fxp

Hi Chris, Done and thanks for all your help. - Frank

Hi Chris, I'm back the fan failed on the pc and have been running around to find a replacement. I just got back on the pc and ran the two programs you requested. The first report found Win32/Bagle.gen.zip worm which I got hit with last year and thought I'd cleared it. I think it is a remnant from the cleanup earlier. The Win32/Adware.MegaSearch.AA I don't know about have not had any problems with adware at all for some time. In any case, glad it was cleaned up. To me it seems that the pc is running better than before; although, I am judging from a horrible recent experience. Let me know if you'd like me to do more or have any suggestions to better protect myself. I want to thank you for all your help, could not have gotten this far without you. Thanks again. - Frank ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=f845280f7a97c54a9013640a61d502d7 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-08-26 04:39:29 # local_time=2010-08-26 12:39:29 (-0500, Eastern Daylight Time) # country="United States" # lang=9 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 48781367 48781367 0 0 # compatibility_mode=768 16777215 100 0 17772451 17772451 0 0 # compatibility_mode=4864 16777215 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=353938 # found=7 # cleaned=7 # scan_time=13116 C:\DL\TrustWatch_IEToolbar.exe probably a variant of Win32/Adware.MegaSearch.AA application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Nurech1.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Nurech3.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\RECYCLER\NPROTECT\00025016.EXE probably a variant of Win32/Adware.MegaSearch.AA application (deleted - quarantined) 00000000000000000000000000000000 C C:\RECYCLER\NPROTECT\00025023.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\RECYCLER\NPROTECT\00025024.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP2568\A0668906.EXE probably a variant of Win32/Adware.MegaSearch.AA application (deleted - quarantined) 00000000000000000000000000000000C Results of screen317's Security Check version 0.99.5 Windows XP Service Pack 3 Internet Explorer 8 `````````````````````````````` Antivirus/Firewall Check: Windows Firewall Enabled! avast! Free Antivirus ESET Online Scanner v3 Antivirus up to date! ``````````````````````````````` Anti-malware/Other Utilities Check: Malwarebytes' Anti-Malware HijackThis 2.0.2 Excel VBA Code Cleaner 5.0 Java 6 Update 17 Java SE Runtime Environment 6 Update 1 Java 6 Update 2 Java 6 Update 3 Java 6 Update 5 Java 6 Update 7 Java 2 Runtime Environment, SE v1.4.2_03 Out of date Java installed! Adobe Flash Player 10.1.53.64 Mozilla Firefox (3.6.8) ```````````````````````````````` Process Check: objlist.exe by Laurent Norton ccSvcHst.exe Alwil Software Avast5 AvastSvc.exe ```````````````````````````````` DNS Vulnerability Check: GREAT! (Not vulnerable to DNS cache poisoning) ``````````End of Log````````````

Hi Chris, Thanks for all the help. I am posting the MBAM log, Combofix.txt and DDS log. - Frank Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4432 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 8/15/2010 11:38:03 AM mbam-log-2010-08-15 (11-38-03).txt Scan type: Quick scan Objects scanned: 190427 Time elapsed: 2 hour(s), 31 minute(s), 11 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ComboFix 10-08-14.06 - Frank 08/15/2010 13:55:54.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.132 [GMT -4:00] Running from: c:\documents and settings\Frank\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Frank\Desktop\SysDiags\Virus Reports\CFScript.txt AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ASWFSBLK -------\Legacy_ASWSP -------\Legacy_PQIMOUNT -------\Service_aswFsBlk -------\Service_aswSP -------\Service_onfb -------\Service_PQIMount ((((((((((((((((((((((((( Files Created from 2010-07-15 to 2010-08-15 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-15 18:57 . 2005-07-31 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\HDD Thermometer 2010-08-14 00:20 . 2003-01-05 15:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-08-10 01:22 . 2005-04-30 14:50 -------- d-----w- c:\documents and settings\Frank\Application Data\KeePass 2010-08-04 21:29 . 2004-01-05 20:02 -------- d-----w- c:\program files\Norton SystemWorks 2010-07-23 15:16 . 2004-05-28 23:50 -------- d-----w- c:\program files\Active Ports 2010-06-30 13:34 . 2007-10-25 23:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-06-30 12:31 . 2002-08-29 11:00 149504 ----a-w- c:\windows\system32\schannel.dll 2010-06-28 20:57 . 2010-07-14 14:45 38848 ----a-w- c:\windows\avastSS.scr 2010-06-28 20:57 . 2009-01-23 16:19 165032 ----a-w- c:\windows\system32\aswBoot.exe 2010-06-28 20:37 . 2009-01-23 16:20 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2010-06-28 20:37 . 2009-01-23 16:20 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys 2010-06-28 20:33 . 2009-01-23 16:20 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2010-06-28 20:32 . 2009-01-23 16:20 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2010-06-28 20:32 . 2009-01-23 16:20 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys 2010-06-28 20:32 . 2009-01-23 16:20 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2010-06-28 20:32 . 2009-01-23 16:20 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2010-06-24 12:22 . 2004-02-06 22:05 916480 ----a-w- c:\windows\system32\wininet.dll 2010-06-23 16:28 . 2010-06-23 16:28 -------- d-----w- c:\program files\LSoft Technologies Inc 2010-06-23 16:28 . 2002-12-12 00:00 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-06-23 13:44 . 2002-08-29 11:00 1851904 ----a-w- c:\windows\system32\win32k.sys 2010-06-21 15:27 . 2002-08-29 11:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys 2010-06-17 14:03 . 2002-08-29 11:00 80384 ------w- c:\windows\system32\iccvid.dll 2010-06-16 20:01 . 2008-05-10 23:03 -------- d-----w- c:\program files\Debugging Tools for Windows (x86) 2010-06-14 07:41 . 2002-08-29 11:00 1172480 ----a-w- c:\windows\system32\msxml3.dll 2001-10-05 16:53 . 2003-03-08 19:32 21866 ------w- c:\program files\Common Files\tppupd2k.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RSD_HDDThermo"="c:\program files\HDD Thermometer\HDD Thermometer.exe" [2005-04-01 215040] "Google Update"="c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-12 133104] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-23 68856] "IE Privacy Keeper"="c:\program files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe" [2005-12-03 1015808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-15 28672] "USB SECURITY DEVICE CoInstaller"="JupitCo.exe" [2002-04-22 28672] "TPP Auto Loader"="c:\windows\TPPALDR.EXE" [2001-10-05 118784] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896] "WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-05-04 161328] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048] "SiteAdvisor"="c:\program files\SiteAdvisor\6253\SiteAdv.exe" [2007-12-04 36640] "VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2007-11-16 2065648] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816] "CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-04 1057328] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-10-06 5058560] "nwiz"="nwiz.exe" [2003-10-06 741376] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2003-10-06 49152] c:\documents and settings\Frank\Start Menu\Programs\Startup\ SysInt Process Explorer.lnk - c:\program files\SysInternals\ProcessExplorer\procexp.exe [2004-11-15 3623736] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Color Calibration.lnk - c:\program files\SEC\MagicTune 2.5\GammaTray.exe [2005-1-12 36864] Microsoft Office.lnk - c:\program files\Microsoft Office XP\Office10\OSA.EXE [2001-2-13 83360] TurboNote.lnk - c:\program files\TurboNote\tbnote.exe [2003-1-4 199168] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1] Source= c:\documents and settings\Frank\My Documents\My Web Sites\LocalDesktop\local_desktop.htm FriendlyName= [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc] @="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 "ctfmon.exe"=c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "<NO NAME>"= "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\FRONTPG.EXE"= "c:\\Program Files\\Microsoft Visual Studio .NET 2003\\Common7\\IDE\\devenv.exe"= "c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"= "c:\\Program Files\\Altova\\XMLSPY2004\\XMLSpy.