island-boy

September 1, 2009

Thanks again Mieke! I looked at your blog, good stuff in them!

August 31, 2009

Hi mieke,

My computer looks to be okay. Its running faster and there are no visible malwares or viruses. I guess I'm good for now

thanks for all the help!!!

August 30, 2009

hi

i deleted the stuff you mentioned above and uninstalled Combofix.

Here's my new Hikackthis log:

-------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:34:15 AM, on 8/30/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\IPSSVC.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\rpcnet.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

C:\WINDOWS\System32\TPHDEXLG.exe

C:\WINDOWS\system32\TpKmpSVC.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

C:\Program Files\Lenovo\Rescue and Recovery\adm\IUService.exe

c:\program files\lenovo\system update\suservice.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\TpShocks.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe

C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe

C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe

C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe

C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe

C:\WINDOWS\system32\TpScrLk.exe

C:\Program Files\Lenovo\Client Security Solution\cssauth.exe

C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\WINDOWS\system32\CF28913.exe

C:\WINDOWS\system32\cscript.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://business.tepper.cmu.edu/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper

O4 - HKLM\..\Run: [TpShocks] TpShocks.exe

O4 - HKLM\..\Run: [TP4EX] tp4ex.exe

O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe

O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe

O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe

O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor

O4 - HKLM\..\Run: [bLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog

O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\system32\TpScrLk.exe

O4 - HKLM\..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent

O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe"

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - S-1-5-18 Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: Adobe Reader Speed Launch.lnk.disabled (User 'SYSTEM')

O4 - S-1-5-18 Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: Adobe Reader Synchronizer.lnk.disabled (User 'SYSTEM')

O4 - S-1-5-18 Startup: Bluetooth.lnk = ? (User 'SYSTEM')

O4 - S-1-5-18 Startup: Digital Line Detect.lnk = ? (User 'SYSTEM')

O4 - S-1-5-18 Startup: Digital Line Detect.lnk.disabled (User 'SYSTEM')

O4 - S-1-5-18 Startup: Leash Ticket Manager.lnk = C:\Program Files\MIT\Kerberos\bin\leash32.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe (User 'Default user')

O4 - .DEFAULT Startup: Adobe Reader Speed Launch.lnk.disabled (User 'Default user')

O4 - .DEFAULT Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe (User 'Default user')

O4 - .DEFAULT Startup: Adobe Reader Synchronizer.lnk.disabled (User 'Default user')

O4 - .DEFAULT Startup: Bluetooth.lnk = ? (User 'Default user')

O4 - .DEFAULT Startup: Digital Line Detect.lnk = ? (User 'Default user')

O4 - .DEFAULT Startup: Digital Line Detect.lnk.disabled (User 'Default user')

O4 - .DEFAULT Startup: Leash Ticket Manager.lnk = C:\Program Files\MIT\Kerberos\bin\leash32.exe (User 'Default user')

O4 - .DEFAULT User Startup: Bluetooth.lnk = ? (User 'Default user')

O4 - .DEFAULT User Startup: Leash Ticket Manager.lnk = C:\Program Files\MIT\Kerberos\bin\leash32.exe (User 'Default user')

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [JAVA_IBM] Java (IBM)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186629554843

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186629449656

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O20 - Winlogon Notify: AwayNotify - C:\Program Files\Lenovo\AwayTask\AwayNotify.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe

O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe

O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe

O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\adm\IUService.exe

--

End of file - 14527 bytes

August 30, 2009

Thanks for the patience btw.

