[snickers]

I got message that my computer was infected and it appeared it was from Microsoft and so I ended up downloading Green AV, which I later found out is the spyware itself. How do I get rid of it?

Edited by snickers, 19 September 2009 - 06:33 AM.

[Advertisements]

Hi,

Please do the following:


Please download exeHelper to your desktop.

• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)

Note If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).



NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

---------------------------------------------------
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT



Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  
  
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

[CatByte]

Hi,

Please do the following:


Please download exeHelper to your desktop.

• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)

Note If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).



NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

---------------------------------------------------
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT



Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  
  
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

[snickers]

exeHelper by Raktor - 09
Build 20090916
Run at 14:35:49 on 09/19/09
Now searching...
Checking for numerical processes...
Checking for bad processes...
Checking for bad files...
Resetting filetype association for .exe
Resetting filetype association for .com
--Finished--

I attached the 3 other files. Thank you very much for your help.

Attached Files

•  Attach.zip   2.47KB   233 downloads
•  DDS.txt   18.05KB   192 downloads
•  Gmer.txt   4.93KB   173 downloads

[CatByte]

Hi,

Please do the following:

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2



**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for further review.

[snickers]

I have attached the combofix.txt file.

Attached Files

•  ComboFix.txt   32.78KB   147 downloads

[CatByte]

Hi,

The bottom of the comboFix Log was cut off.

Can you please paste the whole log into the thread

Thanks

[snickers]

ComboFix 09-09-18.02 - MICHELLE 09/19/2009 18:07:01.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2046.1040 [GMT -4:00]
Running from: C:\Users\MICHELLE\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\$RECYCLE.BIN\S-1-5-21-1400113804-1914402855-3429530994-500
C:\$RECYCLE.BIN\S-1-5-21-2152478756-3922319563-605102323-500
C:\$RECYCLE.BIN\S-1-5-21-2363420569-19101160-1035343276-500
C:\ProgramData\gwr\WSTEch.dll
C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
C:\Users\MICHELLE\AppData\Roaming\inst.exe
C:\Users\MICHELLE\Documents\ZbThumbnail.info
C:\Windows\COUPON~1.OCX
C:\Windows\CouponPrinter.ocx
C:\WINDOWS\Installer\10ca01.msp
C:\WINDOWS\Installer\127c91.msi
C:\WINDOWS\Installer\13f15be.msi
C:\WINDOWS\Installer\177df50.msp
C:\WINDOWS\Installer\1f435.msi
C:\WINDOWS\Installer\1f43b.msi
C:\WINDOWS\Installer\1f454.msi
C:\WINDOWS\Installer\1f459.msi
C:\WINDOWS\Installer\1f467.msi
C:\WINDOWS\Installer\1f475.msi
C:\WINDOWS\Installer\1f483.msi
C:\WINDOWS\Installer\1f491.msi
C:\WINDOWS\Installer\53fee.msp
C:\WINDOWS\Installer\5fee9.msi
C:\Windows\system32\tmp.reg

----- BITS: Possible infected sites -----

hxxp://download.kodak.com
.
((((((((((((((((((((((((( Files Created from 2009-08-19 to 2009-09-19 )))))))))))))))))))))))))))))))
.