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\FTP Explorer\\ftpx.exe"= "c:\\Program Files\\Java\\j2re1.4.2_03\\bin\\javaw.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"= "c:\\Program Files\\Microsoft Office 2007\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\PhraseExpress\\phraseexpress.exe"= "c:\\Program Files\\Pervasive Software\\PSQL\\bin\\w3dbsmgr.exe"= "c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "1583:TCP"= 1583:TCP:Pervasive DBEngine "3351:TCP"= 3351:TCP:Pervasive DBEngine R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [1/27/2009 3:33 PM 64160] R0 PQV2i;PQV2i;c:\windows\SYSTEM32\DRIVERS\PQV2i.sys [11/10/2004 10:30 AM 138801] R1 SBRE;SBRE;c:\windows\SYSTEM32\DRIVERS\SBREDrv.sys [12/18/2009 1:51 PM 93872] R2 BCMNTIO;BCMNTIO;c:\progra~1\CheckIt\DIAGNO~1\BCMNTIO.sys [7/26/2005 8:07 PM 3744] R2 MAPMEM;MAPMEM;c:\progra~1\CheckIt\DIAGNO~1\MAPMEM.sys [7/26/2005 8:07 PM 3904] R2 VPCAppSv;Virtual PC Application Services;c:\windows\SYSTEM32\DRIVERS\VPCAppSv.sys [5/20/2002 9:31 PM 10374] S3 bcgame;Nostromo HID Device Minidriver;c:\windows\system32\drivers\bcgame.sys --> c:\windows\system32\drivers\bcgame.sys [?] S3 DCamUSBBVI;SiPix StyleCam RAVE/SNAP Dual Mode Camera;c:\windows\SYSTEM32\DRIVERS\biomini.sys [12/22/2002 1:29 PM 397184] S3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\SYSTEM32\DRIVERS\tpp300.sys [3/8/2003 3:32 PM 33669] S3 Usblink;Usblink Driver;c:\windows\SYSTEM32\DRIVERS\ulink.sys [1/22/2004 7:19 PM 40060] --- Other Services/Drivers In Memory --- *Deregistered* - PROCEXP100 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2007-04-19 17:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder 2010-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 00:20] 2010-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 00:20] 2010-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2187484283-3964311654-1397676033-1005Core.job - c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-12 14:55] 2010-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2187484283-3964311654-1397676033-1005UA.job - c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-12 14:55] 2009-12-28 c:\windows\Tasks\PandaUSBVaccine.job - c:\program files\Panda USB Vaccine\RunInteractiveWin.exe [2009-12-28 21:45] 2009-06-07 c:\windows\Tasks\RegistryBackup.job - c:\windows\system32\ntbackup.exe [2002-08-29 00:12] 2009-01-25 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job - c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2010-01-07 20:31] 2010-08-15 c:\windows\Tasks\User_Feed_Synchronization-{ABAB6777-B3C7-440A-BEC7-38C62D5C8307}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 08:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: E&xport to Microsoft Excel - c:\progra~1\MI69DF~1\Office12\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html IE: Edit with X&ML Spy - c:\program files\Altova\XMLSPY2004\spy.htm IE: {{D8DEE6AE-1AE4-11D4-9996-00B0D0278826} - {0432FC96-1AF4-11D4-9996-00B0D0278826} - c:\windows\system32\Shdocvw.dll Trusted Zone: intuit.com\ttlc Trusted Zone: turbotax.com DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} - hxxp://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab DPF: {BCD5A227-8720-497B-AF5F-4403E94342E3} - hxxps://netservices.verizon.net/portal/verizon/passwdchg/activex/DSLControl.cab DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} - hxxp://scpwbe.ops.placeware.com/etc/place/RCC-BETA/pws-pw-03/5.1.0.104/lib/quicksilver.cab FF - ProfilePath - FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-08-15 14:55 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-2187484283-3964311654-1397676033-1005\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Pervasive Software\PSQL] @Denied: ) (Everyone) @="" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(5824) c:\windows\system32\WININET.dll c:\windows\system32\nView.dll c:\program files\SiteAdvisor\6253\saHook.dll c:\program files\Logitech\MouseWare\System\LgWndHk.dll c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll c:\windows\system32\nvwddi.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\ftpxext.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Symantec Shared\ccSvcHst.exe c:\program files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe c:\program files\Alwil Software\Avast5\AvastSvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\System32\drivers\CDAC11BA.EXE c:\windows\system32\CTsvcCDA.exe c:\windows\System32\inetsrv\inetinfo.exe c:\program files\Nero\Nero 7\InCD\InCDsrv.exe c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\program files\Microsoft Analysis Services\Bin\msmdsrv.exe c:\program files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe c:\progra~1\NORTON~1\NORTON~1\NPROTECT.EXE c:\windows\system32\nvsvc32.exe c:\program files\Pervasive Software\PSQL\bin\w3dbsmgr.exe c:\progra~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe c:\windows\system32\SearchIndexer.exe c:\windows\system32\fxssvc.exe c:\windows\system32\wscntfy.exe c:\windows\system32\JupitCo.exe c:\program files\Logitech\MouseWare\system\em_exec.exe c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe c:\windows\system32\RUNDLL32.EXE c:\windows\system32\rundll32.exe c:\program files\Microsoft ActiveSync\wcescomm.exe c:\progra~1\MICROS~4\rapimgr.exe . ************************************************************************** . Completion time: 2010-08-15 15:23:49 - machine was rebooted ComboFix-quarantined-files.txt 2010-08-15 19:23 ComboFix2.txt 2010-08-13 16:43 Pre-Run: 23,822,327,808 bytes free Post-Run: 23,716,233,216 bytes free - - End Of File - - BD69F0DD1A75C8B46A7F33217EC8F317 DDS (Ver_10-03-17.01) - NTFSx86 Run by Frank at 15:44:46.42 on Sun 08/15/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.138 [GMT -4:00] AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\System32\inetsrv\inetinfo.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\DSentry.exe C:\WINDOWS\system32\JupitCo.exe C:\WINDOWS\TPPALDR.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\HDD Thermometer\HDD Thermometer.exe C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe C:\PROGRA~1\MICROS~4\rapimgr.exe C:\Program Files\SEC\MagicTune 2.5\GammaTray.exe C:\Program Files\TurboNote\tbnote.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\SysInternals\ProcessExplorer\procexp.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Documents and Settings\Frank\Desktop\SysDiags\dds.scr C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE ============== Pseudo HJT Report =============== uStart Page = hxxp://google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s BHO: {089fd14d-132b-48fc-8861-0048ae113215} - c:\program files\siteadvisor\6261\SiteAdv.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Netcraft Toolbar: {d554d8fc-b36d-4bb4-93db-4a3394d505e3} - c:\program files\netcraft toolbar\nctb.dll TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\6261\SiteAdv.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll EB: Notes: {0432fc96-1af4-11d4-9996-00b0d0278826} - c:\windows\system32\Shdocvw.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe" uRun: [RSD_HDDThermo] c:\program files\hdd thermometer\HDD Thermometer.exe uRun: [Google Update] "c:\documents and settings\frank\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [iE Privacy Keeper] "c:\program files\unh solutions\ie privacy keeper\IEPrivacyKeeper.exe" -startup mRun: [DVDSentry] c:\windows\system32\DSentry.exe mRun: [uSB SECURITY DEVICE CoInstaller] JupitCo.exe mRun: [TPP Auto Loader] c:\windows\TPPALDR.EXE mRun: [Logitech Utility] Logi_MwX.Exe mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe mRun: [symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [siteAdvisor] c:\program files\siteadvisor\6253\SiteAdv.exe mRun: [VerizonServicepoint.exe] "c:\program files\verizon\vsp\VerizonServicepoint.exe" /AUTORUN mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [CTCheck] c:\program files\creative\creative zen\zen media explorer\CTCheck.exe mRun: [inCD] c:\program files\nero\nero 7\incd\InCD.