/05/13 13:57:42 | 000,168,960 | ---- | C] () -- C:\WINDOWS\System32\W037T32W.DLL
[2008/05/13 13:57:42 | 000,163,328 | ---- | C] () -- C:\WINDOWS\System32\W033T32W.DLL
[2008/05/13 13:57:42 | 000,117,760 | ---- | C] () -- C:\WINDOWS\System32\W020T32W.DLL
[2008/05/13 13:57:42 | 000,099,328 | ---- | C] () -- C:\WINDOWS\System32\W021T32W.DLL
[2008/05/13 13:57:42 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\W040T32W.DLL
[2008/05/13 13:57:41 | 000,185,344 | ---- | C] () -- C:\WINDOWS\System32\W007T32W.DLL
[2008/05/13 13:57:41 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\W001T32W.DLL
[2008/05/13 13:57:41 | 000,105,984 | ---- | C] () -- C:\WINDOWS\System32\W008T32W.DLL
[2008/05/13 13:57:41 | 000,101,888 | ---- | C] () -- C:\WINDOWS\System32\W015T32W.DLL
[2008/05/13 13:57:41 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\W006T32W.DLL
[2008/05/13 13:57:34 | 000,068,096 | ---- | C] () -- C:\WINDOWS\System32\LFPLT11N.DLL
[2008/05/13 13:57:32 | 000,096,768 | ---- | C] () -- C:\WINDOWS\System32\W801T32W.DLL
[2008/05/13 12:12:57 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\fusioncache.dat
[2008/04/17 15:24:18 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\USA19HPropPage.dll
[2008/04/17 15:24:18 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\k19hinst.dll
[2008/04/17 10:45:22 | 000,000,041 | ---- | C] () -- C:\WINDOWS\LIVEfsmss.ini
[2008/04/17 10:22:28 | 000,000,206 | ---- | C] () -- C:\WINDOWS\hpbafd.ini
[2008/04/16 09:14:28 | 000,087,808 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2008/04/15 13:30:35 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2008/04/15 13:30:35 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll
[2008/04/15 13:03:19 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2008/04/15 13:01:33 | 000,000,818 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/03/11 17:46:38 | 000,008,784 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll
[2007/08/22 11:39:22 | 000,105,848 | ---- | C] () -- C:\WINDOWS\System32\CprIf.dll
[2007/06/28 20:01:48 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2005/02/02 15:06:38 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Lptsend.dll
[2005/02/02 15:06:38 | 000,004,256 | ---- | C] () -- C:\WINDOWS\System32\UserPort.sys
[2005/02/02 15:06:36 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\FCDcontrol.dll
[2005/02/02 15:06:36 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\COMcheck.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2000/10/20 13:25:36 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\acdbres.dll
[1999/03/18 13:58:26 | 000,343,040 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[1999/03/17 18:42:24 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\lfkodak.dll

========== LOP Check ==========

[2010/03/16 01:24:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2008/05/19 14:43:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2009/09/15 10:37:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
[2010/03/17 16:30:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/04/23 11:40:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\ACD Systems
[2008/05/19 14:45:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Autodesk
[2008/12/16 01:08:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\desksware
[2008/05/14 21:37:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Firaxis Games
[2009/08/14 16:09:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\GARMIN
[2009/09/04 15:33:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\LogMeIn Rescue
[2009/05/25 15:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\My Games
[2009/07/03 05:17:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\OpenOffice.org
[2008/08/12 18:19:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\SecondLife
[2008/12/01 15:48:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Xilinx
[2009/09/20 02:52:00 | 000,000,446 | ---- | M] () -- C:\WINDOWS\Tasks\Driver Robot.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[1999/09/30 22:31:38 | 000,869,376 | ---- | M] (Fred's Software) -- C:\Printkey2000.exe


< MD5 for: AGP440.SYS >
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys
[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2002/08/29 08:00:00 | 010,158,890 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2002/08/29 08:00:00 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 00:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 00:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 00:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/04/15 07:25:41 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008/04/15 07:25:41 | 000,626,688 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008/04/15 07:25:41 | 000,430,080 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