2009-09-19 22:32:17 . 2009-09-19 22:32:17 0 d-----w- C:\Users\Mcx1\AppData\Local\temp
2009-09-19 22:32:17 . 2009-09-19 22:32:17 0 d-----w- C:\Users\Default\AppData\Local\temp
2009-09-19 22:32:16 . 2009-09-19 22:32:16 0 d-----w- C:\Users\MICHELLE\AppData\Local\temp
2009-09-19 22:32:16 . 2009-09-19 22:32:16 0 d-----w- C:\Users\ALEX\AppData\Local\temp
2009-09-19 22:32:11 . 2009-09-19 22:32:11 0 d-----w- C:\Users\ADAM\AppData\Local\temp
2009-09-19 03:55:13 . 2009-09-19 22:30:29 0 d-----w- C:\ProgramData\gwr
2009-09-11 04:48:21 . 2009-09-11 04:48:22 0 d-----w- C:\Program Files\iPhone Configuration Utility
2009-09-11 04:47:28 . 2009-05-18 18:17:00 26600 ----a-w- C:\Windows\system32\drivers\GEARAspiWDM.sys
2009-09-11 04:47:28 . 2008-04-17 17:12:54 107368 ----a-w- C:\Windows\system32\GEARAspi.dll
2009-09-11 04:45:58 . 2009-09-11 04:47:25 0 d-----w- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-11 03:24:54 . 2009-08-19 18:35:44 651264 ----a-w- C:\Windows\system32\lxdrpmui.dll
2009-09-11 03:24:46 . 2009-08-19 18:35:40 376832 ----a-w- C:\Windows\system32\lxdrcomm.dll
2009-09-11 03:24:29 . 2009-08-19 18:26:22 208896 ----a-w- C:\Windows\system32\lxdrgrd.dll
2009-09-08 23:41:38 . 2009-08-14 17:07:56 897608 ----a-w- C:\Windows\system32\drivers\tcpip.sys
2009-09-08 23:41:36 . 2009-08-14 16:29:41 104960 ----a-w- C:\Windows\system32\netiohlp.dll
2009-09-08 23:41:33 . 2009-08-14 14:16:51 27136 ----a-w- C:\Windows\system32\NETSTAT.EXE
2009-09-08 23:41:33 . 2009-08-14 14:16:50 19968 ----a-w- C:\Windows\system32\ARP.EXE
2009-09-08 23:41:32 . 2009-08-14 14:16:55 9728 ----a-w- C:\Windows\system32\TCPSVCS.EXE
2009-09-08 23:41:32 . 2009-08-14 14:16:49 10240 ----a-w- C:\Windows\system32\finger.exe
2009-09-08 23:41:31 . 2009-08-14 14:16:49 8704 ----a-w- C:\Windows\system32\HOSTNAME.EXE
2009-09-08 23:41:30 . 2009-08-14 14:16:55 17920 ----a-w- C:\Windows\system32\ROUTE.EXE
2009-09-08 23:41:30 . 2009-08-14 14:16:52 11264 ----a-w- C:\Windows\system32\MRINFO.EXE
2009-09-08 23:41:26 . 2009-08-14 16:29:41 17920 ----a-w- C:\Windows\system32\netevent.dll
2009-09-08 23:40:13 . 2009-07-11 19:32:52 293376 ----a-w- C:\Windows\system32\wlanmsm.dll
2009-09-08 23:40:12 . 2009-07-11 19:32:52 302592 ----a-w- C:\Windows\system32\wlansec.dll
2009-09-08 23:40:12 . 2009-07-11 19:29:04 127488 ----a-w- C:\Windows\system32\L2SecHC.dll
2009-09-08 23:40:10 . 2009-07-11 19:32:52 513024 ----a-w- C:\Windows\system32\wlansvc.dll
2009-09-08 23:39:57 . 2009-06-10 12:11:26 2868224 ----a-w- C:\Windows\system32\mf.dll
2009-09-02 21:47:15 . 2009-08-28 12:39:07 28672 ----a-w- C:\Windows\system32\Apphlpdm.dll
2009-09-02 21:47:13 . 2009-08-28 10:15:30 4240384 ----a-w- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-08-31 23:52:36 . 2009-08-31 23:52:36 0 d-----w- C:\ProgramData\Office Genuine Advantage
2009-08-31 16:13:59 . 2009-08-31 16:13:59 0 d-----w- C:\Users\MICHELLE\Office Genuine Advantage
2009-08-28 23:42:52 . 2009-08-28 23:42:52 40448 ----a-w- C:\Windows\system32\drivers\usbaapl.sys
2009-08-28 23:42:52 . 2009-08-28 23:42:52 2065696 ----a-w- C:\Windows\system32\usbaaplrc.dll
2009-08-28 07:02:50 . 2009-06-22 10:22:01 2048 ----a-w- C:\Windows\system32\tzres.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-19 21:54:47 . 2007-03-24 11:30:03 17408 ----a-w- C:\Windows\system32\rpcnetp.exe
2009-09-19 21:54:19 . 2007-03-24 11:31:05 17408 ----a-w- C:\Windows\system32\rpcnetp.dll
2009-09-19 21:54:18 . 2007-03-23 01:19:01 56680 ----a-w- C:\Windows\system32\Rpcnet.dll
2009-09-19 21:51:28 . 2007-04-07 15:13:53 0 d-----w- C:\Program Files\Lavasoft
2009-09-19 21:51:27 . 2009-04-11 09:13:25 0 d-----w- C:\ProgramData\Lavasoft
2009-09-19 21:37:16 . 2009-03-13 01:23:31 0 d-----w- C:\ProgramData\Lx_cats
2009-09-19 12:07:55 . 2009-04-12 23:39:37 0 d-----w- C:\Program Files\Windows Live Safety Center
2009-09-19 11:14:50 . 2008-06-15 11:08:50 0 d-----w- C:\ProgramData\Google Updater
2009-09-17 23:13:22 . 2009-09-17 23:13:22 58606 ----a-w- C:\ProgramData\SPL5238.tmp
2009-09-15 16:42:17 . 2007-04-06 21:59:49 8268 ----a-w- C:\Users\MICHELLE\AppData\Local\d3d9caps.dat
2009-09-13 15:24:34 . 2009-09-13 15:24:34 10870 ----a-w- C:\ProgramData\SPL22FA.tmp
2009-09-12 18:37:24 . 2009-09-12 18:37:23 575662 ----a-w- C:\ProgramData\SPL70DC.tmp
2009-09-12 18:32:54 . 2009-09-12 18:32:53 944736 ----a-w- C:\ProgramData\SPL51C7.tmp