Combofix log:

-----------

ComboFix 09-08-29.01 - Oliver 08/30/2009 3:02.1.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.444 [GMT -4:00]

Running from: d:\my documents\Downloads\ComboFix.exe

AV: avast! antivirus 4.8.1351 [VPS 090829-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd

c:\documents and settings\NetworkService\Application Data\buguxaka.dl

c:\documents and settings\NetworkService\Application Data\kekecoqegy.com

c:\documents and settings\NetworkService\Application Data\vujewi.reg

c:\documents and settings\NetworkService\Application Data\wecydez.reg

c:\documents and settings\NetworkService\Cookies\mixil.dl

c:\documents and settings\NetworkService\Local Settings\Application Data\emunase.exe

c:\documents and settings\NetworkService\Local Settings\Application Data\gora.scr

c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\akezixyvas.bat

c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\azazy.scr

c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\ibem.reg

c:\documents and settings\NetworkService\oashdihasidhasuidhiasdhiashdiuasdhasd

c:\program files\Common Files\emofyhuji.sys

c:\program files\WinPCap

c:\program files\WinPCap\rpcapd.exe

c:\recycler\S-1-5-21-1311326432-884624041-1544664029-500

c:\recycler\S-1-5-21-1368029175-3410181526-1144003801-500

c:\recycler\S-1-5-21-2640639099-1956543502-3999591566-1005

c:\recycler\S-1-5-21-2640639099-1956543502-3999591566-1012

c:\recycler\S-1-5-21-2640639099-1956543502-3999591566-1013

c:\recycler\S-1-5-21-2640639099-1956543502-3999591566-500

c:\recycler\S-1-5-21-3202953100-4138470448-3906029960-1017

c:\recycler\S-1-5-21-3202953100-4138470448-3906029960-500

c:\windows\aqemik.bat

c:\windows\bobyxameba.inf

c:\windows\Installer\10209c2.msp

c:\windows\Installer\106b38.msi

c:\windows\Installer\127ba63.msp

c:\windows\Installer\1363b46.msp

c:\windows\Installer\1363b5d.msp

c:\windows\Installer\1363b78.msp

c:\windows\Installer\1363b91.msp

c:\windows\Installer\1591cf.msi

c:\windows\Installer\166218.msp

c:\windows\Installer\166223.msp

c:\windows\Installer\16622f.msp

c:\windows\Installer\1b9b6f6.msp

c:\windows\Installer\1f160c.msi

c:\windows\Installer\20aa4ea.msp

c:\windows\Installer\20aa501.msp

c:\windows\Installer\20aa518.msp

c:\windows\Installer\20aa52f.msp

c:\windows\Installer\2178885.msp

c:\windows\Installer\2198d3d.msi

c:\windows\Installer\21ca386.msp

c:\windows\Installer\21ca39d.msp

c:\windows\Installer\21ca3b4.msp

c:\windows\Installer\245bb3.msp

c:\windows\Installer\2caf1d3.msp

c:\windows\Installer\2caf1dc.msp

c:\windows\Installer\2caf224.msp

c:\windows\Installer\2caf236.msp

c:\windows\Installer\2caf248.msp

c:\windows\Installer\2caf24f.msp

c:\windows\Installer\2d7589.msi

c:\windows\Installer\35905ec.msi

c:\windows\Installer\35f271f.msp

c:\windows\Installer\3b8f5.msp

c:\windows\Installer\3e653.msi

c:\windows\Installer\40e656.msp

c:\windows\Installer\4a033b.msp

c:\windows\Installer\4a0352.msp

c:\windows\Installer\4a0369.msp

c:\windows\Installer\4a0382.msp

c:\windows\Installer\4a039a.msp

c:\windows\Installer\4a03b2.msp

c:\windows\Installer\4fe1ba.msp

c:\windows\Installer\4fe1d6.msp

c:\windows\Installer\55149.msp

c:\windows\Installer\58ffcdb.msp

c:\windows\Installer\6517c3.msi

