mswind18

December 1, 2010

You're right....however it was a couple days ago, I may have fat fingered the process, don't remember.....

Will do the clean up recommendations!

Thanks for your help and patience!

mark

November 30, 2010

This should be a little embarrassing after all this:

Mastershake; you are on the right track.......I found this before your post...

"" To resolve this behavior, turn on the Show Desktop Icons feature:

1. Right-click the desktop.

2. Point to Arrange Icons By.

3. Click Show Desktop Icons. ""

Fixed

Sorry to interject.
Did you try this.
Right-Click->View->Show Desktop Icons

November 30, 2010

No luck still.

November 29, 2010

Sorry about that forgot to post...here it is...

ComboFix 10-11-28.05 - Dad 11/29/2010 15:02:07.4.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.407 [GMT -5:00]

Running from: c:\documents and settings\Dad\My Documents\Downloads\ComboFix.exe

AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

((((((((((((((((((((((((( Files Created from 2010-10-28 to 2010-11-29 )))))))))))))))))))))))))))))))

.

2010-11-21 12:34 . 2010-11-21 12:34 -------- d-----w- c:\documents and settings\Mom2\Local Settings\Application Data\AOL Toolbar

2010-11-15 10:19 . 2010-11-15 10:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\AOL

2010-11-15 04:16 . 2010-11-15 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Toolbar

2010-11-15 04:16 . 2010-11-15 04:16 -------- d-----w- c:\program files\Common Files\Software Update Utility

2010-11-15 04:12 . 2010-11-15 04:12 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL OCP

2010-11-15 04:10 . 2010-11-15 04:21 -------- d-----w- c:\program files\AOL 9.5

2010-11-15 04:10 . 2010-11-15 04:18 -------- d-----w- c:\program files\Common Files\aolshare

2010-11-14 16:23 . 2010-11-14 16:23 -------- dc----w- C:\Install AOL Communicator

2010-11-14 16:23 . 2010-11-14 16:23 -------- dc----w- C:\Install Winamp

2010-11-14 16:23 . 2010-11-14 16:23 -------- dc----w- C:\Install ICQ

2010-11-14 16:23 . 2010-11-14 16:23 -------- dc----w- C:\AOL Instant Messenger

2010-11-14 16:22 . 2010-11-14 16:22 -------- d-----w- c:\program files\Learn2.com

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-11-29 15:29 . 2009-03-06 03:49 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr

2010-11-29 15:29 . 2007-04-04 00:35 214520 ----a-w- c:\windows\system32\PnkBstrB.exe

2010-11-29 15:22 . 2007-04-04 00:35 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2010-11-24 23:46 . 2010-01-07 00:30 41856 ----a-w- c:\windows\system32\drivers\imapi.sys

2010-11-24 04:39 . 2006-10-27 18:33 963 -c-ha-w- c:\windows\win.tmp

2006-04-05 16:26 . 2006-09-23 21:46 233472 -c--a-w- c:\program files\ShellEnglishLC.dll

2006-04-05 16:26 . 2006-09-23 21:46 36864 -c--a-w- c:\program files\ShellDLLResEnglish.dll

2006-04-05 16:26 . 2006-09-23 21:46 483328 -c--a-w- c:\program files\Shell2EnglishLC.dll

2006-04-05 16:26 . 2006-09-23 21:46 208896 -c--a-w- c:\program files\ShellLC.dll

2006-04-05 16:26 . 2006-09-23 21:46 114688 -c--a-w- c:\program files\RTFCtrl.dll

2006-04-05 16:26 . 2006-09-23 21:46 102400 -c--a-w- c:\program files\MXExHand.dll

2006-04-05 16:24 . 2006-09-23 21:46 45056 -c--a-w- c:\program files\DMUtilsResEnglish.dll

2006-04-05 16:24 . 2006-09-23 21:46 184320 -c--a-w- c:\program files\DMUtils.dll

2006-04-05 16:23 . 2006-09-23 21:46 86016 -c--a-w- c:\program files\DMTutorialResEnglish.dll

2006-04-05 16:23 . 2006-09-23 21:46 90112 -c--a-w- c:\program files\DMTutorial.dll