2009-09-12 04:00:14 . 2009-09-12 04:00:14 944736 ----a-w- C:\ProgramData\SPLF336.tmp
2009-09-12 03:58:27 . 2009-09-12 03:58:27 944700 ----a-w- C:\ProgramData\SPL4F5A.tmp
2009-09-12 03:56:36 . 2009-09-12 03:56:36 944700 ----a-w- C:\ProgramData\SPL9EC0.tmp
2009-09-11 10:09:56 . 2007-04-06 10:36:48 0 d-----w- C:\Users\MICHELLE\AppData\Roaming\Apple Computer
2009-09-11 09:48:46 . 2009-06-02 01:52:18 0 d-----w- C:\Program Files\QuickTime
2009-09-11 04:47:25 . 2007-04-06 10:36:28 0 d-----w- C:\Program Files\iTunes
2009-09-11 04:46:01 . 2007-04-06 10:36:30 0 d-----w- C:\Program Files\iPod
2009-09-11 04:46:00 . 2007-07-01 19:53:57 0 d-----w- C:\Program Files\Common Files\Apple
2009-09-10 01:40:48 . 2009-09-10 01:40:48 144908 ----a-w- C:\ProgramData\SPLCF0E.tmp
2009-09-09 11:27:32 . 2008-02-27 03:35:23 0 d-----w- C:\Program Files\Microsoft Silverlight
2009-09-09 09:35:29 . 2009-05-31 03:07:38 0 d-----w- C:\Users\MICHELLE\AppData\Roaming\ComcastToolbar
2009-08-21 00:20:45 . 2008-11-30 15:23:08 0 d-----w- C:\Program Files\Safari
2009-08-19 18:47:28 . 2009-08-19 18:47:28 328360 ----a-w- C:\Windows\system32\lxdrih.exe
2009-08-19 18:47:28 . 2009-03-13 01:00:56 594600 ----a-w- C:\Windows\system32\lxdrcoms.exe
2009-08-19 18:47:26 . 2009-08-19 18:47:26 369320 ----a-w- C:\Windows\system32\lxdrcfg.exe
2009-08-19 18:35:44 . 2009-03-13 01:01:00 860160 ----a-w- C:\Windows\system32\lxdrusb1.dll
2009-08-19 18:35:44 . 2009-03-13 01:01:00 364544 ----a-w- C:\Windows\system32\lxdrinpa.dll
2009-08-19 18:35:44 . 2009-03-13 01:01:00 339968 ----a-w- C:\Windows\system32\lxdriesc.dll
2009-08-19 18:35:42 . 2009-03-13 01:00:59 577536 ----a-w- C:\Windows\system32\lxdrlmpm.dll
2009-08-19 18:35:42 . 2009-03-13 01:00:59 1069056 ----a-w- C:\Windows\system32\lxdrserv.dll
2009-08-19 18:35:40 . 2009-03-13 01:00:57 684032 ----a-w- C:\Windows\system32\lxdrhbn3.dll
2009-08-19 18:35:40 . 2009-03-13 01:00:55 761856 ----a-w- C:\Windows\system32\lxdrcomc.dll
2009-08-14 00:17:09 . 2009-03-11 04:31:05 0 d-----w- C:\Program Files\Yapta
2009-08-09 16:12:40 . 2007-11-14 03:55:31 0 d-----w- C:\ProgramData\Kodak
2009-08-08 00:30:51 . 2009-06-05 10:24:34 0 d-----w- C:\ProgramData\PCPitstop
2009-08-08 00:30:13 . 2009-06-05 10:24:33 0 d-----w- C:\Program Files\PCPitstop
2009-08-05 02:37:34 . 2009-08-05 02:37:34 0 d-----w- C:\ProgramData\Roxio
2009-08-04 17:08:40 . 2009-08-04 11:21:48 0 d-----w- C:\Program Files\Roxio
2009-08-04 11:27:17 . 2009-08-04 11:27:07 0 d-----w- C:\Program Files\Common Files\Sonic Shared
2009-08-04 11:27:10 . 2007-03-16 00:02:47 0 d-----w- C:\Program Files\Common Files\Roxio Shared
2009-08-04 11:23:50 . 2009-08-04 11:23:47 0 d-----w- C:\Program Files\Common Files\SureThing Shared
2009-08-03 19:07:42 . 2009-08-03 19:07:42 403816 ----a-w- C:\Windows\system32\OGACheckControl.dll
2009-08-03 19:07:42 . 2009-08-03 19:07:42 322928 ----a-w- C:\Windows\system32\OGAAddin.dll
2009-08-03 19:07:42 . 2009-08-03 19:07:42 230768 ----a-w- C:\Windows\system32\OGAEXEC.exe
2009-07-30 03:35:23 . 2009-07-29 01:37:00 0 d-----w- C:\Users\MICHELLE\AppData\Roaming\Vso
2009-07-30 03:35:22 . 2009-07-29 01:37:00 47360 ----a-w- C:\Users\MICHELLE\AppData\Roaming\pcouffin.sys
2009-07-29 11:11:55 . 2009-07-29 11:11:55 0 d-----w- C:\ProgramData\vsosdk
2009-07-29 01:37:00 . 2009-07-29 01:37:00 47360 ----a-w- C:\Windows\system32\drivers\pcouffin.sys
2009-07-29 00:07:19 . 2009-07-28 03:13:29 0 d-----w- C:\Users\MICHELLE\AppData\Roaming\WinFF
2009-07-27 19:15:50 . 2007-03-16 00:16:29 0 d-----w- C:\Program Files\CyberLink
2009-07-27 19:13:21 . 2007-04-07 16:25:51 0 d-----w- C:\Users\MICHELLE\AppData\Roaming\CyberLink
2009-07-21 21:52:28 . 2009-07-28 23:05:26 915456 ----a-w- C:\Windows\system32\wininet.dll
2009-07-21 21:47:28 . 2009-07-28 23:05:23 109056 ----a-w- C:\Windows\system32\iesysprep.dll
2009-07-21 21:47:27 . 2009-07-28 23:05:22 71680 ----a-w- C:\Windows\system32\iesetup.dll
2009-07-21 20:13:58 . 2009-07-28 23:05:24 133632 ----a-w- C:\Windows\system32\ieUnatt.exe
2009-07-19 13:58:49 . 2009-07-19 13:58:49 618116 ----a-w- C:\ProgramData\SPLC3EA.tmp
2009-07-17 14:35:11 . 2009-08-12 05:42:41 71680 ----a-w- C:\Windows\system32\atl.dll
2009-07-15 23:33:16 . 2009-07-15 23:33:24 76184 ----a-w- C:\Windows\system32\atsckernel.exe
2009-07-15 23:33:15 . 2009-07-15 23:33:23 20376 ----a-w- C:\Windows\system32\atashost.exe