c:\windows\Installer\682a86.msp

c:\windows\Installer\6c8209.msi

c:\windows\Installer\6c8565.msi

c:\windows\Installer\7b72c.msi

c:\windows\Installer\7b7c93.msp

c:\windows\Installer\7c0f9a.msi

c:\windows\Installer\7f395f.msi

c:\windows\Installer\7f39a4.msi

c:\windows\Installer\7fa22.msp

c:\windows\Installer\7fa2a.msi

c:\windows\Installer\7fa46.msp

c:\windows\Installer\86e662.msp

c:\windows\Installer\86e67b.msp

c:\windows\Installer\86e692.msp

c:\windows\Installer\86e6a9.msp

c:\windows\Installer\88e02e.msp

c:\windows\Installer\88e045.msp

c:\windows\Installer\b3c7e2.msi

c:\windows\Installer\b62235.msi

c:\windows\Installer\b62236.msp

c:\windows\Installer\b62237.msp

c:\windows\Installer\b62238.msp

c:\windows\Installer\b62239.msp

c:\windows\Installer\b6223a.msp

c:\windows\Installer\b6223b.msp

c:\windows\Installer\b6223c.msp

c:\windows\Installer\b6223d.msp

c:\windows\Installer\b6223e.msp

c:\windows\Installer\b8700.msi

c:\windows\Installer\b8706.msi

c:\windows\Installer\b870c.msi

c:\windows\Installer\b8712.msi

c:\windows\Installer\b8718.msi

c:\windows\Installer\b871e.msi

c:\windows\Installer\b8724.msi

c:\windows\Installer\b872a.msi

c:\windows\Installer\b8730.msi

c:\windows\Installer\b8736.msi

c:\windows\Installer\b873c.msi

c:\windows\Installer\b8742.msi

c:\windows\Installer\b8748.msi

c:\windows\Installer\bb6048.msp

c:\windows\Installer\bc9c7b.msi

c:\windows\Installer\bc9c7c.msp

c:\windows\Installer\bc9c7d.msp

c:\windows\Installer\bc9c7e.msp

c:\windows\Installer\bc9c7f.msp

c:\windows\Installer\bc9c80.msp

c:\windows\Installer\bc9c81.msp

c:\windows\Installer\bc9c82.msp

c:\windows\Installer\bc9c83.msp

c:\windows\Installer\bc9c84.msp

c:\windows\Installer\bc9c85.msp

c:\windows\Installer\be11bc.msi

c:\windows\Installer\be11c2.msi

c:\windows\Installer\be11c8.msi

c:\windows\Installer\be11ce.msi

c:\windows\Installer\be11fe.msi

c:\windows\Installer\be1204.msi

c:\windows\Installer\be120b.msp

c:\windows\Installer\be1211.msi

c:\windows\Installer\be1217.msi

c:\windows\Installer\d7323.msi

c:\windows\Installer\f7e6da9.msp

c:\windows\Installer\f7e6dc0.msp

c:\windows\Installer\f7e6dd8.msp

c:\windows\Installer\f7e6def.msp

c:\windows\Installer\f7e6e06.msp

c:\windows\Installer\fc8299.msp

c:\windows\Installer\fc82b0.msp

c:\windows\Installer\fc82c6.msp

c:\windows\ohut.bin

c:\windows\omiquzugo.reg

c:\windows\oroloxubyc._dl

c:\windows\system32\404Fix.exe

c:\windows\system32\Agent.OMZ.Fix.exe

c:\windows\system32\bosyc.scr

c:\windows\system32\Cache

c:\windows\system32\drivers\etc\lmhosts

c:\windows\system32\Drivers\ltuqxxi.sys

c:\windows\system32\drivers\npf.sys

c:\windows\system32\dumphive.exe

c:\windows\system32\IEDFix.C.exe

c:\windows\system32\IEDFix.exe

c:\windows\system32\o4Patch.exe

c:\windows\system32\Packet.dll

c:\windows\system32\Process.exe

c:\windows\system32\pthreadVC.dll

c:\windows\system32\spdwnwxp.exe

c:\windows\system32\SrchSTS.exe

c:\windows\system32\VACFix.exe

c:\windows\system32\VCCLSID.exe

c:\windows\system32\WanPacket.dll

c:\windows\system32\wpcap.dll

c:\windows\system32\WS2Fix.exe

d:\documents and settings\All Users\Documents\isewevaxob.scr

d:\documents and settings\All Users\Documents\mafyc.reg