========== Alternate Data Streams ==========

@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >




OTL Extras logfile created on: 3/17/2010 10:07:44 PM - Run 1
OTL by OldTimer - Version 3.1.37.2 Folder = C:\Documents and Settings\skyem\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 46.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 45.02 Gb Free Space | 60.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SKYEM135LT
Current User Name: skyem
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- File not found
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)
"C:\Program Files\Lantronix\DeviceInstaller4.2\DeviceInstaller.exe" = C:\Program Files\Lantronix\DeviceInstaller4.2\DeviceInstaller.exe:*:Enabled:DeviceInstaller -- (Lantronix)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03CAB33F-D1C2-48C6-8766-DAE84DFC25FE}" = Microsoft Sync Framework Services v1.0 (x86)
"{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}" = mSSO
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{10C7D766-D696-4C12-A6FC-BC22BFFC8395}" = Pivotal Lifecycle Engine Windows Access r5.7 (v5.7.0004)
"{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"{16115E10-502B-4EA0-BD39-4DA329AD89E2}" = BELKIN F5U109
"{18F41A36-BE86-451C-BD86-FCB468EB6612}" = Fourth Shift Workstation 7.40_FS1
"{1ECD6EC8-7BB2-4CD5-A384-BAA371BC4D21}" = Volo View Express
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{2486731F-2D91-4412-B2AE-8850A540D7F0}" = WinPlay
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 17
"{26A24AE4-039D-4CA4-87B4-2F83216013F0}" = Java™ 6 Update 13
"{2E97DE76-851A-48AA-A0D6-665860FAD9CA}" = Keyspan USB Serial Adapter
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{33CFCF98-F8D6-4549-B469-6F4295676D83}" = Symantec AntiVirus
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36CD31F7-963A-47BD-8508-C27A2BC18E28}" = Lantronix DeviceInstaller 4.2.0.4 (32bit)
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{44734179-8A79-4DEE-BB08-73037F065543}" = Apple Mobile Device Support
"{44CE8AA1-3322-4722-B21E-A39C3913C10F}" = Lantronix CPR 4.1.0.2
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{48A2D152-22DB-42D4-A96B-74F5C7BC470B}" = HiTech SoftwareRegistrationV4
"{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}" = mHlpDell
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5621207E-2451-44DE-91AA-F8D10BEE3803}" = WinPlay4
"{5783F2D6-7028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2009
"{597E70FF-7C46-4EED-8092-91B7C2E0529D}" = Google SketchUp 7
"{612B9183-67A9-4B44-9877-2F059E35B86A}" = Broadcom 440x 10/100 Integrated Controller
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{63EE5FB4-47ED-4129-82DB-E38DBACB8B0C}" = DBA Manufacturing Client
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7BBCCC5C-C844-4C58-A0A8-536D666D503A}" = Client Manager 3.15A
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8FF1ADCB-8D4B-11D6-961A-000102CD2B4A}" = WinCupl
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{9261ECB8-A3FE-47B2-89A3-E59C79967ED3}" = OhmsLaw2
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{94F43A30-D938-11D5-80C8-0001026977CA}" = Atmel ISP
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F5F62B5-E6A5-4537-B4B3-35A7DE28E575}" = Quartus II 8.1 Web Edition
"{A02ED372-22FA-448B-AB6A-1B0FC23B7D08}" = ATI Catalyst Control Center
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}" = Garmin Communicator Plugin
"{A8BD5A60-E843-46DC-8271-ABF20756BE0F}" = Microsoft Sync Framework Runtime v1.0 (x86)
"{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB7D42B5-F487-43A2-A952-671E632FFC6D}" = Dynamic C Version 9.62
"{CBF6B8E4-84AE-4FE0-892F-F47A71D10790}" = X-CTU
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF63144B-8CDE-4902-8B23-FA07C87C2069}" = ComPlay 4.0
"{D6321639-483A-4DB1-B05D-AF5E30006226}" = Hx2 Control Panel
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{ED5F7AF9-347B-4440-A211-C6236508CC08}" = ExpressPCB
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F2A561F3-A35B-4E37-BEAC-CE16DDDDF163}" = Lantronix CPR Command Line 4.1.0.2
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{F8F2E8BC-10D1-4DF1-A369-1A33D6C65A4A}" = Fourth Shift Workstation 7.40_Sandbox
"{F963E257-D531-4AAE-A584-C60EDEB6A6C6}" = Quartus II 8.0sp1 Web Edition
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"23C892DBF52DDAF3C9BD2BB6E9805E79FCD09A67" = Windows Driver Package - FTDI CDM Driver Package (05/19/2006 2.00.00)
"3635FC5A3FE7DACCEF2123BDBDA808BA811B977B" = Windows Driver Package - Ricoh Company Memorystick Host Controller (07/09/2005 1.00.01.12)
"452416B030C25BAA383F3DA368FECD5D48FAE727" = Windows Driver Package - Ricoh Company xD-Picture Card/SmartMedia Host Controller (07/14/2005 1.00.02.04)
"4569969E1360D2854474C661EF9B4D54F143EB16" = Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"A Simple Unit Converter_is1" = A Simple Unit Converter 0.9.9.0
"A106663FD3361BDFACB045D83EBA03858EB1E411" = Windows Driver Package - FTDI CDM Driver Package (03/13/2008 2.04.06)
"A2E63BDAC649E514867CB43CE0B4F9DB111206C2" = Windows Driver Package - FTDI CDM Driver Package (05/19/2006 2.00.00)
"ActiveTouchMeetingClient" = WebEx
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"cayahooantispy" = CA Yahoo! Anti-Spy (remove only)
"CF Video" = CF Video Uninstall
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"Complay 2000" = Complay 2000
"Computer Alarm Clock" = Computer Alarm Clock
"config.exe1.11.1" = config.exe1.1
"CutePDF Writer Installation" = CutePDF Writer 2.7
"Distribution Amplifier Config Tool" = Distribution Amplifier Config Tool Uninstall
"DWG TrueView 2009" = DWG TrueView 2009
"EDL Configuration Software" = EDL Configuration Software
"ERUNT_is1" = ERUNT 1.1j
"EZWebCon 2.0/1" = EZWebCon 2.0/1
"F2F24872454C7CAEAABD8BB063F70FBEFF01989D" = Windows Driver Package - FTDI CDM Driver Package (03/13/2008 2.04.06)
"F631A62FA5E06534A0FE3637D75AAA5B1D3E4FB7" = Windows Driver Package - Ricoh Company MMC Host Controller (07/14/2005 1.00.00.06)
"Flash Movie Player" = Flash Movie Player 1.5
"FTDICOMM" = Digi PKG-U USB Wireless Module Drivers
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"InstallShield_{8FF1ADCB-8D4B-11D6-961A-000102CD2B4A}" = WinCupl
"InstallShield_{94F43A30-D938-11D5-80C8-0001026977CA}" = Atmel ISP
"InstallShield_{CF63144B-8CDE-4902-8B23-FA07C87C2069}" = ComPlay 4.0
"LED Software10" = LED Software10
"LedManager V5.5" = LedManager V5.5
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 3.1 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PrintKey2000" = PrintKey2000
"ProInst" = Intel® PROSet/Wireless Software
"Rainbow Sentinel Driver" = Sentinel System Driver
"Registry Mechanic_is1" = Registry Mechanic 8.0
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"SyncBack_is1" = SyncBack
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPcapInst" = WinPcap 4.0.1
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xilinx ISE 10.1" = Xilinx ISE 10.1
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/17/2010 7:20:30 PM | Computer Name = SKYEM135LT | Source = Symantec AntiVirus | ID = 16711725
Description = SYMANTEC TAMPER PROTECTION ALERT Target: C:\Program Files\Symantec
AntiVirus\VPTray.exe Event Info: Terminate Thread Action Taken: Blocked Actor Process:
C:\Documents and Settings\skyem\My Documents\Downloads\TFC.exe (PID 4040) Time:
Wednesday, March 17, 2010 7:20:30 PM