2009-07-14 13:06:04 . 2009-07-14 13:06:04 106496 ----a-w- C:\Windows\system32\lxdrinsr.dll
2009-07-14 13:06:02 . 2009-07-14 13:06:02 36864 ----a-w- C:\Windows\system32\lxdrcur.dll
2009-07-14 13:05:42 . 2009-07-14 13:05:42 147456 ----a-w- C:\Windows\system32\lxdrjswr.dll
2009-07-14 13:03:06 . 2009-07-14 13:03:06 200704 ----a-w- C:\Windows\system32\lxdrinsb.dll
2009-07-14 13:03:02 . 2009-07-14 13:03:02 90112 ----a-w- C:\Windows\system32\lxdrcub.dll
2009-07-14 13:01:26 . 2009-07-14 13:01:26 77824 ----a-w- C:\Windows\system32\lxdrcu.dll
2009-07-14 13:01:24 . 2009-07-14 13:01:24 176128 ----a-w- C:\Windows\system32\lxdrins.dll
2009-07-14 13:00:17 . 2009-08-12 05:42:18 313344 ----a-w- C:\Windows\system32\wmpdxm.dll
2009-07-14 12:59:28 . 2009-08-12 05:42:12 4096 ----a-w- C:\Windows\system32\dxmasf.dll
2009-07-14 12:59:16 . 2009-07-14 12:59:16 544768 ----a-w- C:\Windows\system32\lxdrutil.dll
2009-07-14 12:58:44 . 2009-08-12 05:42:15 7680 ----a-w- C:\Windows\system32\spwmp.dll
2009-07-14 10:59:56 . 2009-08-12 05:42:09 8147456 ----a-w- C:\Windows\system32\wmploc.DLL
2009-07-10 22:59:32 . 2009-07-10 22:59:32 409600 ----a-w- C:\Windows\system32\lxdrcoin.dll
2009-06-29 11:02:14 . 2009-06-29 11:02:14 747262 ----a-w- C:\ProgramData\SPLFA7E.tmp
2009-06-27 21:25:14 . 2007-03-23 00:27:25 59688 ----a-w- C:\Users\ALEX\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-23 23:02:18 . 2009-06-23 23:02:18 1115988 ----a-w- C:\ProgramData\SPLDD55.tmp
2009-06-23 22:57:27 . 2009-06-23 22:57:25 1115988 ----a-w- C:\ProgramData\SPL623C.tmp
2007-09-03 19:41:23 . 2007-09-03 19:41:23 8 --sha-r- C:\Windows\System32\DB460FB393.sys
2007-09-03 19:41:27 . 2007-09-03 19:41:22 2828 --sha-w- C:\Windows\System32\KGyGaAvL.sys
2007-03-16 07:39:26 . 2007-03-16 07:38:46 8192 --sha-w- C:\Windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 07:33:09 125952]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe" [2005-05-09 23:16:15 192512]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2009-07-26 23:39:08 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 23:52:40 815104]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2006-10-13 16:31:34 184320]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 16:37:04 81920]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-11-22 01:09:02 842584]
"Yapta Tracker"="C:\Program Files\Yapta\YaptaClient.exe" [2009-07-27 20:54:44 345392]
"Conime"="C:\Windows\system32\conime.exe" [2008-01-19 07:33:04 69120]
"lxdrmon.exe"="C:\Program Files\Lexmark 4900 Series\lxdrmon.exe" [2008-09-10 10:24:21 676520]
"lxdramon"="C:\Program Files\Lexmark 4900 Series\lxdramon.exe" [2008-09-10 10:24:19 16040]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 22:12:38 582992]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 21:10:28 35696]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 16:35:42 221184]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2009-09-05 05:54:42 417792]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2009-09-09 01:09:42 305440]
"03874569874596"="C:\ProgramData\gwr\rwg.exe" [2009-09-18 22:32:14 753664]
"SigmatelSysTrayApp"="sttray.exe" - C:\Windows\sttray.exe [2007-02-08 05:11:04 303104]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - C:\Windows\KHALMNPR.Exe [2008-10-10 19:46:26 69632]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Users\MICHELLE\Desktop\SetPoint\SetPoint.exe [2009-1-21 809488]
PHOTOfunSTUDIO.lnk - C:\Program Files\Panasonic\PHOTOfunSTUDIO\PhAutoRun.exe [2009-6-18 44176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\C:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\Windows\pss\Kodak EasyShare software.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=C:\Windows\pss\KODAK Software Updater.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^MICHELLE^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Media Player.lnk]
path=C:\Users\MICHELLE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk
backup=C:\Windows\pss\Adobe Media Player.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^MICHELLE^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CNNAlerter.lnk]
path=C:\Users\MICHELLE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CNNAlerter.lnk
backup=C:\Windows\pss\CNNAlerter.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoBoingo
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TheLaptopLock