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit StartupFolder: c:\docume~1\frank\startm~1\programs\startup\sysint~1.lnk - c:\program files\sysinternals\processexplorer\procexp.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\colorc~1.lnk - c:\program files\sec\magictune 2.5\GammaTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office xp\office10\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\turbon~1.lnk - c:\program files\turbonote\tbnote.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe IE: E&xport to Microsoft Excel - c:\progra~1\mi69df~1\office12\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html IE: Edit with X&ML Spy - c:\program files\altova\xmlspy2004\spy.htm IE: {2222EF56-F49E-4d07-A14E-8D2B08766958} - c:\program files\altova\xmlspy2004\spy.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi69df~1\office12\REFIEBAR.DLL IE: {D8DEE6AE-1AE4-11D4-9996-00B0D0278826} - {0432FC96-1AF4-11D4-9996-00B0D0278826} - c:\windows\system32\Shdocvw.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} Trusted Zone: intuit.com\ttlc Trusted Zone: turbotax.com DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemydsl.verizon.net/sdcCommon/download/DSL/tgctlcm.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab DPF: {4BEE3896-4820-48D1-85EA-5A9A9ECD3D95} - hxxp://office.microsoft.com/productupdates/content/opuc/opuc.cab DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126651071953 DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} - hxxp://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www3.ca.com/securityadvisor/virusinfo/webscan.cab DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} - hxxps://www.microsoft.com/resources/virtuallabs/ActiveX/VMRCActiveXClient.cab DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxp://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab DPF: {83229950-AD1D-4B94-8304-F56E95AFACF7} - hxxp://technet.msft.demoservers.com/SupportFiles/Client/srdp.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - hxxp://toolbar.google.com/data/GoogleActivate.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.2954513889 DPF: {A80D199B-CFDD-4DA4-8C47-2310D5B8DD97} - hxxps://accounting.quickbooks.com/v7.576/qboax5.cab DPF: {BCD5A227-8720-497B-AF5F-4403E94342E3} - hxxps://netservices.verizon.net/portal/verizon/passwdchg/activex/DSLControl.cab DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} - hxxp://scpwbe.ops.placeware.com/etc/place/RCC-BETA/pws-pw-03/5.1.0.104/lib/quicksilver.cab DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - hxxp://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} - hxxp://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} - hxxp://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15112/CTPID.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\6261\SiteAdv.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\frank\applic~1\mozilla\firefox\profiles\tcl00tj5.alt user\ FF - prefs.js: browser.search.selectedEngine - Dictionary FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk FF - component: c:\documents and settings\frank\application data\mozilla\firefox\profiles\tcl00tj5.alt user\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll FF - component: c:\program files\siteadvisor\6261\ff\components\FFHook.dll FF - plugin: c:\documents and settings\frank\application data\mozilla\firefox\profiles\tcl00tj5.alt user\extensions\devicedetection@logitech.com\plugins\npLogitechDeviceDetection.dll FF - plugin: c:\documents and settings\frank\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\program files\google\google updater\1.0.377.3622\npCIDetect.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ ---- FIREFOX POLICIES ---- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-1-27 64160] R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2004-11-10 138801] R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009-12-18 93872] R2 Active@ Disk Monitor;Active@ Disk Monitor;c:\program files\lsoft technologies inc\active@ hard disk monitor\DiskMonitorService.exe [2010-6-23 1127944] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-21 40384] R2 BCMNTIO;BCMNTIO;c:\progra~1\checkit\diagno~1\BCMNTIO.sys [2005-7-26 3744] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2006-9-3 108648] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2006-9-3 108648] R2 MAPMEM;MAPMEM;c:\progra~1\checkit\diagno~1\MAPMEM.sys [2005-7-26 3904] R2 NProtectService;Norton Unerase Protection;c:\progra~1\norton~1\norton~1\NPROTECT.EXE [2004-8-31 95328] R2 psqlWGE;Pervasive PSQL Workgroup Engine;c:\program files\pervasive software\psql\bin\w3dbsmgr.exe [2007-9-5 455968] R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2005-1-22 1251720] R2 VPCAppSv;Virtual PC Application Services;c:\windows\system32\drivers\VPCAppSv.sys [2002-5-20 10374] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-21 40384] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-21 40384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-1 135664] S3 bcgame;Nostromo HID Device Minidriver;c:\windows\system32\drivers\bcgame.sys --> c:\windows\system32\drivers\bcgame.sys [?] S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\CCPWDSVC.EXE [2004-8-27 79520] S3 DCamUSBBVI;SiPix StyleCam RAVE/SNAP Dual Mode Camera;c:\windows\system32\drivers\biomini.sys [2002-12-22 397184] S3 MSSQL$SQL;MSSQL$SQL;c:\progra~1\mi6841~1\mssql$~1\binn\sqlservr.exe -ssql --> c:\progra~1\mi6841~1\mssql$~1\binn\sqlservr.exe -sSQL [?] S3 PortReporter;Port Reporter;c:\program files\portreporter\PortReporter.exe [2005-1-1 90183] S3 Radialpoint Security Services;Radialpoint Security Services;c:\windows\system32\dllhost.exe [2002-8-29 5120] S3 SQLAgent$SQL;SQLAgent$SQL;c:\progra~1\mi6841~1\mssql$~1\binn\sqlagent.exe -i sql --> c:\progra~1\mi6841~1\mssql$~1\binn\sqlagent.exe -i SQL [?] S3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\system32\drivers\tpp300.sys [2003-3-8 33669] S3 Usblink;Usblink Driver;c:\windows\system32\drivers\ulink.sys [2004-1-22 40060] =============== Created Last 30 ================ 2010-08-13 23:44:28 599040 ------w- c:\windows\system32\dllcache\msfeeds.dll 2010-08-13 23:44:28 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll 2010-08-13 23:44:28 12800 ------w- c:\windows\system32\dllcache\xpshims.dll 2010-08-13 23:44:27 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll 2010-08-13 23:44:25 1986560 ------w- c:\windows\system32\dllcache\iertutil.dll 2010-08-13 23:44:24 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll 2010-08-13 14:57:48 0 d-sha-r- C:\cmdcons 2010-08-13 14:19:41 77312 ----a-w- c:\windows\MBR.exe 2010-08-13 14:19:40 98816 ----a-w- c:\windows\sed.exe 2010-08-13 14:19:40 256512 ----a-w- c:\windows\PEV.exe 2010-08-13 14:19:40 161792 ----a-w- c:\windows\SWREG.exe 2010-07-27 00:04:14 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll 2010-07-27 00:04:13 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll 2010-07-27 00:04:10 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll 2010-07-27 00:04:09 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe 2010-07-27 00:04:08 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe 2010-07-27 00:03:50 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe 2010-07-27 00:03:49 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys 2010-07-27 00:03:23 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys 2010-07-27 00:03:14 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys 2010-07-27 00:03:13 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys 2010-07-27 00:03:09 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys 2010-07-27 00:03:06 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll 2010-07-27 00:03:06 