Error - 3/17/2010 7:20:30 PM | Computer Name = SKYEM135LT | Source = Symantec AntiVirus | ID = 16711725
Description = SYMANTEC TAMPER PROTECTION ALERT Target: C:\Program Files\Symantec
AntiVirus\VPTray.exe Event Info: Terminate Thread Action Taken: Blocked Actor Process:
C:\Documents and Settings\skyem\My Documents\Downloads\TFC.exe (PID 4040) Time:
Wednesday, March 17, 2010 7:20:30 PM

Error - 3/17/2010 7:20:30 PM | Computer Name = SKYEM135LT | Source = Symantec AntiVirus | ID = 16711725
Description = SYMANTEC TAMPER PROTECTION ALERT Target: C:\Program Files\Symantec
AntiVirus\VPTray.exe Event Info: Terminate Thread Action Taken: Blocked Actor Process:
C:\Documents and Settings\skyem\My Documents\Downloads\TFC.exe (PID 4040) Time:
Wednesday, March 17, 2010 7:20:30 PM

Error - 3/17/2010 7:20:30 PM | Computer Name = SKYEM135LT | Source = Symantec AntiVirus | ID = 16711725
Description = SYMANTEC TAMPER PROTECTION ALERT Target: C:\Program Files\Symantec
AntiVirus\VPTray.exe Event Info: Terminate Thread Action Taken: Blocked Actor Process:
C:\Documents and Settings\skyem\My Documents\Downloads\TFC.exe (PID 4040) Time:
Wednesday, March 17, 2010 7:20:30 PM

Error - 3/17/2010 7:25:13 PM | Computer Name = SKYEM135LT | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 3/17/2010 7:25:13 PM | Computer Name = SKYEM135LT | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 3/17/2010 7:25:14 PM | Computer Name = SKYEM135LT | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 3/17/2010 9:37:41 PM | Computer Name = SKYEM135LT | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 3/17/2010 9:37:42 PM | Computer Name = SKYEM135LT | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 3/17/2010 9:37:43 PM | Computer Name = SKYEM135LT | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

[ System Events ]
Error - 3/17/2010 8:24:50 PM | Computer Name = SKYEM135LT | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 3/17/2010 8:39:53 PM | Computer Name = SKYEM135LT | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 29 minutes. NtpClient has no source of accurate
time.

Error - 3/17/2010 9:09:53 PM | Computer Name = SKYEM135LT | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 59 minutes. NtpClient has no source of accurate
time.

Error - 3/17/2010 9:37:32 PM | Computer Name = SKYEM135LT | Source = Ftdisk | ID = 262189
Description = The system could not sucessfully load the crash dump driver.

Error - 3/17/2010 9:37:32 PM | Computer Name = SKYEM135LT | Source = Ftdisk | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 3/17/2010 9:37:42 PM | Computer Name = SKYEM135LT | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain HI-TECH due to the following:
%%1311. Make sure that the computer is connected to the network and try again. If
the problem persists, please contact your domain administrator.

Error - 3/17/2010 9:37:45 PM | Computer Name = SKYEM135LT | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 3/17/2010 9:37:45 PM | Computer Name = SKYEM135LT | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 3/17/2010 9:38:22 PM | Computer Name = SKYEM135LT | Source = Service Control Manager | ID = 7001
Description = The Altera ByteBlaster service depends on the Parport service which
failed to start because of the following error: %%1058

Error - 3/17/2010 9:52:47 PM | Computer Name = SKYEM135LT | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 29 minutes. NtpClient has no source of accurate
time.


< End of report >

[Advertisements]

can you try this guide

http://www.geekstogo...ts-t267407.html

[Rorschach112]

can you try this guide

http://www.geekstogo...ts-t267407.html

[soer10705]

Youre the man!!!! No more redirects and after uninstalling/reinstalling IE, its working again.

So, I guess my questions now are 1. Is there any way to make sure my machine is clean? 2. Is it safe to go back to using online banking etc? I havent used those services since "the infection".

Thanks for all your help!

[Rorschach112]

Q1 - We can run some scans if you want, will take a little while to verify this
Q2 - Should be yes

[soer10705]

Better safe than sorry.

What should we run?

[Rorschach112]

this

Download ComboFix here :

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you don't know how to disable them then just continue on.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

[soer10705]

ComboFix 10-03-19.08 - skyem 03/20/2010 8:45.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.737 [GMT -4:00]
Running from: c:\documents and settings\skyem\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\recycler\NPROTECT
c:\windows\AegisP.inf
c:\windows\Downloaded Program Files\MyWebEx
c:\windows\Downloaded Program Files\MyWebEx\419\atarm.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atas32.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atasanot.exe
c:\windows\Downloaded Program Files\MyWebEx\419\atasctrl.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atasnt40.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atcarmcl.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atdl2006.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atjpeg60.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atkbctl.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atlchat.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atmemmgr.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atnetext.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atpack.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atres.dll
c:\windows\Downloaded Program Files\MyWebEx\419\attp.dll
c:\windows\Downloaded Program Files\MyWebEx\419\atwbxui6.dll
c:\windows\Downloaded Program Files\MyWebEx\419\h264dec.dll
c:\windows\Downloaded Program Files\MyWebEx\419\h264enc.dll
c:\windows\Downloaded Program Files\MyWebEx\419\mmssl32.dll
c:\windows\Downloaded Program Files\MyWebEx\419\msess.dll
c:\windows\Downloaded Program Files\MyWebEx\419\mticket.dll
c:\windows\Downloaded Program Files\MyWebEx\419\mutiltpd.dll
c:\windows\Downloaded Program Files\MyWebEx\419\mvc.dll
c:\windows\Downloaded Program Files\MyWebEx\419\mwm.ini
c:\windows\Downloaded Program Files\MyWebEx\419\mwmcliun.exe
c:\windows\Downloaded Program Files\MyWebEx\419\mwmproxy.dll
c:\windows\Downloaded Program Files\MyWebEx\419\mwmres.dll
c:\windows\Downloaded Program Files\MyWebEx\419\mwmupd.exe
c:\windows\Downloaded Program Files\MyWebEx\419\raurl.dll
c:\windows\Downloaded Program Files\MyWebEx\419\uilibres.dll
c:\windows\Downloaded Program Files\MyWebEx\419\wbxcrypt.dll
c:\windows\Downloaded Program Files\MyWebEx\419\webexmgr.dll
c:\windows\system32\regsvr32.dll
c:\windows\system32\W020T32W.DLL
c:\windows\system32\W021T32W.DLL

----- BITS: Possible infected sites -----

hxxp://vault:8530
.
((((((((((((((((((((((((( Files Created from 2010-02-20 to 2010-03-20 )))))))))))))))))))))))))))))))
.