2006-04-05 16:22 . 2006-09-23 21:46 159744 -c--a-w- c:\program files\DMSetupResEnglish.dll

2006-04-05 16:22 . 2006-09-23 21:46 303104 -c--a-w- c:\program files\DMSetup.dll

2006-04-05 16:21 . 2006-09-23 21:46 118784 -c--a-w- c:\program files\ODIFCopy.dll

2006-04-05 16:21 . 2006-09-23 21:46 98304 -c--a-w- c:\program files\ODIMan.dll

2006-04-05 16:21 . 2006-09-23 21:46 20480 -c--a-w- c:\program files\DMInfoResEnglish.dll

2006-04-05 16:20 . 2006-09-23 21:46 151552 -c--a-w- c:\program files\DMInfo.dll

2006-04-05 16:19 . 2006-09-23 21:46 3497984 -c--a-w- c:\program files\ODIJump.dll

2006-04-05 16:19 . 2006-09-23 21:46 176128 -c--a-w- c:\program files\ODICtrl.dll

2006-04-05 16:19 . 2006-09-23 21:46 94208 -c--a-w- c:\program files\ODIFrmt.dll

2006-04-05 16:18 . 2006-09-23 21:46 61440 -c--a-w- c:\program files\CDEject.exe

2006-04-05 16:18 . 2006-09-23 21:46 49152 ----a-w- c:\program files\DataLifeguard.exe

2006-04-05 16:18 . 2006-09-23 21:46 266240 -c--a-w- c:\program files\ShellDLL.dll

2006-04-05 16:17 . 2006-09-23 21:46 139264 -c--a-w- c:\program files\ODIPart.dll

2006-04-05 16:16 . 2006-09-23 21:46 176128 -c--a-w- c:\program files\ODIDev.dll

2006-04-05 16:16 . 2006-09-23 21:46 49152 -c--a-w- c:\program files\Scsilib.dll

2006-04-05 16:15 . 2006-09-23 21:46 94208 -c--a-w- c:\program files\mxdlgsup.dll

2006-04-05 16:15 . 2006-09-23 21:46 102400 -c--a-w- c:\program files\MXPM.dll

2004-12-08 14:50 . 2004-12-08 14:50 2112103 -c--a-w- c:\program files\BHODemon20Setup_2020.exe

2004-12-02 13:24 . 2004-12-02 13:22 16706160 -c--a-w- c:\program files\AdbeRdr60_enu_full.exe

2004-12-02 13:22 . 2004-12-02 13:22 6811656 -c--a-w- c:\program files\psa201se_us.exe

2003-04-03 12:47 . 2003-04-03 12:47 1684194 -c--a-w- c:\program files\SpamNet1.0Beta9.exe

2003-02-18 01:31 . 2003-02-18 01:31 2430662 -c--a-w- c:\program files\spybotsd11.exe

2003-02-09 03:10 . 2003-02-09 03:10 37376 -c-ha-w- c:\program files\iblock.exe

2003-01-17 04:22 . 2003-01-17 04:22 3781808 -c-ha-w- c:\program files\zaSetup_1001.exe

2003-01-11 15:07 . 2003-01-11 14:41 8839120 -c-ha-w- c:\program files\AcroReader51_ENU.exe

2003-01-11 14:41 . 2003-01-11 04:22 13736688 -c-ha-w- c:\program files\AcroReader51_ENU_full.exe

2000-03-13 16:13 . 2006-09-23 21:46 509984 -c--a-w- c:\program files\50comupd.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-24 68856]

"AOL Fast Start"="c:\program files\AOL 9.5\AOL.EXE" [2010-03-23 29520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]

"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-12-12 192512]

"EM_EXEC"="c:\progra~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-07-01 28672]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-09-25 290816]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]

"NSWosCheck"="c:\program files\Norton SystemWorks\osCheck.exe" [2007-09-18 25472]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]

"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]

"HostManager"="c:\program files\Common Files\AOL\1188076909\ee\AOLSoftware.exe" [2010-02-10 41800]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2007-08-23 152952]

"Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2006-12-11 2115728]

c:\documents and settings\Dad\Start Menu\Programs\Startup\

HotSync Manager.LNK - c:\program files\Palm\Hotsync.exe [2004-6-9 471040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2007-2-2 28672]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2002-12-22 45056]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