53760 ----a-w- c:\windows\system32\dllcache\wiamsmud.dll 2010-07-27 00:03:04 41600 ----a-w- c:\windows\system32\dllcache\weitekp9.dll 2010-07-27 00:03:04 31232 ----a-w- c:\windows\system32\dllcache\weitekp9.sys 2010-07-27 00:03:01 701386 ----a-w- c:\windows\system32\dllcache\wdhaalba.sys 2010-07-27 00:01:59 82944 ----a-w- c:\windows\system32\dllcache\tp4mon.exe 2010-07-27 00:00:59 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys 2010-07-26 23:59:59 50432 ----a-w- c:\windows\system32\dllcache\sisv.sys 2010-07-26 23:58:59 166720 ----a-w- c:\windows\system32\dllcache\s3m.sys 2010-07-26 23:57:58 130942 ----a-w- c:\windows\system32\dllcache\ptserlv.sys 2010-07-26 23:56:59 30495 ----a-w- c:\windows\system32\dllcache\pc100nds.sys 2010-07-26 23:55:59 60480 ----a-w- c:\windows\system32\dllcache\neo20xx.dll 2010-07-26 23:54:58 6528 ----a-w- c:\windows\system32\dllcache\miniqic.sys 2010-07-26 23:53:38 18432 ----a-w- c:\windows\system32\dllcache\jupiw.dll 2010-07-26 23:52:59 109085 ----a-w- c:\windows\system32\dllcache\ibmtrp.sys 2010-07-26 23:51:59 7680 ----a-w- c:\windows\system32\dllcache\ftpctrs2.dll 2010-07-26 23:50:57 334208 ----a-w- c:\windows\system32\dllcache\ds1wdm.sys 2010-07-26 23:49:59 42112 ----a-w- c:\windows\system32\dllcache\crtaud.sys 2010-07-26 23:48:59 66082 ----a-w- c:\windows\system32\dllcache\c_1047.nls 2010-07-26 23:47:59 27678 ----a-w- c:\windows\system32\dllcache\ali5261.sys ==================== Find3M ==================== 2010-07-27 06:30:35 8462336 ----a-w- c:\windows\system32\dllcache\shell32.dll 2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll 2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\dllcache\schannel.dll 2010-06-28 20:57:33 38848 ----a-w- c:\windows\avastSS.scr 2010-06-24 21:51:58 11077120 ------w- c:\windows\system32\dllcache\ieframe.dll 2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll 2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\dllcache\wininet.dll 2010-06-24 12:22:02 1210368 ----a-w- c:\windows\system32\dllcache\urlmon.dll 2010-06-24 12:22:01 611840 ----a-w- c:\windows\system32\dllcache\mstime.dll 2010-06-24 12:22:01 5951488 ----a-w- c:\windows\system32\dllcache\mshtml.dll 2010-06-24 12:22:01 206848 ----a-w- c:\windows\system32\dllcache\occache.dll 2010-06-24 12:21:59 25600 ----a-w- c:\windows\system32\dllcache\jsproxy.dll 2010-06-24 12:21:58 184320 ----a-w- c:\windows\system32\dllcache\iepeers.dll 2010-06-24 12:21:55 387584 ----a-w- c:\windows\system32\dllcache\iedkcs32.dll 2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys 2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\dllcache\win32k.sys 2010-06-23 12:08:09 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe 2010-06-21 15:27:11 354304 ----a-w- c:\windows\system32\drivers\srv.sys 2010-06-21 15:27:11 354304 ----a-w- c:\windows\system32\dllcache\srv.sys 2010-06-18 13:36:12 3558912 ----a-w- c:\windows\system32\dllcache\moviemk.exe 2010-06-17 14:03:00 80384 ------w- c:\windows\system32\iccvid.dll 2010-06-14 14:31:20 744448 ----a-w- c:\windows\system32\dllcache\helpsvc.exe 2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll 2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\dllcache\msxml3.dll 2001-10-05 16:53:04 21866 ------w- c:\program files\common files\tppupd2k.dll 2009-12-13 22:24:02 16384 --sha-w- c:\windows\system32\config\systemprofile\application data\earthlink\6.0\pucci@ix.netcom.com\cookies\index.dat 2009-12-13 22:24:02 16384 --sha-w- c:\windows\system32\config\systemprofile\application data\earthlink\6.0\pucci@ix.netcom.com\ietldcache\index.dat 2008-05-21 16:38:39 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052120080522\index.dat ============= FINISH: 15:46:25.70 ===============

Hi Chris, I just ran Combofix and am sending the log report and the DDS report post Combofix, too. I am now going to run Malwarebytes again and see if it completes. Thanks for the help. ComboFix 10-08-12.03 - Frank 08/13/2010 11:08:56.1.1 - x86 Running from: c:\documents and settings\Frank\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Frank\GoToAssistDownloadHelper.exe C:\Documents C:\Microsoft c:\program files\WinPCap c:\program files\WinPCap\daemon_mgm.exe c:\program files\WinPCap\INSTALL.LOG c:\program files\WinPCap\npf_mgm.exe c:\program files\WinPCap\rpcapd.exe c:\program files\WinPCap\Uninstall.exe c:\windows\system32\bszip.dll c:\windows\system32\Cache c:\windows\system32\drivers\npf.sys c:\windows\system32\Packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32\Thumbs.db c:\windows\system32\wpcap.dll c:\windows\winhelp.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_FILEMON -------\Legacy_NM -------\Legacy_NPF -------\Legacy_SECURITY -------\Service_NM -------\Service_NPF -------\Service_SECURITY ((((((((((((((((((((((((( Files Created from 2010-07-13 to 2010-08-13 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-13 16:07 . 2005-07-31 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\HDD Thermometer 2010-08-10 01:22 . 2005-04-30 14:50 -------- d-----w- c:\documents and settings\Frank\Application Data\KeePass 2010-08-04 21:29 . 2004-01-05 20:02 -------- d-----w- c:\program files\Norton SystemWorks 2010-07-23 15:16 . 2004-05-28 23:50 -------- d-----w- c:\program files\Active Ports 2010-07-14 16:23 . 2003-01-05 15:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-06-30 13:34 . 2007-10-25 23:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-06-28 20:57 . 2010-07-14 14:45 38848 ----a-w- c:\windows\avastSS.scr 2010-06-28 20:57 . 2009-01-23 16:19 165032 ----a-w- c:\windows\system32\aswBoot.exe 2010-06-28 20:37 . 2009-01-23 16:20 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2010-06-28 20:37 . 2009-01-23 16:20 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys 2010-06-28 20:33 . 2009-01-23 16:20 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2010-06-28 20:32 . 2009-01-23 16:20 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2010-06-28 20:32 . 2009-01-23 16:20 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys 2010-06-28 20:32 . 2009-01-23 16:20 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2010-06-28 20:32 . 2009-01-23 16:20 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2010-06-23 16:28 . 2010-06-23 16:28 -------- d-----w- c:\program files\LSoft Technologies Inc 2010-06-23 16:28 . 2002-12-12 00:00 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-06-16 20:01 . 2008-05-10 23:03 -------- d-----w- c:\program files\Debugging Tools for Windows (x86) 2010-06-14 16:19 . 2010-06-14 16:19 -------- d-----w- c:\program files\KeePass Password Safe 2 2001-10-05 16:53 . 2003-03-08 19:32 21866 ------w- c:\program files\Common Files\tppupd2k.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RSD_HDDThermo"="c:\program files\HDD Thermometer\HDD Thermometer.exe" [2005-04-01 215040] "Google Update"="c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-12 133104] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-23 68856] "IE Privacy Keeper"="c:\program files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe" [2005-12-03 1015808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-15 28672] "USB SECURITY DEVICE CoInstaller"="JupitCo.exe" [2002-04-22 28672] "TPP Auto Loader"="c:\windows\TPPALDR.EXE" [2001-10-05 118784] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896] "WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-05-04 161328] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048] "SiteAdvisor"="c:\program files\SiteAdvisor\6253\SiteAdv.exe" [2007-12-04 36640] "VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2007-11-16 2065648] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816] "CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312] "avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-04 1057328] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-10-06 5058560] "nwiz"="nwiz.exe" [2003-10-06 741376] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2003-10-06 49152] c:\documents and settings\Frank\Start Menu\Programs\Startup\ SysInt Process Explorer.lnk - c:\program files\SysInternals\ProcessExplorer\procexp.exe [2004-11-15 3623736] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Color Calibration.lnk - c:\program files\SEC\MagicTune 2.5\GammaTray.exe [2005-1-12 36864] Microsoft Office.lnk - c:\program files\Microsoft Office XP\Office10\OSA.EXE [2001-2-13 83360] TurboNote.lnk - c:\program files\TurboNote\tbnote.exe [2003-1-4 199168] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1] Source= c:\documents and settings\Frank\My Documents\My Web Sites\LocalDesktop\local_desktop.htm FriendlyName= [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc] @="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 "ctfmon.exe"=c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "<NO NAME>"= "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\FRONTPG.EXE"= "c:\\Program Files\\Microsoft Visual Studio .NET 2003\\Common7\\IDE\\devenv.exe"= "c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"= "c:\\Program Files\\Altova\\XMLSPY2004\\XMLSpy.