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"="0x00000000"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B1554098-2B14-4333-AB0F-53C74A49A14E}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ED6CBBD3-6B02-4778-B34E-BD25CBF4565F}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{3D534813-C883-45F3-A789-39270E6E86AC}C:\\windows\\system32\\ctmweb.exe"= UDP:C:\windows\system32\ctmweb.exe:ctmweb.exe
"UDP Query User{EDAF5A29-FFD8-420C-AA2B-5BA4D35D771F}C:\\windows\\system32\\ctmweb.exe"= TCP:C:\windows\system32\ctmweb.exe:ctmweb.exe
"TCP Query User{D43BA8D4-F7BF-4050-9284-AB50D651E5B5}C:\\program files\\msgtag\\msgtag.exe"= UDP:C:\program files\msgtag\msgtag.exe:MSGTAG
"UDP Query User{A04EEB63-2E58-4A23-AFAC-0399D4CFE036}C:\\program files\\msgtag\\msgtag.exe"= TCP:C:\program files\msgtag\msgtag.exe:MSGTAG
"TCP Query User{D2F82F5E-FD86-4665-A18B-E84EE1C6F72D}C:\\program files\\gametap\\bin\\release\\gametap.exe"= UDP:C:\program files\gametap\bin\release\gametap.exe:GameTap Application
"UDP Query User{9861C908-5E46-4321-ABBC-5E620546A5B4}C:\\program files\\gametap\\bin\\release\\gametap.exe"= TCP:C:\program files\gametap\bin\release\gametap.exe:GameTap Application
"TCP Query User{F89360A3-D292-4764-BEC1-6DBB953E01F1}C:\\program files\\kodak\\kodak software updater\\7288971\\program\\kodak software updater.exe"= UDP:C:\program files\kodak\kodak software updater\7288971\program\kodak software updater.exe:Kodak Software Updater
"UDP Query User{BD635C9A-0907-4FD2-AFE2-675FAC3D1227}C:\\program files\\kodak\\kodak software updater\\7288971\\program\\kodak software updater.exe"= TCP:C:\program files\kodak\kodak software updater\7288971\program\kodak software updater.exe:Kodak Software Updater
"TCP Query User{C83D8481-DADE-4A8D-9C67-B6ECB53C5CD7}C:\\program files\\msgtag\\msgtag.exe"= UDP:C:\program files\msgtag\msgtag.exe:MSGTAG
"UDP Query User{636FDF6B-88D1-4B9F-8F44-CB1FF52F4E2F}C:\\program files\\msgtag\\msgtag.exe"= TCP:C:\program files\msgtag\msgtag.exe:MSGTAG
"{3ED2C9C4-576B-467C-A65D-10DF23C626EE}"= UDP:C:\Program Files\DellConnect\Bin\Launch.exe:DellConnect
"{3EE1A3D4-3C15-4AC7-B86C-5996D97A48E9}"= TCP:C:\Program Files\DellConnect\Bin\Launch.exe:DellConnect
"{B879921C-3A93-4525-8841-167B8F6A97E1}"= UDP:C:\Program Files\DellSupport\DSAgnt.exe:Dell Support
"{216E4DDF-DE39-48EA-9C71-C9E50B5DE001}"= TCP:C:\Program Files\DellSupport\DSAgnt.exe:Dell Support
"{E66C97C6-5D24-43B7-A467-CAB0C11B70A9}"= UDP:C:\Program Files\Siber Systems\AI RoboForm\identities.exe:Edit Identities
"{4BDDCE18-AD70-4D5B-A295-85879AD15CA7}"= TCP:C:\Program Files\Siber Systems\AI RoboForm\identities.exe:Edit Identities
"{44BFD514-1882-453E-A59B-812450E004F3}"= UDP:C:\Program Files\Siber Systems\AI RoboForm\passcards.exe:Edit Passcards
"{CE7B810C-CFB6-4B6E-978F-9EE45BFA4B27}"= TCP:C:\Program Files\Siber Systems\AI RoboForm\passcards.exe:Edit Passcards
"{E64F1CC6-CCCE-4421-8CC8-58F6E4AD9885}"= UDP:C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe:Google Desktop
"{628C37BC-9B09-4F70-B032-61A98A4E03F4}"= TCP:C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe:Google Desktop
"{7380B378-C2D6-46BA-B559-C95FF834CE98}"= UDP:C:\Program Files\Dell\MediaDirect\MDirect.exe:MediaDirect
"{0B2FCAB0-00B8-450D-A4AE-02B51CE85656}"= TCP:C:\Program Files\Dell\MediaDirect\MDirect.exe:MediaDirect
"{679C1439-F3D7-4CFC-8024-04BA1E1ED472}"= UDP:C:\Program Files\Windows Mail\WinMail.exe:Windows Mail
"{94062850-02BD-4DF0-AED9-18FCE59BFF59}"= TCP:C:\Program Files\Windows Mail\WinMail.exe:Windows Mail
"{29F8919D-6F4D-42F3-A705-22EA50E06ADB}"= UDP:C:\Program Files\Yapta\YaptaClient.exe:Yapta Tracker
"{0FE933A4-EF81-402B-ABD4-AC7050A757A5}"= TCP:C:\Program Files\Yapta\YaptaClient.exe:Yapta Tracker
"{A250B121-7F24-4B44-9DC8-AC0987E49D8E}"= UDP:C:\Program Files\Canon\ZoomBrowser EX\Program\ZoomBrowser.exe:ZoomBrowser EX
"{2208ABAE-84E1-4BA5-88EE-07C05276E0E6}"= TCP:C:\Program Files\Canon\ZoomBrowser EX\Program\ZoomBrowser.exe:ZoomBrowser EX
"{82F03D62-F85F-488C-962D-A0D5DCD43A3F}"= UDP:C:\Program Files\Yapta\YaptaSettings.exe:Yapta Settings
"{0B7D2C3A-C882-4D25-86CE-41A35E090C2F}"= TCP:C:\Program Files\Yapta\YaptaSettings.exe:Yapta Settings
"TCP Query User{3EA75441-6FFA-4025-8173-E7BB13E26274}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{7352AE6C-4A27-47FB-8819-6698C3D849DD}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{4DE8204E-ACBD-4A99-B753-0ABE3B222B3A}"= Disabled:UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{F513ED03-39D0-4D90-ACA4-B90E22352EAA}"= Disabled:TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{48E30C34-8B59-4237-9BA5-DF2D03A6B58F}C:\\stubinstaller.exe"= Disabled:UDP:C:\stubinstaller.exe:LimeWire swarmed installer
"UDP Query User{5C114170-9817-42B0-BC9A-76DF82D8D390}C:\\stubinstaller.exe"= Disabled:TCP:C:\stubinstaller.exe:LimeWire swarmed installer
"{B88FD737-5383-4179-82B4-74D7539DF820}"= UDP:C:\Program Files\Yapta\YaptaClient.exe:Yapta Tracker
"{FA189B96-D168-4193-9B46-5844411F2853}"= TCP:C:\Program Files\Yapta\YaptaClient.exe:Yapta Tracker
"{A4BF2964-60BB-41D2-8FF4-909B7B58BD66}"= UDP:C:\Program Files\Canon\ZoomBrowser EX\Program\ZoomBrowser.exe:ZoomBrowser EX
"{906A78A7-240B-43AE-A613-4F810558BFA9}"= TCP:C:\Program Files\Canon\ZoomBrowser EX\Program\ZoomBrowser.exe:ZoomBrowser EX
"{C1A3343D-F974-4C04-B72D-AF5A38D2ED05}"= UDP:C:\Program Files\Yapta\YaptaSettings.exe:Yapta Settings
"{4F0A5109-84D0-44BB-A790-109AC3FEEC8D}"= TCP:C:\Program Files\Yapta\YaptaSettings.exe:Yapta Settings
"{E198FFB7-D2BE-4675-A12A-56BA83A8C914}"= UDP:C:\Program Files\Windows Defender\MSASCui.exe:Windows Defender
"{6FE7F10D-4B1E-4BC4-A139-AD78D5905E87}"= TCP:C:\Program Files\Windows Defender\MSASCui.exe:Windows Defender
"{1DCE3C0D-F2EF-4263-B6E0-7685B50E4C9D}"= UDP:C:\Program Files\DellConnect\Bin\Launch.exe:DellConnect
"{9E3B61B8-5CEB-4EE1-B72E-4FC50200BF07}"= TCP:C:\Program Files\DellConnect\Bin\Launch.exe:DellConnect
"{36964AF2-35E1-4362-A591-0EA66566C543}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{46956F07-0AF5-4008-AE0F-AC754E81351B}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{D7F36AF8-F5CE-40B9-8B86-294DA9B2A2CA}"= UDP:C:\Program Files\AIM6\aim6.exe:AIM