@="FSFilter Activity Monitor"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk

backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]

2002-04-10 20:44 679936 -c--a-w- c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]

2006-10-23 12:50 71216 ----a-r- c:\program files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2009-11-11 04:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2007-06-24 10:41 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

"Camera Detector"=c:\progra~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"f:\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Activision\\Call of Duty 2\\cod2mp_s.exe"=

"c:\\Program Files\\Call of Duty Game of the Year Edition\\CoDMP.exe"=

"c:\\Program Files\\Palm\\Hotsync.exe"=

"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=

"c:\\Program Files\\Common Files\\AOL\\1188076909\\ee\\aolsoftware.exe"=

"c:\\Program Files\\AOL 9.5\\waol.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SYMEFA.SYS [2009-08-22 310320]

S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys [2009-08-22 259632]

S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\N360\0308000.029\ccHPx86.sys [2009-08-22 482432]

S1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20101124.002\IDSxpx86.sys [2010-10-19 341880]

S2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [2009-08-22 117640]

S2 NProtectService;Norton UnErase Protection;c:\progra~1\NORTON~1\NORTON~1\NPROTECT.EXE [2005-11-04 95832]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-05-26 102448]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - PNKBSTRB

*NewlyCreated* - PNKBSTRK

*Deregistered* - klmd25

*Deregistered* - mchInjDrv

.

Contents of the 'Scheduled Tasks' folder

2010-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 15:37]

2010-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 15:37]

2010-11-01 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job

- c:\program files\Norton SystemWorks\OBC.exe [2007-09-18 12:22]

.

------- Supplementary Scan -------

.

uLocal Page = C:\WINDOWSabout.htm

uStart Page = hxxp://www.google.com/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mLocal Page = about:blank

mStart Page = about:blank

mSearch Bar = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

Trusted Zone: finefind.net

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB

FF - ProfilePath - c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\46d37nqd.dad\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

FF - Extension: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\46d37nqd.dad\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}

FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Extension: Norton Toolbar: {7BA52691-1876-45ce-9EE6-54BCB3B04BBC} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-11-29 15:37

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]

"ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]

"ImagePath"="\??\c:\windows\TEMP\mc23.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3013870458-1111066612-3762109593-1005\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-3013870458-1111066612-3762109593-1005\Software\Policies\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (S-1-5-21-3013870458-1111066612-3762109593-1005)

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(520)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(43068)

c:\program files\Logitech\iTouch\iTchHk.dll

c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll

c:\windows\System32\shdoclc.dll

c:\progra~1\Logitech\MOUSEW~1\SYSTEM\LGMOUSHK.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2010-11-29 16:49:15

ComboFix-quarantined-files.txt 2010-11-29 21:48

ComboFix2.txt 2010-11-29 18:49

ComboFix3.txt 2010-11-25 02:07

Pre-Run: 11,900,088,320 bytes free

Post-Run: 12,105,166,848 bytes free

- - End Of File - - C71348CEEB57BEFF015A165E85AF5CEE

November 29, 2010

Here is the report from the affected account....this also took longer than the one I ran the other day (for the first time)....

November 29, 2010

I was getting nervous.....started the program and it seemed the"creating report" part was running too long....certainly not as long in my (the problem) directory....so I stopped and ran again...and just let it run.....report finally appeared (attached) also note I think I did not run combofix as you requested earlier today from the problem account....should I run again?

Here is from a good account.

ComboFix 10-11-28.05 - Mom2 11/29/2010 12:32:26.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.314 [GMT -5:00]

Running from: c:\documents and settings\Dad\My Documents\Downloads\ComboFix.exe

AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

((((((((((((((((((((((((( Files Created from 2010-10-28 to 2010-11-29 )))))))))))))))))))))))))))))))

.

2010-11-29 16:08 . 2010-11-29 16:08 -------- d-----w- c:\documents and settings\Greg\Local Settings\Application Data\AOL Toolbar

2010-11-29 16:03 . 2010-11-29 16:03 -------- d-----w- c:\documents and settings\Greg\Application Data\Malwarebytes