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\FTP Explorer\\ftpx.exe"= "c:\\Program Files\\Java\\j2re1.4.2_03\\bin\\javaw.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"= "c:\\Program Files\\Microsoft Office 2007\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\PhraseExpress\\phraseexpress.exe"= "c:\\Program Files\\Pervasive Software\\PSQL\\bin\\w3dbsmgr.exe"= "c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "1583:TCP"= 1583:TCP:Pervasive DBEngine "3351:TCP"= 3351:TCP:Pervasive DBEngine R0 onfb;onfb;c:\windows\System32\drivers\urhy.sys [x] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 135664] R3 bcgame;Nostromo HID Device Minidriver;c:\windows\system32\drivers\bcgame.sys [x] R3 DCamUSBBVI;SiPix StyleCam RAVE/SNAP Dual Mode Camera;c:\windows\system32\Drivers\biomini.sys [2002-08-31 397184] R3 MSSQL$SQL;MSSQL$SQL;c:\progra~1\MI6841~1\MSSQL$~1\binn\sqlservr.exe [2002-12-17 7520337] R3 PortReporter;Port Reporter;c:\program files\PortReporter\portreporter.exe [2004-03-30 90183] R3 Radialpoint Security Services;Radialpoint Security Services;c:\windows\system32\dllhost.exe [2008-04-14 5120] R3 SQLAgent$SQL;SQLAgent$SQL;c:\progra~1\MI6841~1\MSSQL$~1\binn\sqlagent.exe [2002-12-17 311872] R3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\system32\DRIVERS\TPP300.SYS [2001-10-05 33669] R3 Usblink;Usblink Driver;c:\windows\system32\Drivers\ulink.sys [2003-06-02 40060] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-01-27 64160] S0 PQV2i;PQV2i; [x] S1 aswSP;aswSP; [x] S1 PQIMount;PQIMount; [x] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2009-08-05 93872] S2 Active@ Disk Monitor;Active@ Disk Monitor;c:\program files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe [2009-09-02 1127944] S2 aswFsBlk;aswFsBlk; [x] S2 BCMNTIO;BCMNTIO;c:\progra~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2004-03-05 3744] S2 MAPMEM;MAPMEM;c:\progra~1\CheckIt\DIAGNO~1\MAPMEM.sys [2004-03-05 3904] S2 NProtectService;Norton Unerase Protection;c:\progra~1\NORTON~1\NORTON~1\NPROTECT.EXE [2004-08-31 95328] S2 psqlWGE;Pervasive PSQL Workgroup Engine;c:\program files\Pervasive Software\PSQL\bin\w3dbsmgr.exe [2007-09-05 455968] S2 VPCAppSv;Virtual PC Application Services;c:\windows\system32\DRIVERS\VPCAppSv.sys [2002-05-21 10374] --- Other Services/Drivers In Memory --- *Deregistered* - PROCEXP100 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2007-04-19 17:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder 2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 00:20] 2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 00:20] 2010-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2187484283-3964311654-1397676033-1005Core.job - c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-12 14:55] 2010-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2187484283-3964311654-1397676033-1005UA.job - c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-12 14:55] 2009-12-28 c:\windows\Tasks\PandaUSBVaccine.job - c:\program files\Panda USB Vaccine\RunInteractiveWin.exe [2009-12-28 21:45] 2009-06-07 c:\windows\Tasks\RegistryBackup.job - c:\windows\system32\ntbackup.exe [2002-08-29 00:12] 2009-01-25 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job - c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2010-01-07 20:31] 2010-08-13 c:\windows\Tasks\User_Feed_Synchronization-{ABAB6777-B3C7-440A-BEC7-38C62D5C8307}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 08:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: E&xport to Microsoft Excel - c:\progra~1\MI69DF~1\Office12\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html IE: Edit with X&ML Spy - c:\program files\Altova\XMLSPY2004\spy.htm IE: {{D8DEE6AE-1AE4-11D4-9996-00B0D0278826} - {0432FC96-1AF4-11D4-9996-00B0D0278826} - c:\windows\system32\Shdocvw.dll Trusted Zone: intuit.com\ttlc Trusted Zone: turbotax.com DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} - hxxp://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab DPF: {BCD5A227-8720-497B-AF5F-4403E94342E3} - hxxps://netservices.verizon.net/portal/verizon/passwdchg/activex/DSLControl.cab DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} - hxxp://scpwbe.ops.placeware.com/etc/place/RCC-BETA/pws-pw-03/5.1.0.104/lib/quicksilver.cab FF - ProfilePath - FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - ORPHANS REMOVED - - - - AddRemove-WinPcapInst - c:\program files\WinPcap\Uninstall.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-08-13 12:04 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\windows\TEMP\_asw_aisI.tm~a02192 c:\windows\TEMP\_asw_aisI.tm~a02192\onefile 0 bytes scan completed successfully hidden files: 2 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-2187484283-3964311654-1397676033-1005\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Pervasive Software\PSQL] @Denied: ) (Everyone) @="" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(4188) c:\windows\system32\WININET.dll c:\windows\system32\nView.dll c:\program files\Logitech\MouseWare\System\LgWndHk.dll c:\program files\SiteAdvisor\6253\saHook.dll c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll c:\windows\system32\nvwddi.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\ftpxext.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Symantec Shared\ccSvcHst.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe c:\program files\Alwil Software\Avast5\AvastSvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\System32\drivers\CDAC11BA.EXE c:\windows\system32\CTsvcCDA.exe c:\windows\System32\inetsrv\inetinfo.exe c:\program files\Nero\Nero 7\InCD\InCDsrv.exe c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\program files\Microsoft Analysis Services\Bin\msmdsrv.exe c:\program files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe c:\windows\system32\nvsvc32.exe c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe c:\progra~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe c:\windows\system32\SearchIndexer.exe c:\windows\system32\fxssvc.exe c:\windows\system32\JupitCo.exe c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe c:\program files\Logitech\MouseWare\system\em_exec.exe c:\windows\system32\RUNDLL32.EXE c:\windows\system32\rundll32.exe c:\program files\Microsoft ActiveSync\wcescomm.exe c:\progra~1\MICROS~4\rapimgr.exe c:\windows\system32\SearchProtocolHost.exe c:\windows\system32\SearchFilterHost.exe . ************************************************************************** . Completion time: 2010-08-13 12:43:33 - machine was rebooted ComboFix-quarantined-files.txt 2010-08-13 16:43 Pre-Run: 23,963,938,816 bytes free Post-Run: 23,586,652,160 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn - - End Of File - - 4B6890BC03837AF23D9B055C3C7236C6 DDS (Ver_10-03-17.01) - NTFSx86 Run by Frank at 12:55:29.23 on Fri 08/13/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.123 [GMT -4:00] AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\System32\inetsrv\inetinfo.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\System32\DSentry.exe C:\WINDOWS\system32\JupitCo.exe C:\WINDOWS\TPPALDR.