"{FD1C8B6A-D6B6-4DD5-925E-F164F66A2785}"= TCP:C:\Program Files\AIM6\aim6.exe:AIM
"{3D9B9A8F-A7C7-4502-B087-4B145E7AD03A}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{EC7C1EA9-AD5B-4684-ABA5-D6CE1D5EDEB5}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{113E2CC1-780A-4BF8-B7C1-B3FF4148DC64}"= UDP:9322:EKDiscovery
"{9638770B-3FE6-473E-AEE8-8FEC1959E026}"= UDP:9323:EKDiscovery
"{EFDE957D-9947-43E2-B6A7-BA9D55C6ADAE}"= UDP:9323:EKDiscovery
"{0EB38B8B-C0AA-483F-AFFF-E87291A5DF35}"= E:\setup\hpznui01.exe:hpznui01.exe
"{6D43A19E-7993-4D5B-B5F8-0523D97B53C6}"= TCP:427|RPort=427|C:\Windows\system32\svchost.exe|Svc=HPSLPSVC:SLP_Service
"{234C3492-7FB8-4525-B3FB-E208020B7755}"= C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{6B13E0CB-19B7-48AE-90C1-C3FF7992E389}"= C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{EEF28060-ABC8-4E21-B759-3857B8E1DD11}"= C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{983BC193-BB32-45A8-B76F-CAF0D1BFBA21}"= C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{0004B0A9-C8B9-44FD-A22D-7DF125E745ED}"= C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{6E9DB860-F919-42C6-AAC0-A08BA17FB620}"= C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:hpiscnapp.exe
"{8C082C5A-1D63-475B-B131-49759BD367F8}"= C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqphotocrm.exe:hpqphotocrm.exe
"{4DB974E1-3604-4A81-966F-996C99936230}"= C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:hpqsudi.exe
"{F67336F7-A63F-42DA-88F4-149A08AE938A}"= C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:hpqpsapp.exe
"{28B1F9DC-F233-44D6-9137-A6417654E22F}"= C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:hpqpse.exe
"{4011D4A0-09D4-4F4E-87C4-B5E36878067B}"= C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:hpqgplgtupl.exe
"{5A1DC797-8511-436A-AD79-058576F12F52}"= C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:hpqgpc01.exe
"{24CE2F8C-0095-413A-87B4-81026D7DA51A}"= UDP:C:\Windows\System32\lxdrcoms.exe:Lexmark Communications System
"{9D939F04-BDA2-47FB-B589-FB05B380CAF0}"= TCP:C:\Windows\System32\lxdrcoms.exe:Lexmark Communications System
"{1FBAF56F-7D89-4C63-9F19-F0407645BCBD}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdrpswx.exe:Printer Status Window
"{97DFC081-8E47-4BA8-B33C-EB4134D9C3AA}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdrpswx.exe:Printer Status Window
"{84599512-F9F6-4832-9F46-7DA2D019BCDD}"= UDP:C:\Program Files\Lexmark 4900 Series\lxdramon.exe:Lexmark Device Monitor
"{9F2492D1-4B78-4120-BE83-9545BC5DE584}"= TCP:C:\Program Files\Lexmark 4900 Series\lxdramon.exe:Lexmark Device Monitor
"{1ADE7CA6-F4FB-4E47-A15A-83708182282F}"= UDP:C:\Program Files\Lexmark 4900 Series\frun.exe:Lexmark Productivity Studio
"{86089135-96F2-42C3-99A0-FEEBBC0BC44C}"= TCP:C:\Program Files\Lexmark 4900 Series\frun.exe:Lexmark Productivity Studio
"{421580AA-A3BB-435E-AA6B-6A36A87D03E7}"= Profile=Private|Profile=Public|C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"TCP Query User{D2EF6CCE-7207-4147-934C-88127C2D73FC}C:\\program files\\aim6\\aim6.exe"= UDP:C:\program files\aim6\aim6.exe:AIM
"UDP Query User{D1EF9AE5-0B50-4485-83E1-43185B9540DF}C:\\program files\\aim6\\aim6.exe"= TCP:C:\program files\aim6\aim6.exe:AIM
"{155798F7-6339-4517-837E-1B66527AA697}"= UDP:C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader
"{7E6CD9DB-5166-4E6C-A17F-05E77B9079A2}"= TCP:C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader
"{A91548C1-337B-494C-A0E0-4368A7899392}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A8487762-9C8E-4A52-93A4-756FC847B520}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{11B740B1-3991-4977-98EC-952A0313EBF0}"= UDP:C:\Program Files\UltiDev\Cassini Web Server for ASP.NET 2.0\UltiDevCassinWebServer2a.exe:UltiDev Cassini Web Server for ASP.NET 2.0
"{6DB90BC2-8E8D-4FE0-AD43-7B71AB86266C}"= TCP:C:\Program Files\UltiDev\Cassini Web Server for ASP.NET 2.0\UltiDevCassinWebServer2a.exe:UltiDev Cassini Web Server for ASP.NET 2.0
"TCP Query User{17DA61C3-4E9D-4C9C-84F2-8C753AC32844}C:\\program files\\webguide\\webguide4\\bin\\webguide_configuration.exe"= UDP:C:\program files\webguide\webguide4\bin\webguide_configuration.exe:WebGuide_Configuration
"UDP Query User{06A092FC-C5E1-4046-BC54-5E33034856D3}C:\\program files\\webguide\\webguide4\\bin\\webguide_configuration.exe"= TCP:C:\program files\webguide\webguide4\bin\webguide_configuration.exe:WebGuide_Configuration
"{0938EC74-671D-4908-98F5-A54A8CAAE687}"= UDP:58550:WebGuide
"{22D43C65-923D-4FEC-AC70-FCE639B4673B}"= UDP:58551:WebGuide
"{C1BC8A0D-E5FB-45B9-B40F-C7D6407E1097}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{A1B8B99F-C381-4ECA-89BD-4110793375D7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 tclondrv;tclondrv;C:\Windows\System32\drivers\tclondrv.sys [10/1/2008 8:50:26 AM 20352]
R2 atashost;WebEx Service Host for Support Center;C:\Windows\System32\atashost.exe [7/15/2009 7:33:23 PM 20376]
R2 lxdr_device;lxdr_device;C:\Windows\system32\lxdrcoms.exe -service --> C:\Windows\system32\lxdrcoms.exe -service [?]
R2 tgsrvc_providercomcast;SupportSoft Repair Service (providercomcast);C:\Program Files\providerComcast\bin\tgsrvc.exe [5/2/2008 12:40:34 PM 148768]
R2 UltiDev Cassini Web Server for ASP.NET 2.0;UltiDev Cassini Web Server for ASP.NET 2.0;C:\Program Files\UltiDev\Cassini Web Server for ASP.NET 2.0\UltiDevCassinWebServer2a.exe [2/8/2007 12:06:10 AM 49152]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [10/9/2008 8:16:46 PM 24652]
R2 WebGuideTranscode;WebGuideTranscode;C:\Program Files\WebGuide\WebGuide4\bin\WebGuideTranscodeService.exe [8/8/2007 7:28:42 PM 40960]
R3 NETw5v32;Intel® WiFi Link Adapter Driver for Windows Vista 32 Bit ;C:\Windows\System32\drivers\NETw5v32.sys [1/17/2008 2:53:00 PM 4788736]
S2 lxdrCATSCustConnectService;lxdrCATSCustConnectService;C:\Windows\System32\spool\drivers\w32x86\3\lxdrserv.exe [5/16/2008 11:39:03 AM 98984]
S4 PCPitstop Scheduling;PCPitstop Scheduling;C:\Program Files\PCPitstop\PCPitstopScheduleService.exe [8/7/2009 8:27:36 PM 90352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-19 C:\Windows\Tasks\Google Software Updater.job
- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-15 11:08:46 . 2009-03-27 00:13:04]