d:\documents and settings\All Users\Documents\oruxopylu.vbs

d:\documents and settings\Oliver\Application Data\ejomuje.pif

d:\documents and settings\Oliver\Application Data\emocycu.pif

d:\documents and settings\Oliver\Application Data\facynuben.dll

d:\documents and settings\Oliver\Application Data\igaku.inf

d:\documents and settings\Oliver\Local Settings\Application Data\uzixifeqac.scr

.

((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))

.

2009-08-28 05:30 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-28 05:30 . 2009-08-28 05:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-28 05:30 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-28 04:44 . 2008-09-04 17:15 1106944 ------w- c:\windows\system32\dllcache\msxml3.dll

2009-08-28 04:43 . 2009-05-21 18:46 268288 ------w- c:\windows\system32\dllcache\httpext.dll

2009-08-28 04:40 . 2009-02-09 12:10 729088 ------w- c:\windows\system32\dllcache\lsasrv.dll

2009-08-28 04:40 . 2009-02-06 11:06 2145280 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe

2009-08-28 04:40 . 2009-02-06 11:08 2189056 ------w- c:\windows\system32\dllcache\ntoskrnl.exe

2009-08-28 04:40 . 2009-02-06 10:32 2023936 ------w- c:\windows\system32\dllcache\ntkrpamp.exe

2009-08-28 04:36 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys

2009-08-28 04:36 . 2008-10-24 11:21 455296 ------w- c:\windows\system32\dllcache\mrxsmb.sys

2009-08-28 04:36 . 2008-12-11 10:57 333952 ------w- c:\windows\system32\dllcache\srv.sys

2009-08-28 04:36 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll

2009-08-28 04:36 . 2008-04-11 19:04 691712 ------w- c:\windows\system32\dllcache\inetcomm.dll

2009-08-28 04:31 . 2008-10-15 16:34 337408 ------w- c:\windows\system32\dllcache\netapi32.dll

2009-08-27 22:02 . 2009-08-17 16:04 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2009-08-27 22:02 . 2009-08-17 16:04 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2009-08-27 22:02 . 2009-08-17 16:03 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2009-08-27 22:02 . 2009-08-17 16:06 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys

2009-08-27 22:02 . 2009-08-17 16:06 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2009-08-27 22:02 . 2009-08-17 16:05 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2009-08-27 22:02 . 2009-08-17 16:05 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2009-08-27 22:02 . 2009-08-17 16:02 97480 ----a-w- c:\windows\system32\AvastSS.scr

2009-08-27 22:02 . 2009-08-17 16:10 1279456 ----a-w- c:\windows\system32\aswBoot.exe

2009-08-27 22:02 . 2009-08-27 22:02 -------- d-----w- c:\program files\Alwil Software

2009-08-27 04:28 . 2009-08-27 04:28 -------- d-----w- d:\documents and settings\All Users\Application Data\NOS

2009-08-27 02:51 . 2009-08-27 02:51 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)

2009-08-27 02:51 . 2009-08-27 02:51 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)

2009-08-26 21:41 . 2009-08-26 21:41 11966 ----a-w- c:\windows\system32\syjydaluga.dat

2009-08-26 21:38 . 2009-08-26 21:38 -------- d-----w- C:\PC_Antispyware2010

2009-08-26 21:23 . 2009-08-26 21:23 12208 ----a-w- c:\windows\system32\cozitopu.dat

2009-08-26 01:42 . 2009-08-26 01:42 -------- d-----w- c:\program files\Trend Micro