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\HDD Thermometer\HDD Thermometer.exe C:\PROGRA~1\MICROS~4\rapimgr.exe C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe C:\Program Files\SEC\MagicTune 2.5\GammaTray.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Program Files\TurboNote\tbnote.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\SysInternals\ProcessExplorer\procexp.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Frank\Desktop\SysDiags\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s BHO: {089fd14d-132b-48fc-8861-0048ae113215} - c:\program files\siteadvisor\6261\SiteAdv.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Netcraft Toolbar: {d554d8fc-b36d-4bb4-93db-4a3394d505e3} - c:\program files\netcraft toolbar\nctb.dll TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\6261\SiteAdv.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll EB: Notes: {0432fc96-1af4-11d4-9996-00b0d0278826} - c:\windows\system32\Shdocvw.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe" uRun: [RSD_HDDThermo] c:\program files\hdd thermometer\HDD Thermometer.exe uRun: [Google Update] "c:\documents and settings\frank\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [iE Privacy Keeper] "c:\program files\unh solutions\ie privacy keeper\IEPrivacyKeeper.exe" -startup mRun: [DVDSentry] c:\windows\system32\DSentry.exe mRun: [uSB SECURITY DEVICE CoInstaller] JupitCo.exe mRun: [TPP Auto Loader] c:\windows\TPPALDR.EXE mRun: [Logitech Utility] Logi_MwX.Exe mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe mRun: [symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [siteAdvisor] c:\program files\siteadvisor\6253\SiteAdv.exe mRun: [VerizonServicepoint.exe] "c:\program files\verizon\vsp\VerizonServicepoint.exe" /AUTORUN mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [CTCheck] c:\program files\creative\creative zen\zen media explorer\CTCheck.exe mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui mRun: [inCD] c:\program files\nero\nero 7\incd\InCD.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit StartupFolder: c:\docume~1\frank\startm~1\programs\startup\sysint~1.lnk - c:\program files\sysinternals\processexplorer\procexp.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\colorc~1.lnk - c:\program files\sec\magictune 2.5\GammaTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office xp\office10\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\turbon~1.lnk - c:\program files\turbonote\tbnote.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe IE: E&xport to Microsoft Excel - c:\progra~1\mi69df~1\office12\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html IE: Edit with X&ML Spy - c:\program files\altova\xmlspy2004\spy.htm IE: {2222EF56-F49E-4d07-A14E-8D2B08766958} - c:\program files\altova\xmlspy2004\spy.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi69df~1\office12\REFIEBAR.DLL IE: {D8DEE6AE-1AE4-11D4-9996-00B0D0278826} - {0432FC96-1AF4-11D4-9996-00B0D0278826} - c:\windows\system32\Shdocvw.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} Trusted Zone: intuit.com\ttlc Trusted Zone: turbotax.com DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemydsl.verizon.net/sdcCommon/download/DSL/tgctlcm.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab DPF: {4BEE3896-4820-48D1-85EA-5A9A9ECD3D95} - hxxp://office.microsoft.com/productupdates/content/opuc/opuc.cab DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126651071953 DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} - hxxp://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www3.ca.com/securityadvisor/virusinfo/webscan.cab DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} - hxxps://www.microsoft.com/resources/virtuallabs/ActiveX/VMRCActiveXClient.cab DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxp://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab DPF: {83229950-AD1D-4B94-8304-F56E95AFACF7} - hxxp://technet.msft.demoservers.com/SupportFiles/Client/srdp.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - hxxp://toolbar.google.com/data/GoogleActivate.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.2954513889 DPF: {A80D199B-CFDD-4DA4-8C47-2310D5B8DD97} - hxxps://accounting.quickbooks.com/v7.576/qboax5.cab DPF: {BCD5A227-8720-497B-AF5F-4403E94342E3} - hxxps://netservices.verizon.net/portal/verizon/passwdchg/activex/DSLControl.cab DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} - hxxp://scpwbe.ops.placeware.com/etc/place/RCC-BETA/pws-pw-03/5.1.0.104/lib/quicksilver.cab DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - hxxp://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} - hxxp://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} - hxxp://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15112/CTPID.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\6261\SiteAdv.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\frank\applic~1\mozilla\firefox\profiles\tcl00tj5.alt user\ FF - prefs.js: browser.search.selectedEngine - Dictionary FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk FF - component: c:\documents and settings\frank\application data\mozilla\firefox\profiles\tcl00tj5.alt user\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll FF - component: c:\program files\siteadvisor\6261\ff\components\FFHook.dll FF - plugin: c:\documents and settings\frank\application data\mozilla\firefox\profiles\tcl00tj5.alt user\extensions\devicedetection@logitech.com\plugins\npLogitechDeviceDetection.dll FF - plugin: c:\documents and settings\frank\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\program files\google\google updater\1.0.377.3622\npCIDetect.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ ---- FIREFOX POLICIES ---- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-1-27 64160] R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2004-11-10 138801] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-1-23 165456] R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [2004-11-10 46800] R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009-12-18 93872] R2 Active@ Disk Monitor;Active@ Disk Monitor;c:\program files\lsoft technologies inc\active@ hard disk monitor\DiskMonitorService.exe [2010-6-23 1127944] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-1-23 17744] R2 BCMNTIO;BCMNTIO;c:\progra~1\checkit\diagno~1\BCMNTIO.sys [2005-7-26 3744] R2 MAPMEM;MAPMEM;c:\progra~1\checkit\diagno~1\MAPMEM.sys [2005-7-26 3904] R2 VPCAppSv;Virtual PC Application Services;c:\windows\system32\drivers\VPCAppSv.sys [2002-5-20 10374] S0 onfb;onfb;c:\windows\system32\drivers\urhy.sys --> c:\windows\system32\drivers\urhy.sys [?] S3 bcgame;Nostromo HID Device Minidriver;c:\windows\system32\drivers\bcgame.sys --> c:\windows\system32\drivers\bcgame.sys [?] S3 DCamUSBBVI;SiPix StyleCam RAVE/SNAP Dual Mode Camera;c:\windows\system32\drivers\biomini.sys [2002-12-22 397184] S3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\system32\drivers\tpp300.sys [2003-3-8 33669] S3 Usblink;Usblink Driver;c:\windows\system32\drivers\ulink.sys [2004-1-22 40060] =============== Created Last 30 ================ 2010-08-13 14:57:48 0 d-sha-r- C:\cmdcons 2010-08-13 14:19:41 77312 ----a-w- c:\windows\MBR.exe 2010-08-13 14:19:40 98816 ----a-w- c:\windows\sed.exe 2010-08-13 14:19:40 256512 ----a-w- c:\windows\PEV.exe 2010-08-13 14:19:40 161792 ----a-w- c:\windows\SWREG.exe 2010-07-27 00:04:14 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll 2010-07-27 00:04:13 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll 2010-07-27 00:04:10 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll 2010-07-27 00:04:09 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe 2010-07-27 00:04:08 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe 2010-07-27 00:03:50 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe 2010-07-27 00:03:49 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys 2010-07-27 00:03:23 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys 2010-07-27 00:03:14 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys 2010-07-27 00:03:13 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys 2010-07-27 00:03:09 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys 2010-07-27 00:03:06 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll 2010-07-27 00:03:06 53760 ----a-w- c:\windows\system32\dllcache\wiamsmud.dll 2010-07-27 00:03:04 41600 ----a-w- c:\windows\system32\dllcache\weitekp9.dll 2010-07-27 00:03:04 31232 ----a-w- c:\windows\system32\dllcache\weitekp9.sys 2010-07-27 00:03:01 701386 ----a-w- c:\windows\system32\dllcache\wdhaalba.sys 2010-07-27 00:01:59 82944 ----a-w- c:\windows\system32\dllcache\tp4mon.exe 2010-07-27 00:00:59 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys 2010-07-26 23:59:59 50432 ----a-w- c:\windows\system32\dllcache\sisv.sys 2010-07-26 23:58:59 166720 ----a-w- c:\windows\system32\dllcache\s3m.sys 2010-07-26 23:57:58 130942 ----a-w- c:\windows\system32\dllcache\ptserlv.sys 2010-07-26 23:56:59 30495 ----a-w- c:\windows\system32\dllcache\pc100nds.sys 2010-07-26 23:55:59 60480 ----a-w- c:\windows\system32\dllcache\neo20xx.dll 2010-07-26 23:54:58 6528 ----a-w- c:\windows\system32\dllcache\miniqic.sys 2010-07-26 23:53:38 18432 ----a-w- c:\windows\system32\dllcache\jupiw.dll 2010-07-26 23:52:59 109085 ----a-w- c:\windows\system32\dllcache\ibmtrp.sys 2010-07-26 23:51:59 7680 ----a-w- c:\windows\system32\dllcache\ftpctrs2.dll 2010-07-26 23:50:57 334208 ----a-w- c:\windows\system32\dllcache\ds1wdm.sys 2010-07-26 23:49:59 42112 ----a-w- c:\windows\system32\dllcache\crtaud.sys 2010-07-26 23:48:59 66082 ----a-w- c:\windows\system32\dllcache\c_1047.nls 2010-07-26 23:47:59 27678 ----a-w- c:\windows\system32\dllcache\ali5261.sys ==================== Find3M ==================== 2010-07-27 06:30:35 8462336 ----a-w- c:\windows\system32\dllcache\shell32.dll 2010-06-28 20:57:33 38848 ----a-w- c:\windows\avastSS.scr 2010-06-14 14:31:20 744448 ----a-w- c:\windows\system32\dllcache\helpsvc.exe 2001-10-05 16:53:04 21866 ------w- c:\program files\common files\tppupd2k.dll 2009-12-13 22:24:02 16384 --sha-w- c:\windows\system32\config\systemprofile\application data\earthlink\6.0\pucci@ix.netcom.com\cookies\index.dat 2009-12-13 22:24:02 16384 --sha-w- c:\windows\system32\config\systemprofile\application data\earthlink\6.0\pucci@ix.netcom.com\ietldcache\index.dat 2008-05-21 16:38:39 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052120080522\index.dat ============= FINISH: 12:59:21.50 ===============

Hi Chris, Thanks for the fast reply. It looks like Avast! didn't fix the problem. After it found something and isolated it, pc still runs slow. I am pasting the DDS report you requested. Thanks again. Frank DDS (Ver_10-03-17.01) - NTFSx86 Run by Frank at 16:01:38.48 on Tue 08/10/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.9 [GMT -4:00] AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\System32\inetsrv\inetinfo.exe C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\System32\DSentry.exe C:\WINDOWS\system32\JupitCo.exe C:\WINDOWS\TPPALDR.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\HDD Thermometer\HDD Thermometer.exe C:\PROGRA~1\MICROS~4\rapimgr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\Program Files\TurboNote\tbnote.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\SysInternals\ProcessExplorer\procexp.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Program Files\AutoHotkey\AutoHotkey.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Frank\Desktop\dds.scr C:\Documents and Settings\Frank\Local Settings\Temp\B.tmp\evP.exe C:\Documents and Settings\Frank\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://google.com uSearch Bar = uWindow Title = Microsoft Internet Explorer uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mWinlogon: Userinit=c:\windows\system32\Userinit.exe BHO: {089fd14d-132b-48fc-8861-0048ae113215} - c:\program files\siteadvisor\6261\SiteAdv.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Netcraft Toolbar: {d554d8fc-b36d-4bb4-93db-4a3394d505e3} - c:\program files\netcraft toolbar\nctb.dll TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\6261\SiteAdv.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll EB: Notes: {0432fc96-1af4-11d4-9996-00b0d0278826} - c:\windows\system32\Shdocvw.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe" uRun: [RSD_HDDThermo] c:\program files\hdd thermometer\HDD Thermometer.exe uRun: [Google Update] "c:\documents and settings\frank\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [iE Privacy Keeper] "c:\program files\unh solutions\ie privacy keeper\IEPrivacyKeeper.exe" -startup uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [DVDSentry] c:\windows\system32\DSentry.exe mRun: [uSB SECURITY DEVICE CoInstaller] JupitCo.exe mRun: [TPP Auto Loader] c:\windows\TPPALDR.EXE mRun: [Logitech Utility] Logi_MwX.Exe mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe mRun: [symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [siteAdvisor] c:\program files\siteadvisor\6253\SiteAdv.exe mRun: [VerizonServicepoint.exe] "c:\program files\verizon\vsp\VerizonServicepoint.exe" /AUTORUN mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [CTCheck] c:\program files\creative\creative zen\zen media explorer\CTCheck.exe mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui mRun: [inCD] c:\program files\nero\nero 7\incd\InCD.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit StartupFolder: c:\docume~1\frank\startm~1\programs\startup\sysint~1.lnk - c:\program files\sysinternals\processexplorer\procexp.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\colorc~1.lnk - c:\program files\sec\magictune 2.5\GammaTray.exe uPolicies-explorer: NoViewOnDrive = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\mi69df~1\office12\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html IE: Edit with X&ML Spy - c:\program files\altova\xmlspy2004\spy.htm IE: {2222EF56-F49E-4d07-A14E-8D2B08766958} - c:\program files\altova\xmlspy2004\spy.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi69df~1\office12\REFIEBAR.DLL IE: {D8DEE6AE-1AE4-11D4-9996-00B0D0278826} - {0432FC96-1AF4-11D4-9996-00B0D0278826} - c:\windows\system32\Shdocvw.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} Trusted Zone: intuit.com\ttlc Trusted Zone: turbotax.com DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemydsl.verizon.net/sdcCommon/download/DSL/tgctlcm.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab DPF: {4BEE3896-4820-48D1-85EA-5A9A9ECD3D95} - hxxp://office.microsoft.com/productupdates/content/opuc/opuc.cab DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126651071953 DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} - hxxp://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www3.ca.com/securityadvisor/virusinfo/webscan.cab DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} - hxxps://www.microsoft.com/resources/virtuallabs/ActiveX/VMRCActiveXClient.cab DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxp://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab DPF: {83229950-AD1D-4B94-8304-F56E95AFACF7} - hxxp://technet.msft.demoservers.com/SupportFiles/Client/srdp.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - hxxp://toolbar.google.com/data/GoogleActivate.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.2954513889 DPF: {A80D199B-CFDD-4DA4-8C47-2310D5B8DD97} - hxxps://accounting.quickbooks.com/v7.576/qboax5.cab DPF: {BCD5A227-8720-497B-AF5F-4403E94342E3} - hxxps://netservices.verizon.net/portal/verizon/passwdchg/activex/DSLControl.cab DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} - hxxp://scpwbe.ops.placeware.com/etc/place/RCC-BETA/pws-pw-03/5.1.0.104/lib/quicksilver.cab DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - hxxp://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} - hxxp://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} - hxxp://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15112/CTPID.