2009-09-15 C:\Windows\Tasks\McDefragTask.job
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2009-05-14 11:23:00 . 2007-12-04 17:32:10]

2009-08-01 C:\Windows\Tasks\McQcTask.job
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2009-05-14 11:23:00 . 2007-12-04 17:32:10]

2009-09-19 C:\Windows\Tasks\User_Feed_Synchronization-{43A518E6-C34F-4385-927F-75DDE5105BDE}.job
- C:\Windows\system32\msfeedssync.exe [2009-07-28 23:05:22 . 2009-07-21 20:13:15]

2009-09-19 C:\Windows\Tasks\User_Feed_Synchronization-{4EF27C85-EE55-495F-80F8-3060E4B8A57A}.job
- C:\Windows\system32\msfeedssync.exe [2009-07-28 23:05:22 . 2009-07-21 20:13:15]

2009-09-19 C:\Windows\Tasks\User_Feed_Synchronization-{5F21486F-FCF4-4E72-B917-B2262D5A96A6}.job
- C:\Windows\system32\msfeedssync.exe [2009-07-28 23:05:22 . 2009-07-21 20:13:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://comcast.net/
uInternet Settings,ProxyOverride = *.local
IE: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {{0362b485-11fe-469c-ae98-42f478e581a0} - C:\Program Files\Yapta\YaptaSettings.exe
IE: {{0094A600-9BDD-4019-BAFE-487284F7D476} - {C3C07AD6-ACE9-43EE-A2AF-45BC13F6275F} - C:\Program Files\Yapta\YaptaSidebar.dll
Trusted Zone: comcastsupport.com\www
Trusted Zone: gameinformer.com
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: msgtag.com\www
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB
FF - ProfilePath - C:\Users\MICHELLE\AppData\Roaming\Mozilla\Firefox\Profiles\edccnlxs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=TB50TRFF;homepage=no;search=yesab&query=
FF - component: C:\Program Files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - component: C:\Users\MICHELLE\AppData\Roaming\Mozilla\Firefox\Profiles\edccnlxs.default\extensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1}\components\WinampPlayer.dll
FF - component: C:\Users\MICHELLE\AppData\Roaming\Mozilla\Firefox\Profiles\edccnlxs.default\gsl.dll
FF - plugin: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

Notify-GoToAssist - (no file)

[CatByte]

Hi,

There should be another section after "Orphans Removed"


Like this example: --- E O F --- date_time is usually the last line - check at C:\ComboFix.txt

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-CTFMON - (no file)
AddRemove-{83d96ed0-98aa-4515-8ddc-816f3efdd104} - c:\program files\InstallShield Installation Information\{83D96ED0-98AA-4515-8DDC-816F3EFDD104}\setup.exe
AddRemove-uTorrent - c:\program files\uTorrent\uTorrent.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-19 06:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3678683883-2346267703-745543312-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1a,74,fb,b2,20,77,c5,26,ca,69,86,86,4b,e0,08,e6,d0,79,55,18,3c,c3,54,
0a,8f,f8,a1,c7,6d,b7,5a,a6,aa,0f,a6,8e,5e,bd,40,72,45,93,66,14,84,80,cb,df,\
"??"=hex:3f,eb,b2,a8,d5,51,4b,c2,1b,01,ec,08,0f,18,11,95

[HKEY_USERS\S-1-5-21-3678683883-2346267703-745543312-1005\Software\SecuROM\License information*]
"datasecu"=hex:da,6d,cc,71,46,d1,4b,8e,ab,c7,f0,9f,5f,5a,de,fa,1c,42,eb,6e,3c,
66,fa,87,78,ae,d4,86,d9,e0,5e,7b,87,df,e4,a1,b4,09,d3,b3,f2,03,69,1a,3b,31,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(908)
c:\program files\AlienGUIse\fastload.dll
.
Completion time: 2009-09-19 7:00
ComboFix-quarantined-files.txt 2009-09-19 14:00

Pre-Run: 147,731,644,416 bytes free
Post-Run: 147,995,840,512 bytes free

Current=7 Default=7 Failed=6 LastKnownGood=4 Sets=1,2,3,4,6,7
217 --- E O F --- 2009-01-14 15:29

Edited by CatByte, 19 September 2009 - 06:17 PM.

[snickers]

In the combofix.txt file in notepad, the last line
is


- - - - ORPHANS REMOVED - - - -

Notify-GoToAssist - (no file)

I don't know why the rest of the lines aren't there. Do I need to scan again, or is there something else I can do?

[CatByte]

Hi,

Leave it for now, please do the following:

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
• They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
C:\ProgramData\SPL5238.tmp
C:\ProgramData\SPL22FA.tmp
C:\ProgramData\SPL70DC.tmp
C:\ProgramData\SPL51C7.tmp
C:\ProgramData\SPLF336.tmp
C:\ProgramData\SPL4F5A.tmp
C:\ProgramData\SPL9EC0.tmp
C:\ProgramData\SPLC3EA.tmp
C:\ProgramData\SPLFA7E.tmp
C:\ProgramData\SPLDD55.tmp
C:\ProgramData\SPL623C.tmp

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you.
• Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT



Please download Malwarebytes' Anti-Malware

• Double Click mbam-setup.exe to install the application.
• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <-- very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
  
  
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

In your next reply please include

• ComboFix.Log
• MBAM Log
• Kaspersky report

[snickers]

Hi.
How do I disable script blocking?
Never mind- I think I found it in Mcafee I disabled script scanning.

Edited by snickers, 19 September 2009 - 07:09 PM.

[snickers]

Okay, here are the attached files. Thanks again for the help.

Attached Files

•  COMBOFIX.txt   34.39KB   135 downloads
•  mbam_log_2009_09_19__21_56_09_.txt   1.27KB   111 downloads
•  Kaspersky.txt   999bytes   108 downloads

[CatByte]

Hi

Please do the following:


Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

cmd /c del /f/a/q "C:\Users\MICHELLE\AppData\Roaming\Mozilla\Firefox\Profiles\edccnlxs.default\gsl.dll"

NEXT

Please post a fresh DDS and Attach.txt and advise how your computer is running now and if there are any outstanding issues

[snickers]

Everything is good now. The computer is running okay, and it seems like the virus/spyware is gone.

I notice that when I start the computer it says that windows has blocked some start up programs.

One thing I noticed is that Windows Defender application is no longer there; when I click on the icon it says application not found. When I try to redownload it, it says that I do not need to install this software because it is included in Windows Vista. I don't know how long the application has been gone for. It may very well have been missing before this virus attack, because I never checked before and just happened to notice now. How important is it to have Windows Defender and is there anyway to reinstall it?

Is the malwarebytes a good spyware program to prevent future spyware attacks? Do I need more than 1 spyware program?

Thanks for all the help you have given me.

Attached Files

•  DDS.txt   19.11KB   156 downloads
•  Attach__2_.zip   2.48KB   162 downloads

[CatByte]

Hi,

Windows Defender is running on your system.

What programs are blocked on startup?

McAfee Antivirus is installed, that is the only Antivirus you need.
You are fine with McAfee and Windows Defender. Keep Malwarebytes, update it and run it frequently, it is a good program to have.

I have more recommendations in my closing that you can try as well.


Your logs are clean, just need to do some housekeeping now.

Please do the following:


Please download JavaRa to your desktop and unzip it to its own folder.

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
• Scroll down to the Java SE Runtime Environment (JRE) option.
• Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 16)

NEXT

Follow these steps to uninstall Combofix

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

NEXT

Now to remove the rest of the tools that we have used in fixing your machine:

• Make sure you have an Internet Connection.
• Download OTC to your desktop and run it
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them
  Then consider a password keeper, to keep all your passwords safe.
  
• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  
  
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  
  WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox and IE
  
  
• For Firefox, I highly recommend this add-on to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
• In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
  Think Prevention.
  PC Safety and Security--What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.