2009-08-26 00:07 . 2009-08-26 00:07 -------- d-----w- c:\program files\CCleaner

2009-08-06 03:14 . 2009-08-06 03:55 -------- d-----w- c:\program files\Pod to PC

2009-08-06 02:11 . 2009-08-06 02:11 -------- d-----w- d:\documents and settings\All Users\Application Data\TEMP

2009-08-05 09:01 . 2009-08-05 09:01 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll

2009-07-31 07:24 . 2009-07-31 07:24 -------- d-----w- c:\program files\Last.fm

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-30 05:54 . 2006-10-02 19:19 5427 ----a-w- c:\windows\system32\EGATHDRV.SYS

2009-08-30 05:54 . 2007-03-14 13:57 17408 ----a-w- c:\windows\system32\rpcnetp.exe

2009-08-30 00:33 . 2007-03-14 14:15 56680 ----a-w- c:\windows\system32\rpcnet.dll

2009-08-30 00:19 . 2007-08-12 17:23 -------- d-----w- c:\program files\iTunes

2009-08-30 00:19 . 2008-04-08 05:14 -------- d-----w- c:\program files\iPod

2009-08-30 00:17 . 2007-08-12 17:22 -------- d-----w- c:\program files\QuickTime

2009-08-30 00:00 . 2007-08-12 17:21 -------- d-----w- c:\program files\Apple Software Update

2009-08-29 10:52 . 2007-03-14 13:57 17408 ----a-w- c:\windows\system32\rpcnetp.dll

2009-08-28 16:13 . 2006-09-06 19:38 -------- d-----w- c:\program files\Common Files\Symantec Shared

2009-08-28 16:13 . 2006-09-06 19:38 -------- d-----w- c:\program files\Symantec

2009-08-28 04:38 . 2009-08-28 04:38 0 ----atw- c:\windows\006320_.tmp

2009-08-28 04:21 . 2007-03-14 14:15 56680 ----a-w- c:\windows\system32\rpcnet.exe

2009-08-28 03:56 . 2007-04-25 16:27 -------- d-----w- c:\documents and settings\Administrator\Application Data\Lenovo

2009-08-28 03:54 . 2007-05-23 20:31 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\vlc

2009-08-28 03:54 . 2007-05-23 20:31 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Thunderbird

2009-08-28 03:54 . 2007-05-23 20:31 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\OfficeUpdate12

2009-08-28 03:50 . 2007-10-18 15:54 -------- d-----w- c:\program files\Windows Media Connect 2

2009-08-28 03:50 . 2007-05-15 21:27 -------- d-----w- c:\program files\Windows Journal Viewer

2009-08-28 03:50 . 2007-03-14 15:24 -------- d-----w- c:\program files\ThinkVantage Fingerprint Software

2009-08-28 03:50 . 2006-10-02 19:14 -------- d-----w- c:\program files\TVT SMBus

2009-08-28 03:49 . 2006-10-02 19:15 -------- d-----w- c:\program files\SMI2

2009-08-28 03:49 . 2006-09-06 19:36 -------- d-----w- c:\program files\PCDR5

2009-08-28 03:49 . 2007-04-25 21:00 -------- d-----w- c:\program files\Opera

2009-08-28 03:49 . 2007-05-22 19:05 -------- d-----w- c:\program files\NetWaiting

2009-08-28 03:49 . 2007-04-26 15:57 -------- d-----w- c:\program files\Mozilla Thunderbird

2009-08-28 03:49 . 2007-04-25 20:57 -------- d-----w- c:\program files\Minitab 15

2009-08-28 03:49 . 2007-04-26 14:33 -------- d-----w- c:\program files\Microsoft Works

2009-08-28 03:47 . 2007-08-27 11:11 -------- d-----w- c:\program files\Microsoft LifeCam