2010-03-17 23:35 . 2010-03-17 23:35 -------- d-----w- c:\program files\ERUNT
2010-03-17 23:33 . 2010-03-17 23:33 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM
2010-03-17 23:32 . 2010-03-17 23:33 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-03-17 13:36 . 2009-12-02 18:16 1324720 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30d402.vdb\NAVEX15.SYS
2010-03-17 13:36 . 2009-11-10 22:48 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30d402.vdb\NAVEX32A.DLL
2010-03-17 13:36 . 2010-03-10 09:00 259440 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30d402.vdb\ECMSVR32.DLL
2010-03-17 13:36 . 2009-12-08 00:01 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30d402.vdb\CCERASER.DLL
2010-03-17 13:36 . 2009-12-02 18:15 84912 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30d402.vdb\NAVENG.SYS
2010-03-17 13:36 . 2009-11-10 22:48 177520 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30d402.vdb\NAVENG32.DLL
2010-03-17 13:36 . 2009-08-18 00:15 102448 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30d402.vdb\ERASER.SYS
2010-03-17 13:36 . 2009-08-18 00:15 371248 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30d402.vdb\EECTRL.SYS
2010-03-17 13:34 . 2009-12-02 18:16 1324720 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30e003.vdb\NAVEX15.SYS
2010-03-17 13:34 . 2009-12-02 18:15 84912 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30e003.vdb\NAVENG.SYS
2010-03-17 13:34 . 2009-11-10 22:48 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30e003.vdb\NAVEX32A.DLL
2010-03-17 13:34 . 2009-11-10 22:48 177520 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30e003.vdb\NAVENG32.DLL
2010-03-17 13:34 . 2010-03-16 08:00 259440 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30e003.vdb\ECMSVR32.DLL
2010-03-17 13:34 . 2009-12-08 00:01 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30e003.vdb\CCERASER.DLL
2010-03-17 13:34 . 2009-08-18 00:15 102448 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30e003.vdb\ERASER.SYS
2010-03-17 13:34 . 2009-08-18 00:15 371248 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd30e003.vdb\EECTRL.SYS
2010-03-16 22:01 . 2010-03-16 22:01 -------- d-----w- c:\program files\Trend Micro
2010-03-16 16:01 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-16 16:01 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-16 13:39 . 2010-03-16 13:39 -------- d-----w- c:\documents and settings\skyem.SKYEM135LT\Application Data\Malwarebytes
2010-03-16 13:21 . 2010-03-16 13:21 -------- d-----w- c:\documents and settings\administrator\Application Data\Malwarebytes
2010-03-16 13:10 . 2010-03-16 13:10 -------- d-sh--w- c:\documents and settings\administrator\IETldCache
2010-03-16 06:15 . 2010-03-16 06:15 -------- d-sh--w- c:\documents and settings\skyem\IECompatCache
2010-03-16 06:10 . 2010-03-16 06:10 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-03-16 06:06 . 2010-03-16 06:06 -------- d-sh--w- c:\documents and settings\skyem\IETldCache
2010-03-16 05:54 . 2009-06-29 16:12 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-16 05:54 . 2009-06-29 16:12 78336 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2010-03-16 05:27 . 2010-03-16 05:27 -------- d-----w- c:\documents and settings\skyem\Application Data\Malwarebytes
2010-03-16 05:27 . 2010-01-07 20:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-16 05:27 . 2010-03-16 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-16 05:27 . 2010-01-07 20:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-16 05:27 . 2010-03-16 05:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-16 05:19 . 2010-03-16 05:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-03-16 05:19 . 2010-03-16 05:19 -------- d-----w- c:\program files\Alwil Software
2010-03-16 05:10 . 2010-03-16 05:10 -------- d-----w- c:\documents and settings\skyem\Local Settings\Application Data\Threat Expert
2010-03-16 04:51 . 2010-03-16 06:03 -------- d-----w- c:\program files\Spyware Doctor
2010-03-16 04:24 . 2010-03-16 04:27 -------- d-----w- c:\program files\CA Yahoo! Anti-Spy
2010-03-16 02:56 . 2010-03-16 02:56 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-10 23:43 . 2001-05-26 20:16 13824 ----a-w- c:\windows\system32\LAYOUT.DLL
2010-03-10 15:54 . 2008-03-21 18:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2010-03-09 23:17 . 2010-03-09 23:22 -------- d-----w- C:\VHD
2010-03-05 21:56 . 2010-03-06 13:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-03-05 21:55 . 2009-12-14 21:52 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2010-03-05 05:42 . 2010-03-05 15:14 -------- d-----w- c:\program files\Computer Alarm Clock
2010-03-04 22:45 . 2010-03-04 22:45 -------- d-----w- c:\documents and settings\skyem\Application Data\UltraVNC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-20 06:15 . 2008-04-15 19:57 -------- d-----w- c:\program files\Symantec AntiVirus
2010-03-18 19:29 . 2008-04-15 17:07 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-03-17 20:30 . 2008-11-25 20:57 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-17 19:47 . 2008-04-16 16:07 -------- d-----w- c:\program files\Windows Media Connect 2
2010-03-14 00:18 . 2008-06-07 01:25 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-10 21:40 . 2008-04-16 13:31 -------- d-----w- c:\program files\Google
2010-03-10 16:07 . 2009-11-02 15:29 -------- d-----w- c:\program files\LedSoft10
2010-03-10 15:54 . 2010-03-10 15:54 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_silabser_01007.Wdf
2010-03-10 15:54 . 2010-03-10 15:54 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-03-05 21:57 . 2008-12-18 01:59 -------- d-----w- c:\documents and settings\skyem\Application Data\Yahoo!
2010-03-05 21:56 . 2008-12-18 01:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-03-05 21:56 . 2008-09-24 00:36 -------- d-----w- c:\program files\Yahoo!
2010-02-24 19:08 . 2009-05-06 15:17 -------- d-----w- c:\program files\OhmsLaw 2
2010-02-19 23:09 . 2009-03-30 21:55 519808 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-02 19:05 . 2009-07-03 09:21 1 ----a-w- c:\documents and settings\skyem\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-28 16:28 . 2008-04-15 19:57 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-28 14:48 . 2008-04-15 19:24 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-01-28 14:43 . 2008-04-16 13:30 -------- d-----w- c:\program files\Common Files\Java
2009-12-22 19:06 . 2009-12-22 19:06 40960 ----a-r- c:\documents and settings\skyem\Application Data\Microsoft\Installer\{48A2D152-22DB-42D4-A96B-74F5C7BC470B}\NewShortcut1_48A2D15222DB42D4A96B74F5C7BC470B.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Broadcom Wireless Manager UI"="c:\windows\System32\WLTRAY.exe" [2007-03-16 1392640]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"Track-It! Workstation Manager Service Monitor"="c:\windows\TIREMOTE\TIServiceMonitor.exe" [2005-03-07 414720]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