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\6261\SiteAdv.dll AppInit_DLLs: SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\frank\applic~1\mozilla\firefox\profiles\tcl00tj5.alt user\ FF - prefs.js: browser.search.selectedEngine - Dictionary FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk FF - component: c:\documents and settings\frank\application data\mozilla\firefox\profiles\tcl00tj5.alt user\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll FF - component: c:\program files\siteadvisor\6261\ff\components\FFHook.dll FF - plugin: c:\documents and settings\frank\application data\mozilla\firefox\profiles\tcl00tj5.alt user\extensions\devicedetection@logitech.com\plugins\npLogitechDeviceDetection.dll FF - plugin: c:\documents and settings\frank\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\program files\google\google updater\1.0.377.3622\npCIDetect.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ ---- FIREFOX POLICIES ---- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R? bcgame;Nostromo HID Device Minidriver R? ccPwdSvc;Symantec Password Validation R? DCamUSBBVI;SiPix StyleCam RAVE/SNAP Dual Mode Camera R? gupdate;Google Update Service (gupdate) R? MSSQL$SQL;MSSQL$SQL R? NPF;NetGroup Packet Filter Driver R? onfb;onfb R? PortReporter;Port Reporter R? Radialpoint Security Services;Radialpoint Security Services R? SECURITY;%JUPITER.DeviceDesc% R? SQLAgent$SQL;SQLAgent$SQL R? TPP300;USB Storage Adapter V3 (TPP) R? Usblink;Usblink Driver S? Active@ Disk Monitor;Active@ Disk Monitor S? aswFsBlk;aswFsBlk S? aswSP;aswSP S? avast! Antivirus;avast! Antivirus S? avast! Mail Scanner;avast! Mail Scanner S? avast! Web Scanner;avast! Web Scanner S? BCMNTIO;BCMNTIO S? ccEvtMgr;Symantec Event Manager S? ccSetMgr;Symantec Settings Manager S? Lbd;Lbd S? MAPMEM;MAPMEM S? NProtectService;Norton Unerase Protection S? PQIMount;PQIMount S? PQV2i;PQV2i S? psqlWGE;Pervasive PSQL Workgroup Engine S? SBRE;SBRE S? Symantec Core LC;Symantec Core LC S? VPCAppSv;Virtual PC Application Services ============== File Associations =============== inffile=c:\dpl\DPLAS.EXE %1 =============== Created Last 30 ================ 2010-07-27 00:04:14 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll 2010-07-27 00:04:13 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll 2010-07-27 00:04:10 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll 2010-07-27 00:04:09 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe 2010-07-27 00:04:08 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe 2010-07-27 00:03:50 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe 2010-07-27 00:03:49 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys 2010-07-27 00:03:23 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys 2010-07-27 00:03:14 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys 2010-07-27 00:03:13 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys 2010-07-27 00:03:09 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys 2010-07-27 00:03:06 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll 2010-07-27 00:03:06 53760 ----a-w- c:\windows\system32\dllcache\wiamsmud.dll 2010-07-27 00:03:04 41600 ----a-w- c:\windows\system32\dllcache\weitekp9.dll 2010-07-27 00:03:04 31232 ----a-w- c:\windows\system32\dllcache\weitekp9.sys 2010-07-27 00:03:01 701386 ----a-w- c:\windows\system32\dllcache\wdhaalba.sys 2010-07-27 00:01:59 82944 ----a-w- c:\windows\system32\dllcache\tp4mon.exe 2010-07-27 00:00:59 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys 2010-07-26 23:59:59 50432 ----a-w- c:\windows\system32\dllcache\sisv.sys 2010-07-26 23:58:59 166720 ----a-w- c:\windows\system32\dllcache\s3m.sys 2010-07-26 23:57:58 130942 ----a-w- c:\windows\system32\dllcache\ptserlv.sys 2010-07-26 23:56:59 30495 ----a-w- c:\windows\system32\dllcache\pc100nds.sys 2010-07-26 23:55:59 60480 ----a-w- c:\windows\system32\dllcache\neo20xx.dll 2010-07-26 23:54:58 6528 ----a-w- c:\windows\system32\dllcache\miniqic.sys 2010-07-26 23:53:38 18432 ----a-w- c:\windows\system32\dllcache\jupiw.dll 2010-07-26 23:52:59 109085 ----a-w- c:\windows\system32\dllcache\ibmtrp.sys 2010-07-26 23:51:59 7680 ----a-w- c:\windows\system32\dllcache\ftpctrs2.dll 2010-07-26 23:50:57 334208 ----a-w- c:\windows\system32\dllcache\ds1wdm.sys 2010-07-26 23:49:59 42112 ----a-w- c:\windows\system32\dllcache\crtaud.sys 2010-07-26 23:48:59 66082 ----a-w- c:\windows\system32\dllcache\c_1047.nls 2010-07-26 23:47:59 27678 ----a-w- c:\windows\system32\dllcache\ali5261.sys 2010-07-14 14:45:58 38848 ----a-w- c:\windows\avastSS.scr ==================== Find3M ==================== 2010-07-27 06:30:35 8462336 ----a-w- c:\windows\system32\dllcache\shell32.dll 2010-06-14 14:31:20 744448 ----a-w- c:\windows\system32\dllcache\helpsvc.exe 2001-10-05 16:53:04 21866 ------w- c:\program files\common files\tppupd2k.dll 2009-12-13 22:24:02 16384 --sha-w- c:\windows\system32\config\systemprofile\application data\earthlink\6.0\pucci@ix.netcom.com\cookies\index.dat 2009-12-13 22:24:02 16384 --sha-w- c:\windows\system32\config\systemprofile\application data\earthlink\6.0\pucci@ix.netcom.com\ietldcache\index.dat 2008-05-21 16:38:39 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052120080522\index.dat ============= FINISH: 16:16:39.82 ===============

I ran Avast! and it found Win32Malware-gen which it moved to the Virus Chest. I don't know if this has fixed it, will run more diagnostics.

I run a Dell with Windows XP fully patched and up-to-date. It now seems to run slow and the keyboard crashes, just stops working. I usually run Malwarebytes weekly and the app works fine and doesn't find a problem. Now, Malwarebytes starts slow, stops during execution and the last time closed before ending without creating a log file. I first thought I had a bad keyboard, but now am not so sure. I've enclosed a link for the hijacthis.log file. Thanks for any help you can give me to figure out what is going on. http://cid-c96b5052195124ca.office.live.co.../hijackthis.log

Thanks for the fast reply. I will make a bookmark of your response and if it happens again, I'll reinstall. Like I said, am happy with the stability of the app so maybe this was a fluke or the next upgrade will fix it. All the best.

I was running a deep scan today and got the BSOD. I didn't have anything else running, but the mini-dump pointed to Malwearbytes. I have been using this app for almost a year and no problems. Malwearbytes is up to date as of today. The machine is a Windows XP up to date with all patches Dell, nothing unusual about it. This is the first time it happensed, so am not upset, but thought I'd pass along the minidump as an FYI for your review: Use !analyze -v to get detailed debugging information. BugCheck 10000050, {e11a7008, 0, f89dfe9a, 1} Could not read faulting driver name Probably caused by : mbamswissarmy.sys ( mbamswissarmy+1e9a ) Followup: MachineOwner --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: e11a7008, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: f89dfe9a, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000001, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: e11a7008 FAULTING_IP: mbamswissarmy+1e9a f89dfe9a 8b7e28 mov edi,dword ptr [esi+28h] MM_INTERNAL_CODE: 1 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: mbam.exe LAST_CONTROL_TRANSFER: from f89df032 to f89dfe9a STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. f33dd218 f89df032 0000936d 00000000 00100002 mbamswissarmy+0x1e9a f33dd238 f89df350 e1197998 e461fcd0 e461fcd0 mbamswissarmy+0x1032 f33dd24c f89dea82 e461fcd0 f33dd27c 00000000 mbamswissarmy+0x1350 f33dd270 f89e4e4b 82d64ac0 82d64b30 e461fcd0 mbamswissarmy+0xa82 f33dd294 804e3807 82934678 00000043 806f02d0 mbamswissarmy+0x6e4b f33dd294 82d64ac0 82934678 00000043 806f02d0 nt!KeUpdateSystemTime+0xca f33dd328 82934678 82912a01 00000002 82912a01 0x82d64ac0 00000000 00000000 00000000 00000000 00000000 0x82934678 STACK_COMMAND: kb FOLLOWUP_IP: mbamswissarmy+1e9a f89dfe9a 8b7e28 mov edi,dword ptr [esi+28h] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: mbamswissarmy+1e9a FOLLOWUP_NAME: MachineOwner MODULE_NAME: mbamswissarmy IMAGE_NAME: mbamswissarmy.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4bd9bdda FAILURE_BUCKET_ID: 0x50_mbamswissarmy+1e9a BUCKET_ID: 0x50_mbamswissarmy+1e9a Followup: MachineOwner ---------