2009-08-28 03:47 . 2006-09-06 19:23 -------- d-----w- c:\program files\Lenovo

2009-08-28 03:47 . 2007-04-25 20:55 -------- d-----w- c:\program files\IZArc

2009-08-28 03:46 . 2006-09-06 19:37 -------- d-----w- c:\program files\IBM ThinkVantage

2009-08-28 03:46 . 2007-04-26 20:34 -------- d-----w- c:\program files\HTML Help Workshop

2009-08-28 03:46 . 2007-04-25 20:55 -------- d-----w- c:\program files\gs

2009-08-28 03:46 . 2007-09-05 05:02 -------- d-----w- c:\program files\ftsInstaller

2009-08-28 03:46 . 2007-04-25 20:54 -------- d-----w- c:\program files\GraphCalc

2009-08-28 03:46 . 2007-04-25 20:44 -------- d-----w- c:\program files\DoroPDFWriter

2009-08-28 03:46 . 2007-04-25 20:43 -------- d-----w- c:\program files\DivX

2009-08-28 03:46 . 2007-05-22 19:06 -------- d-----w- c:\program files\Digital Line Detect

2009-08-28 03:46 . 2007-03-14 15:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-08-28 03:46 . 2007-05-22 19:09 -------- d-----w- c:\program files\Common Files\SureThing Shared

2009-08-28 03:46 . 2006-09-06 19:35 -------- d-----w- c:\program files\Common Files\Sonic Shared

2009-08-28 03:45 . 2007-04-25 20:42 -------- d-----w- c:\program files\Cobian Backup 8

2009-08-28 03:40 . 2007-04-26 15:57 -------- d-----w- c:\documents and settings\Administrator\Application Data\Thunderbird

2009-08-28 03:40 . 2007-04-26 15:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\OfficeUpdate12

2009-08-28 03:39 . 2008-04-09 13:06 -------- d-----w- c:\program files\WinDirStat

2009-08-27 13:50 . 2007-04-26 15:51 90352 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-24 07:34 . 2009-08-24 07:34 1060 ----a-w- c:\program files\zxlfrqct.txt

2009-08-05 09:01 . 1980-01-01 07:00 204800 ------w- c:\windows\system32\mswebdvd.dll

2009-08-01 03:12 . 2008-10-25 21:39 -------- d-----w- c:\program files\Microsoft Silverlight

2009-07-31 06:25 . 2009-07-31 06:25 -------- d-----w- d:\documents and settings\All Users\Application Data\Last.fm

2009-07-29 04:37 . 1980-01-01 07:00 81920 ------w- c:\windows\system32\fontsub.dll

2009-07-29 04:37 . 1980-01-01 07:00 119808 ------w- c:\windows\system32\t2embed.dll

2009-07-17 19:01 . 1980-01-01 07:00 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-16 04:02 . 2009-06-22 02:23 0 ----a-w- c:\windows\system32\drivers\cbcxvporviwuymbp.sys

2009-07-14 03:43 . 1980-01-01 07:00 286208 ------w- c:\windows\system32\wmpdxm.dll

2009-06-29 16:12 . 1980-01-01 07:00 827392 ----a-w- c:\windows\system32\wininet.dll

2009-06-29 16:12 . 1980-01-01 07:00 78336 ------w- c:\windows\system32\ieencode.dll

2009-06-29 16:12 . 1980-01-01 07:00 17408 ------w- c:\windows\system32\corpol.dll

2009-06-12 12:31 . 1980-01-01 07:00 80896 ------w- c:\windows\system32\tlntsess.exe

2009-06-12 12:31 . 1980-01-01 07:00 76288 ------w- c:\windows\system32\telnet.exe

2009-06-10 14:13 . 1980-01-01 07:00 84992 ------w- c:\windows\system32\avifil32.dll

2009-06-10 13:19 . 2004-08-09 17:51 2066432 ------w- c:\windows\system32\mstscax.dll

2009-06-10 06:14 . 1980-01-01 07:00 132096 ------w- c:\windows\system32\wkssvc.dll