c:\documents and settings\skyem\Start Menu\Programs\Startup\
Shortcut to Printkey2000.lnk - C:\Printkey2000.exe [2009-5-18 869376]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinVNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 09:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-03-24 21:30 282624 ----a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"winvnc"=2 (0x2)
"TIRmtSvc"=2 (0x2)
"TIRmtCtl"=2 (0x2)
"Diskeeper"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"YahooAUService"=2 (0x2)
"WinVNC4"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Lantronix\\DeviceInstaller4.2\\DeviceInstaller.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 R592;R592;c:\windows\system32\drivers\R592.sys [4/15/2008 1:03 PM 57088]
R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [4/15/2008 1:03 PM 27264]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 CprDrvr;Driver for Lantronix CPR Device;c:\windows\system32\drivers\CprDrvr.sys [6/11/2008 1:50 PM 146168]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [3/15/2010 7:47 AM 102448]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/28/2007 8:01 PM 34064]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\drivers\silabenm.sys [11/2/2009 11:31 AM 17920]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\drivers\silabser.sys [11/2/2009 11:31 AM 62592]
S3 USA19H;USA19H;c:\windows\system32\drivers\usa19h2k.sys [4/17/2008 3:24 PM 727908]
S3 USA19H2KP;Keyspan USB Serial Port Driver;c:\windows\system32\drivers\usa19h2kp.sys [4/17/2008 3:24 PM 44928]
S3 USBBLSTR;Altera USB-Blaster Device Driver;c:\windows\system32\drivers\usbblstr.sys [10/17/2008 12:56 PM 53184]
S3 XilinxFirmwareLpLoader;XilinxFirmwareLpLoader;c:\windows\system32\drivers\xusb_xlp.sys [12/1/2008 1:48 PM 17280]
S4 TIRmtCtl;Track-It! Remote Control;c:\windows\TIREMOTE\wuser32.exe [2/5/2009 3:58 PM 311374]
S4 TIRmtSvc;Track-It! Workstation Manager;c:\windows\TIREMOTE\TIRemoteService.exe [2/5/2009 3:58 PM 579072]
.
Contents of the 'Scheduled Tasks' folder

2010-03-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = 127.0.0.1
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1D9EFA3B-4E85-41A8-9092-14012CD447C9} - hxxp://192.168.0.196/img/NetCamPlayerWeb.ocx
FF - ProfilePath - c:\documents and settings\skyem\Application Data\Mozilla\Firefox\Profiles\xxuuf5n9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
.
------- File Associations -------
.
.scr=DWGTrueViewScriptFile
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
SafeBoot-klmdb.sys
AddRemove-SLABCOMM&10C4&EA60 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
AddRemove-Octoshape add-in for Adobe Flash Player - c:\documents and settings\skyem\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-20 08:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1016)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\netprovcredman.dll
.
Completion time: 2010-03-20 08:52:35
ComboFix-quarantined-files.txt 2010-03-20 12:52

Pre-Run: 48,616,329,216 bytes free
Post-Run: 48,578,252,800 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 3EBACB770BD345179EFEB296EB1B3E84

[Rorschach112]

hi

Please download OTM

• Save it to your desktop.
• Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Processes
  
  :Services
  
  :Reg
  
  :Files
  c:\windows\system32\LAYOUT.DLL
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [EMPTYFLASH]
  [Reboot]

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

[soer10705]

Would you like me to put all the logs in one reply or post them individually?

[Rorschach112]

in the one post please

[soer10705]

All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
DllUnregisterServer procedure not found in c:\windows\system32\LAYOUT.DLL
c:\windows\system32\LAYOUT.DLL moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes

User: Administrator.LOANER651LT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: skyem
->Temp folder emptied: 478165 bytes
->Temporary Internet Files folder emptied: 191570 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 43305777 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 3301 bytes

User: skyem.SKYEM135LT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: user
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 255 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 42.00 mb

Restore point Set: OTM Restore Point (64424509440)

OTM by OldTimer - Version 3.1.10.1 log created on 03212010_173746

Files moved on Reboot...

Registry entries deleted on Reboot...