2009-06-03 19:09 . 1980-01-01 07:00 1291264 ------w- c:\windows\system32\quartz.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]

"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-03 856064]

"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-11-29 243248]

"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-10-02 94208]

"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2007-02-02 120368]

"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-12-20 159744]

"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-12-20 208896]

"TPKBDLED"="c:\windows\system32\TpScrLk.exe" [2002-10-09 40960]

"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2006-07-14 2341632]

"PDService.exe"="c:\program files\Lenovo\SafeGuard PrivateDisk\pdservice.exe" [2006-03-13 41472]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]

"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2007-11-19 487424]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]

"VX1000"="c:\windows\vVX1000.exe" [2006-12-05 707360]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2007-03-29 181808]

"TP4EX"="tp4ex.exe" - c:\windows\system32\TP4EX.exe [2005-10-17 65536]

"Tweak UI"="TWEAKUI.CPL" - c:\windows\system32\TWEAKUI.CPL [2005-05-02 106544]

c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2008-1-11 39792]

Adobe Reader Speed Launch.lnk.disabled [2007-4-25 1757]

Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-5-11 738968]

Adobe Reader Synchronizer.lnk.disabled [2007-4-25 1799]

Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2006-8-18 561213]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-5-22 50688]

Digital Line Detect.lnk.disabled [2006-9-6 493]

Leash Ticket Manager.lnk - c:\program files\MIT\Kerberos\bin\leash32.exe [2004-9-17 770048]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2006-8-18 561213]

Leash Ticket Manager.lnk - c:\program files\MIT\Kerberos\bin\leash32.exe [2004-9-17 770048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]

2006-06-19 06:06 49152 ------w- c:\program files\Lenovo\AwayTask\AwayNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]

2007-03-08 22:08 89600 ------w- c:\windows\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]

2005-07-06 04:45 28672 ------w- c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]

2005-12-01 03:16 24576 ------w- c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli psqlpwd

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk

backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk

backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^jb92^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=d:\documents and settings\jb92\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^jb92^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]

path=d:\documents and settings\jb92\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

backup=c:\windows\pss\Adobe Reader Synchronizer.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^jb92^Start Menu^Programs^Startup^Digital Line Detect.lnk]

path=d:\documents and settings\jb92\Start Menu\Programs\Startup\Digital Line Detect.lnk

backup=c:\windows\pss\Digital Line Detect.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Oliver^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=d:\documents and settings\Oliver\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Oliver^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk.disabled]

path=d:\documents and settings\Oliver\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk.disabled

backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.disabledStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Oliver^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]

path=d:\documents and settings\Oliver\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

backup=c:\windows\pss\Adobe Reader Synchronizer.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Oliver^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk.disabled]

path=d:\documents and settings\Oliver\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk.disabled

backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.disabledStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Oliver^Start Menu^Programs^Startup^Digital Line Detect.lnk]

path=d:\documents and settings\Oliver\Start Menu\Programs\Startup\Digital Line Detect.lnk

backup=c:\windows\pss\Digital Line Detect.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Oliver^Start Menu^Programs^Startup^Digital Line Detect.lnk.disabled]

path=d:\documents and settings\Oliver\Start Menu\Programs\Startup\Digital Line Detect.lnk.disabled

backup=c:\windows\pss\Digital Line Detect.lnk.disabledStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Oliver^Start Menu^Programs^Startup^Leash Ticket Manager.lnk]

path=d:\documents and settings\Oliver\Start Menu\Programs\Startup\Leash Ticket Manager.lnk

backup=c:\windows\pss\Leash Ticket Manager.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Oliver^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=d:\documents and settings\Oliver\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

"TVT Scheduler Proxy"=c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [3/2/2007 5:49 PM 100656]

R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [3/2/2007 5:47 PM 19760]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [8/27/2009 6:02 PM 114768]