Malwarebytes' Anti-Malware 1.44
Database version: 3878
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

3/21/2010 6:25:55 PM
mbam-log-2010-03-21 (18-25-55).txt

Scan type: Quick Scan
Objects scanned: 162944
Time elapsed: 8 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, March 22, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, March 21, 2010 20:05:32
Records in database: 3840205
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
G:\
M:\
W:\

Scan statistics:
Objects scanned: 208900
Threats found: 2
Infected objects found: 5
Suspicious objects found: 0
Scan duration: 05:31:33


File name / Threat / Threats count
TIServiceMonitor.exe\TIServiceMonitor.exe/TIServiceMonitor.exe\TIServiceMonitor.exe Infected: Trojan-Downloader.Win32.Dadobra.bnx 1
C:\Documents and Settings\skyem\My Documents\Notes\LEDMan\vnc-4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 4

Selected area has been scanned.

[Rorschach112]

[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[soer10705]

OTL logfile created on: 3/22/2010 8:23:09 AM - Run 2
OTL by OldTimer - Version 3.1.37.2 Folder = C:\Documents and Settings\skyem\My Documents\Other stuff\Malware removal
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 45.17 Gb Free Space | 60.60% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SKYEM135LT
Current User Name: skyem
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/03/17 22:05:42 | 000,556,032 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\skyem\My Documents\Other stuff\Malware removal\OTL.exe
PRC - [2010/01/15 23:09:37 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2008/10/22 23:49:24 | 000,188,416 | ---- | M] () -- c:\altera\81\quartus\bin\jtagserver.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/10/08 14:27:02 | 000,794,624 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2007/10/08 14:18:04 | 000,995,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2007/10/08 14:15:50 | 000,356,352 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2007/10/08 14:13:36 | 001,101,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2007/10/08 14:09:26 | 000,659,456 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2007/10/08 14:06:44 | 001,183,744 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007/10/08 14:01:54 | 000,483,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2006/11/13 14:39:52 | 001,289,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\wcescomm.exe
PRC - [2006/11/13 14:39:34 | 000,199,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\rapimgr.exe
PRC - [2006/09/27 20:33:44 | 000,125,168 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\VPTray.exe
PRC - [2006/09/27 20:33:38 | 000,116,464 | ---- | M] (symantec) -- C:\Program Files\Symantec AntiVirus\SavRoam.exe
PRC - [2006/09/27 20:33:32 | 001,813,232 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe
PRC - [2006/09/27 20:33:22 | 000,031,472 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe
PRC - [2006/07/19 19:26:12 | 000,169,632 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
PRC - [2006/07/19 19:26:06 | 000,192,160 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
PRC - [2006/07/19 19:26:04 | 000,052,896 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2006/04/11 17:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
PRC - [2006/01/02 17:41:22 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/03/07 11:55:06 | 000,414,720 | ---- | M] (Intuit, Inc.) -- C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe
PRC - [1999/09/30 22:31:38 | 000,869,376 | ---- | M] (Fred's Software) -- C:\Printkey2000.exe


========== Modules (SafeList) ==========

MOD - [2010/03/17 22:05:42 | 000,556,032 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\skyem\My Documents\Other stuff\Malware removal\OTL.exe


========== Win32 Services (SafeList) ==========

SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Disabled | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/10/22 23:49:24 | 000,188,416 | ---- | M] () [Auto | Running] -- c:\altera\81\quartus\bin\jtagserver.exe -- (JTAGServer)
SRV - [2007/10/08 14:27:02 | 000,794,624 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) Intel®
SRV - [2007/10/08 14:15:50 | 000,356,352 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) Intel®
SRV - [2007/10/08 14:06:44 | 001,183,744 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) Intel®
SRV - [2007/10/08 14:01:54 | 000,483,328 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) Intel®
SRV - [2007/06/28 20:01:48 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2006/09/27 20:33:38 | 000,116,464 | ---- | M] (symantec) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2006/09/27 20:33:32 | 001,813,232 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2006/09/27 20:33:22 | 000,031,472 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2006/09/02 16:36:33 | 002,528,960 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE -- (LiveUpdate)
SRV - [2006/08/07 16:03:02 | 000,214,720 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2006/07/19 19:26:12 | 000,169,632 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2006/07/19 19:26:06 | 000,192,160 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2006/04/11 17:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)
SRV - [2005/11/14 01:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/03/07 11:55:04 | 000,579,072 | ---- | M] (Intuit, Inc.) [Disabled | Stopped] -- C:\WINDOWS\TIREMOTE\TIRemoteService.exe -- (TIRmtSvc)
SRV - [2005/03/07 11:38:08 | 000,311,374 | ---- | M] (Intuit Track-It!) [Disabled | Stopped] -- C:\WINDOWS\TIREMOTE\wuser32.exe -- (TIRmtCtl)
SRV - [2003/03/09 21:31:02 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo....-8&fr=ytff-&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-tyc"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-tyc"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..keyword.URL: "http://search.yahoo....fr=ytff-tyc&p="
FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1"

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/16 00:41:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/16 00:40:52 | 000,000,000 | ---D | M]

[2010/03/16 00:41:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Mozilla\Extensions
[2010/03/21 16:11:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Mozilla\Firefox\Profiles\xxuuf5n9.default\extensions
[2010/03/16 01:05:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\skyem\Application Data\Mozilla\Firefox\Profiles\xxuuf5n9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/20 00:52:28 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\skyem\Application Data\Mozilla\Firefox\Profiles\xxuuf5n9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/03/21 16:11:03 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008/11/04 18:10:48 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll
[2007/03/09 19:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: ([2010/03/21 17:37:49 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [Track-It! Workstation Manager Service Monitor] C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe (Intuit, Inc.)
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\skyem\Start Menu\Programs\Startup\Shortcut to Printkey2000.lnk = C:\Printkey2000.exe (Fred's Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceStartMenuLogOff = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1D9EFA3B-4E85-41A8-9092-14012CD447C9} http://192.168.0.196...amPlayerWeb.ocx (NetCamPlayerWeb Control)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} http://us.dl1.yimg.c...nst_current.cab (YInstStarter Class)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.micr...922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://mwmus.webex....bex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hi-tech.local
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\skyem\My Documents\Notes\ohms law.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\skyem\My Documents\Notes\ohms law.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/19 11:33:00 | 000,000,026 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/03/21 17:37:46 | 000,000,000 | ---D | C] -- C:\_OTM
[2010/03/20 11:53:20 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/03/20 08:39:45 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/03/20 08:37:46 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/03/20 08:37:45 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/03/20 08:37:45 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/03/20 08:37:45 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/03/20 08:37:29 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/03/20 08:36:58 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/03/18 22:59:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skyem\My Documents\Print these
[2010/03/18 15:48:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/03/17 19:36:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/03/17 19:35:43 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/03/17 19:33:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\AdobeUM
[2010/03/17 19:33:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/03/17 19:32:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/03/16 18:01:29 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/03/16 11:32:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/03/16 02:15:10 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\skyem\IECompatCache
[2010/03/16 02:06:48 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\skyem\IETldCache
[2010/03/16 01:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skyem\Application Data\Malwarebytes
[2010/03/16 01:27:45 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/16 01:27:43 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/16 01:27:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/03/16 01:27:42 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/16 01:19:01 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/03/16 01:19:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/03/16 01:10:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skyem\Local Settings\Application Data\Threat Expert
[2010/03/16 00:53:15 | 001,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll.old
[2010/03/16 00:51:01 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/03/16 00:45:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/03/16 00:24:33 | 000,000,000 | ---D | C] -- C:\Program Files\CA Yahoo! Anti-Spy
[2010/03/09 19:17:46 | 000,000,000 | ---D | C] -- C:\VHD
[2010/03/08 11:38:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skyem\My Documents\Lantronix
[2009/07/06 11:23:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Intel
[2009/07/06 11:23:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Intel
[2009/04/23 17:24:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/04/23 17:24:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Yahoo!
[2008/06/07 07:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/04/15 12:06:39 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/04/15 12:06:39 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/03/21 18:12:35 | 000,525,448 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/21 18:12:35 | 000,444,156 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/21 18:12:35 | 000,072,248 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/21 18:08:44 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/21 18:08:15 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/21 18:08:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/21 18:06:09 | 013,631,488 | ---- | M] () -- C:\Documents and Settings\skyem\ntuser.dat
[2010/03/21 18:06:07 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\skyem\ntuser.ini
[2010/03/21 17:37:49 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2010/03/20 08:50:18 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/20 08:39:53 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/03/20 08:32:15 | 003,895,816 | R--- | M] () -- C:\Documents and Settings\skyem\Desktop\ComboFix.exe
[2010/03/18 15:49:18 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/03/17 21:42:16 | 000,012,540 | ---- | M] () -- C:\WINDOWS\System32\wpa.bak
[2010/03/17 13:01:28 | 000,000,830 | ---- | M] () -- C:\Documents and Settings\skyem\Desktop\Tech Trip Log 2010.xls.lnk
[2010/03/16 11:59:54 | 000,167,936 | ---- | M] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/16 09:21:44 | 000,000,865 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/03/16 09:21:44 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/03/16 02:30:50 | 000,002,435 | ---- | M] () -- C:\Documents and Settings\skyem\Desktop\DeviceInstaller.lnk
[2010/03/16 01:57:18 | 000,000,873 | ---- | M] () -- C:\WINDOWS\System32\spupdsvc.inf
[2010/03/16 01:24:15 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/03/16 00:40:56 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/15 22:52:55 | 000,009,220 | -HS- | M] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\4GCn8U7
[2010/03/15 22:52:55 | 000,009,220 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\4GCn8U7
[2010/03/15 18:00:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/03/15 10:20:27 | 000,268,906 | ---- | M] () -- C:\Relation.err
[2010/03/13 20:18:46 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/03/12 18:02:38 | 000,261,632 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010/03/12 13:30:08 | 000,000,352 | ---- | M] () -- C:\WINDOWS\FS1fsmss.ini
[2010/03/10 17:40:20 | 000,001,762 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google SketchUp 7.lnk
[2010/03/10 13:06:46 | 000,002,048 | ---- | M] () -- C:\Led_Sys.CFG
[2010/03/10 11:54:51 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_silabser_01007.Wdf
[2010/03/10 11:54:50 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/03/09 01:21:32 | 000,560,793 | ---- | M] () -- C:\Documents and Settings\skyem\My Documents\VBA-28-8832-ARE.pdf
[2010/03/08 22:34:00 | 000,002,269 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ohms Law 2.lnk

========== Files Created - No Company Name ==========

[2010/03/20 08:39:53 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/03/20 08:39:51 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/03/20 08:37:46 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/03/20 08:37:45 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/03/20 08:37:45 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/03/20 08:37:45 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/03/20 08:37:45 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/03/20 08:32:13 | 003,895,816 | R--- | C] () -- C:\Documents and Settings\skyem\Desktop\ComboFix.exe
[2010/03/17 13:01:28 | 000,000,830 | ---- | C] () -- C:\Documents and Settings\skyem\Desktop\Tech Trip Log 2010.xls.lnk
[2010/03/16 01:57:18 | 000,000,873 | ---- | C] () -- C:\WINDOWS\System32\spupdsvc.inf
[2010/03/16 00:53:17 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010/03/16 00:40:56 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/15 22:48:12 | 000,009,220 | -HS- | C] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\4GCn8U7
[2010/03/15 22:48:12 | 000,009,220 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\4GCn8U7
[2010/03/15 08:55:21 | 013,631,488 | ---- | C] () -- C:\Documents and Settings\skyem\ntuser.dat
[2010/03/10 17:40:20 | 000,001,762 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google SketchUp 7.lnk
[2010/03/10 11:54:51 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_silabser_01007.Wdf
[2010/03/10 11:54:50 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/03/09 01:15:24 | 000,560,793 | ---- | C] () -- C:\Documents and Settings\skyem\My Documents\VBA-28-8832-ARE.pdf
[2009/10/09 15:52:38 | 000,038,496 | ---- | C] () -- C:\Documents and Settings\skyem\Application Data\Microsoft Excel.ADR
[2009/06/22 15:26:31 | 002,052,096 | ---- | C] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\filesync.metadata
[2009/04/27 17:26:58 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/04/27 17:26:58 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009/03/30 17:55:55 | 000,519,808 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2008/12/17 17:09:10 | 000,000,752 | ---- | C] () -- C:\WINDOWS\AnimatorDV.INI
[2008/12/16 01:09:25 | 000,000,651 | ---- | C] () -- C:\WINDOWS\Calendar.INI
[2008/11/25 15:33:22 | 000,000,319 | ---- | C] () -- C:\WINDOWS\SWWATER.INI
[2008/10/31 12:51:51 | 000,000,228 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/07/16 13:44:23 | 000,000,352 | ---- | C] () -- C:\WINDOWS\FS1fsmss.ini
[2008/06/11 13:50:47 | 000,146,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\CprDrvr.sys
[2008/06/09 13:28:39 | 000,000,353 | ---- | C] () -- C:\WINDOWS\Sandboxfsmss.ini
[2008/06/09 13:00:36 | 000,000,092 | ---- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini
[2008/06/06 18:27:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2008/05/16 11:51:06 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\skyem\Application Data\$_hpcst$.hpc
[2008/05/13 15:54:04 | 000,000,035 | ---- | C] () -- C:\WINDOWS\FSSERVERfsmss.ini
[2008/05/13 14:35:33 | 000,167,936 | ---- | C] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/05/13 13:57:54 | 000,002,044 | ---- | C] () -- C:\WINDOWS\Comp2000.ini
[2008/05/13 13:57:43 | 000,235,520 | ---- | C] () -- C:\WINDOWS\System32\W048T32W.DLL
[2008/05/13 13:57:43 | 000,137,216 | ---- | C] () -- C:\WINDOWS\System32\W043T32W.DLL
[2008/05/13 13:57:43 | 000,128,000 | ---- | C] () -- C:\WINDOWS\System32\W046T32W.DLL
[2008/05/13 13:57:43 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\W770T32W.DLL
[2008/05/13 13:57:42 | 000,202,752 | ---- | C] () -- C:\WINDOWS\System32\W042T32W.DLL
[2008/05/13 13:57:42 | 000,202,240 | ---- | C] () -- C:\WINDOWS\System32\W019T32W.DLL
[2008/05/13 13:57:42 | 000,168,960 | ---- | C] () -- C:\WINDOWS\System32\W037T32W.DLL
[2008/05/13 13:57:42 | 000,163,328 | ---- | C] () -- C:\WINDOWS\System32\W033T32W.DLL
[2008/05/13 13:57:42 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\W040T32W.DLL
[2008/05/13 13:57:41 | 000,185,344 | ---- | C] () -- C:\WINDOWS\System32\W007T32W.DLL
[2008/05/13 13:57:41 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\W001T32W.DLL
[2008/05/13 13:57:41 | 000,105,984 | ---- | C] () -- C:\WINDOWS\System32\W008T32W.DLL
[2008/05/13 13:57:41 | 000,101,888 | ---- | C] () -- C:\WINDOWS\System32\W015T32W.DLL
[2008/05/13 13:57:41 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\W006T32W.DLL
[2008/05/13 13:57:34 | 000,068,096 | ---- | C] () -- C:\WINDOWS\System32\LFPLT11N.DLL
[2008/05/13 13:57:32 | 000,096,768 | ---- | C] () -- C:\WINDOWS\System32\W801T32W.DLL
[2008/05/13 12:12:57 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\skyem\Local Settings\Application Data\fusioncache.dat
[2008/04/17 15:24:18 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\USA19HPropPage.dll
[2008/04/17 15:24:18 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\k19hinst.dll
[2008/04/17 10:45:22 | 000,000,041 | ---- | C] () -- C:\WINDOWS\LIVEfsmss.ini
[2008/04/17 10:22:28 | 000,000,206 | ---- | C] () -- C:\WINDOWS\hpbafd.ini
[2008/04/16 09:14:28 | 000,087,808 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2008/04/15 13:30:35 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2008/04/15 13:30:35 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll
[2008/04/15 13:03:19 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2008/04/15 13:01:33 | 000,000,818 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/03/11 17:46:38 | 000,008,784 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll
[2007/08/22 11:39:22 | 000,105,848 | ---- | C] () -- C:\WINDOWS\System32\CprIf.dll
[2007/06/28 20:01:48 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2005/02/02 15:06:38 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Lptsend.dll
[2005/02/02 15:06:38 | 000,004,256 | ---- | C] () -- C:\WINDOWS\System32\UserPort.sys
[2005/02/02 15:06:36 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\FCDcontrol.dll
[2005/02/02 15:06:36 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\COMcheck.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2000/10/20 13:25:36 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\acdbres.dll
[1999/03/18 13:58:26 | 000,343,040 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[1999/03/17 18:42:24 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\lfkodak.dll

========== LOP Check ==========

[2010/03/16 01:24:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2008/05/19 14:43:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2009/09/15 10:37:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
[2010/03/17 16:30:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/04/23 11:40:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\ACD Systems
[2008/05/19 14:45:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Autodesk
[2008/12/16 01:08:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\desksware
[2008/05/14 21:37:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Firaxis Games
[2009/08/14 16:09:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\GARMIN
[2009/09/04 15:33:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\LogMeIn Rescue
[2009/05/25 15:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\My Games
[2009/07/03 05:17:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\OpenOffice.org
[2008/08/12 18:19:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\SecondLife
[2008/12/01 15:48:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skyem\Application Data\Xilinx

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

[Rorschach112]

Your logs are clean


Follow these steps to uninstall Combofix and tools used in the removal of malware

Uninstall ComboFix

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
  
• Please follow the prompts to uninstall Combofix.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

• Download OTC to your desktop and run it
• Click Yes to beginning the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Below I have included a number of recommendations for how to protect your computer against malware infections.

• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  
  
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• TFC - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  
  
• Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
  secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
  blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
  Here
  
  
  If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
  • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
  
  
• Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
  
  
• Please read my guide on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.

[soer10705]

Thanks for all your help!!!!