R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [9/6/2006 3:48 PM 4442]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/27/2009 6:02 PM 20560]

R2 PrivateDisk;PrivateDisk;c:\program files\Lenovo\SafeGuard PrivateDisk\privatediskm.sys [3/13/2006 4:05 PM 58368]

R2 smi2;smi2;c:\program files\SMI2\smi2.sys [7/14/2006 3:55 PM 3968]

R2 smihlp;SMI Helper Driver (smihlp);c:\program files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [3/8/2007 6:01 PM 11152]

S2 smihlp2;SMI Helper Driver (smihlp2);c:\program files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [3/8/2007 6:01 PM 11152]

.

Contents of the 'Scheduled Tasks' folder

2009-08-30 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-08-30 c:\windows\Tasks\PMTask.job

- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-09-06 05:14]

2009-08-30 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-04-02 02:18]

.

- - - - ORPHANS REMOVED - - - -

Notify-NavLogon - (no file)

.

------- Supplementary Scan -------

.

uStart Page = hxxp://business.tepper.cmu.edu/

uInternet Settings,ProxyOverride = *.local

IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm

IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html

FF - ProfilePath - d:\documents and settings\Oliver\Application Data\Mozilla\Firefox\Profiles\8i5kb7gp.default\

FF - prefs.js: browser.startup.homepage - hxxp://online.wsj.com/home/us?refresh=on

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-30 03:12

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet013\Services\MySQL]

"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1496)

c:\windows\system32\vrlogon.dll

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\psqlpwd.dll

c:\program files\ThinkVantage Fingerprint Software\homefus2.dll

c:\program files\ThinkVantage Fingerprint Software\infra.dll

c:\program files\ThinkVantage Fingerprint Software\homepass.dll

c:\program files\ThinkVantage Fingerprint Software\bio.dll

c:\program files\ThinkVantage Fingerprint Software\ps2css.dll

c:\program files\ThinkVantage Fingerprint Software\remote.dll

c:\windows\system32\tphklock.dll

c:\program files\ThinkVantage Fingerprint Software\pscssint.dll

c:\program files\ThinkVantage Fingerprint Software\crypto.dll

c:\program files\Lenovo\AwayTask\AwayNotify.dll

c:\windows\system32\notifyf2.dll

- - - - - - - > 'lsass.exe'(1552)

c:\windows\system32\psqlpwd.dll

c:\program files\ThinkVantage Fingerprint Software\homefus2.dll

c:\program files\ThinkVantage Fingerprint Software\infra.dll

.

Completion time: 2009-08-30 3:17

ComboFix-quarantined-files.txt 2009-08-30 07:16

Pre-Run: 6,986,080,256 bytes free

Post-Run: 7,185,543,168 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

537 --- E O F --- 2009-08-29 23:38

August 30, 2009

I finally successfully uninstalled Systemantec, installed Avast and ran a thorough scan. Detected and quarantined a number of viruses/trojans/rootkits. Rebooted my computer and ran my hijack this. My computer seems much better, but is it free of all malware and viruses?

Hijack this log:

-------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:42:56 PM, on 8/29/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\IPSSVC.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\rpcnet.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

C:\WINDOWS\System32\TPHDEXLG.exe

C:\WINDOWS\system32\TpKmpSVC.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

C:\Program Files\Lenovo\Rescue and Recovery\adm\IUService.exe

c:\program files\lenovo\system update\suservice.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrcmd.exe

C:\Program Files\Lenovo\Rescue and Recovery\Migration\bin\r2r.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\cmd.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\TpShocks.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe

C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe

C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe

C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe

C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\TpScrLk.exe

C:\Program Files\Lenovo\Client Security Solution\cssauth.exe

C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\WINDOWS\vVX1000.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

C:\Program Files\MIT\Kerberos\bin\leash32.exe

C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe

C:\Program Files\MIT\Kerberos\bin\krbcc32s.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe