XP Antispyware 2012 DDS logs

[vtidtv]

Computer was showing a large amount of network activity. Internet Gateway was active and running at 1Mb/s. I went into Network Services and removed the check from Internet Gateway Device Discovery and Control Client. Once I did this that is when the XP Antispyware 2012 took over.

Thanks for your help.

Logs pasted.

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 7/18/2003 10:37:19 PM

System Uptime: 12/28/2011 7:22:33 PM (1 hours ago)

.

Motherboard: | | nVidia-nForce

Processor: AMD Athlon XP 2800+ | Socket A | 2079/166mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 114 GiB total, 29.094 GiB free.

D: is CDROM ()

E: is CDROM ()

F: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: 1394 Net Adapter

Device ID: V1394\NIC1394\CFC70000

Manufacturer: Microsoft

Name: 1394 Net Adapter

PNP Device ID: V1394\NIC1394\CFC70000

Service: NIC1394

.

Class GUID: {4D36E97D-E325-11CE-BFC1-08002BE10318}

Description: Motherboard resources

Device ID: ACPI\PNP0C02\3&13C0B0C5&0&3

Manufacturer: (Standard system devices)

Name: Motherboard resources

PNP Device ID: ACPI\PNP0C02\3&13C0B0C5&0&3

Service:

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: VMware Virtual Ethernet Adapter for VMnet1

Device ID: ROOT\VMWARE\0000

Manufacturer: VMware, Inc.

Name: VMware Virtual Ethernet Adapter for VMnet1

PNP Device ID: ROOT\VMWARE\0000

Service: VMnetAdapter

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: VMware Virtual Ethernet Adapter for VMnet8

Device ID: ROOT\VMWARE\0001

Manufacturer: VMware, Inc.

Name: VMware Virtual Ethernet Adapter for VMnet8

PNP Device ID: ROOT\VMWARE\0001

Service: VMnetAdapter

.

==== System Restore Points ===================

.

RP103: 8/28/2011 1:49:16 AM - Software Distribution Service 3.0

RP104: 8/28/2011 3:56:56 PM - Software Distribution Service 3.0

RP105: 8/29/2011 3:47:40 PM - Software Distribution Service 3.0

RP106: 8/30/2011 3:50:39 PM - Software Distribution Service 3.0

RP107: 9/2/2011 10:44:23 AM - Software Distribution Service 3.0

RP108: 9/3/2011 10:32:07 AM - Software Distribution Service 3.0

RP109: 9/4/2011 1:50:41 AM - Software Distribution Service 3.0

RP110: 9/4/2011 11:04:45 AM - Software Distribution Service 3.0

RP111: 9/5/2011 11:35:56 AM - Software Distribution Service 3.0

RP112: 9/7/2011 2:15:47 AM - Software Distribution Service 3.0

RP113: 9/8/2011 9:45:34 AM - Software Distribution Service 3.0

RP114: 9/9/2011 9:53:41 AM - Software Distribution Service 3.0

RP115: 9/9/2011 3:10:32 PM - Software Distribution Service 3.0

RP116: 9/10/2011 3:11:30 PM - Software Distribution Service 3.0

RP117: 9/11/2011 2:25:46 AM - Software Distribution Service 3.0

RP118: 9/11/2011 3:19:46 PM - Software Distribution Service 3.0

RP119: 9/12/2011 3:10:02 PM - Software Distribution Service 3.0

RP120: 9/13/2011 3:12:54 PM - Software Distribution Service 3.0

RP121: 9/14/2011 3:11:12 PM - Software Distribution Service 3.0

RP122: 9/15/2011 3:20:12 PM - Software Distribution Service 3.0

RP123: 9/16/2011 3:11:03 PM - Software Distribution Service 3.0

RP124: 9/17/2011 3:21:27 PM - Software Distribution Service 3.0

RP125: 9/18/2011 2:28:47 AM - Software Distribution Service 3.0

RP126: 9/18/2011 3:13:19 PM - Software Distribution Service 3.0

RP127: 9/19/2011 3:21:51 PM - Software Distribution Service 3.0

RP128: 9/19/2011 4:11:45 PM - Software Distribution Service 3.0

RP129: 9/20/2011 3:10:29 PM - Software Distribution Service 3.0

RP130: 9/20/2011 4:30:02 PM - Software Distribution Service 3.0

RP131: 9/21/2011 4:33:27 PM - Software Distribution Service 3.0

RP132: 9/22/2011 4:44:30 PM - Software Distribution Service 3.0

RP133: 9/23/2011 5:13:46 PM - Software Distribution Service 3.0

RP134: 9/24/2011 8:07:45 PM - Software Distribution Service 3.0

RP135: 9/25/2011 3:29:06 AM - Software Distribution Service 3.0

RP136: 9/25/2011 5:31:25 PM - Software Distribution Service 3.0

RP137: 9/26/2011 7:32:42 PM - Software Distribution Service 3.0

RP138: 9/28/2011 12:49:16 AM - Software Distribution Service 3.0

RP139: 9/28/2011 9:40:39 AM - Software Distribution Service 3.0

RP140: 9/28/2011 4:41:27 PM - Software Distribution Service 3.0

RP141: 9/29/2011 4:34:04 PM - Software Distribution Service 3.0

RP142: 9/30/2011 4:42:44 PM - Software Distribution Service 3.0

RP143: 10/1/2011 4:34:43 PM - Software Distribution Service 3.0

RP144: 10/2/2011 2:13:11 AM - Software Distribution Service 3.0

RP145: 10/2/2011 4:41:35 PM - Software Distribution Service 3.0

RP146: 10/3/2011 4:34:26 PM - Software Distribution Service 3.0

RP147: 10/4/2011 4:42:23 PM - Software Distribution Service 3.0

RP148: 10/5/2011 4:34:14 PM - Software Distribution Service 3.0

RP149: 10/6/2011 4:41:36 PM - Software Distribution Service 3.0

RP150: 10/7/2011 4:37:58 PM - Software Distribution Service 3.0

RP151: 10/8/2011 5:38:03 PM - Software Distribution Service 3.0

RP152: 10/9/2011 2:11:21 AM - Software Distribution Service 3.0

RP153: 10/9/2011 4:34:39 PM - Software Distribution Service 3.0

RP154: 10/13/2011 12:33:17 PM - Software Distribution Service 3.0

RP155: 10/13/2011 1:19:49 PM - Software Distribution Service 3.0

RP156: 10/14/2011 2:29:26 PM - Software Distribution Service 3.0

RP157: 10/15/2011 1:59:30 PM - Software Distribution Service 3.0

RP158: 10/15/2011 2:41:56 PM - Software Distribution Service 3.0

RP159: 10/16/2011 2:21:29 AM - Software Distribution Service 3.0

RP160: 10/16/2011 3:05:42 PM - Software Distribution Service 3.0

RP161: 10/17/2011 4:58:50 PM - Software Distribution Service 3.0

RP162: 10/23/2011 2:59:50 AM - Software Distribution Service 3.0

RP163: 10/23/2011 2:53:24 PM - Software Distribution Service 3.0

RP164: 10/24/2011 2:47:55 PM - Software Distribution Service 3.0

RP165: 10/25/2011 2:53:19 PM - Software Distribution Service 3.0

RP166: 10/26/2011 2:44:56 PM - Software Distribution Service 3.0

RP167: 10/27/2011 2:53:11 PM - Software Distribution Service 3.0

RP168: 11/8/2011 12:45:50 PM - Software Distribution Service 3.0

RP169: 11/9/2011 8:04:23 PM - Software Distribution Service 3.0

RP170: 11/10/2011 8:11:58 PM - Software Distribution Service 3.0

RP171: 11/11/2011 2:41:24 PM - Software Distribution Service 3.0

RP172: 11/12/2011 3:46:21 PM - Software Distribution Service 3.0

RP173: 11/13/2011 2:13:50 AM - Software Distribution Service 3.0

RP174: 11/13/2011 3:54:55 PM - Software Distribution Service 3.0

RP175: 11/14/2011 3:47:16 PM - Software Distribution Service 3.0

RP176: 11/15/2011 3:28:38 PM - Software Distribution Service 3.0

RP177: 11/16/2011 3:34:32 PM - Software Distribution Service 3.0

RP178: 11/17/2011 3:41:23 PM - Software Distribution Service 3.0

RP179: 11/18/2011 3:34:51 PM - Software Distribution Service 3.0

RP180: 11/19/2011 3:37:14 PM - Software Distribution Service 3.0

RP181: 11/20/2011 1:45:32 AM - Software Distribution Service 3.0

RP182: 11/20/2011 3:35:30 PM - Software Distribution Service 3.0

RP183: 11/21/2011 3:41:45 PM - Software Distribution Service 3.0

RP184: 11/22/2011 3:34:03 PM - Software Distribution Service 3.0

RP185: 11/23/2011 3:36:36 PM - Software Distribution Service 3.0

RP186: 11/24/2011 7:42:51 PM - Software Distribution Service 3.0

RP187: 11/26/2011 2:26:31 PM - Software Distribution Service 3.0

RP188: 11/27/2011 1:44:36 AM - Software Distribution Service 3.0

RP189: 11/27/2011 3:42:58 PM - Software Distribution Service 3.0

RP190: 11/28/2011 3:33:57 PM - Software Distribution Service 3.0

RP191: 11/29/2011 3:37:18 PM - Software Distribution Service 3.0

RP192: 12/1/2011 2:01:47 AM - Software Distribution Service 3.0

RP193: 12/1/2011 3:42:43 PM - Software Distribution Service 3.0

RP194: 12/2/2011 3:33:43 PM - Software Distribution Service 3.0

RP195: 12/3/2011 3:36:09 PM - Software Distribution Service 3.0

RP196: 12/4/2011 1:44:44 AM - Software Distribution Service 3.0

RP197: 12/4/2011 3:35:25 PM - Software Distribution Service 3.0

RP198: 12/5/2011 3:37:51 PM - Software Distribution Service 3.0

RP199: 12/6/2011 3:35:28 PM - Software Distribution Service 3.0

RP200: 12/7/2011 3:36:23 PM - Software Distribution Service 3.0

RP201: 12/8/2011 3:34:06 PM - Software Distribution Service 3.0

RP202: 12/9/2011 3:36:29 PM - Software Distribution Service 3.0

RP203: 12/10/2011 3:33:41 PM - Software Distribution Service 3.0

RP204: 12/11/2011 1:45:21 AM - Software Distribution Service 3.0

RP205: 12/11/2011 3:42:56 PM - Software Distribution Service 3.0

RP206: 12/12/2011 3:35:22 PM - Software Distribution Service 3.0

RP207: 12/13/2011 3:36:24 PM - Software Distribution Service 3.0

RP208: 12/14/2011 3:34:04 PM - Software Distribution Service 3.0

RP209: 12/15/2011 3:37:48 PM - Software Distribution Service 3.0

RP210: 12/16/2011 3:44:52 PM - Software Distribution Service 3.0

RP211: 12/17/2011 3:32:16 PM - Software Distribution Service 3.0

RP212: 12/18/2011 1:48:02 AM - Software Distribution Service 3.0

RP213: 12/18/2011 3:39:43 PM - Software Distribution Service 3.0

RP214: 12/19/2011 2:07:07 PM - Software Distribution Service 3.0

RP215: 12/20/2011 2:30:57 PM - Software Distribution Service 3.0

RP216: 12/21/2011 2:37:09 PM - Software Distribution Service 3.0

RP217: 12/22/2011 2:29:34 PM - Software Distribution Service 3.0

RP218: 12/23/2011 2:37:06 PM - Software Distribution Service 3.0

RP219: 12/24/2011 2:27:58 PM - Software Distribution Service 3.0

RP220: 12/25/2011 2:11:44 AM - Software Distribution Service 3.0

RP221: 12/25/2011 2:35:29 PM - Software Distribution Service 3.0

RP222: 12/26/2011 2:29:38 PM - Software Distribution Service 3.0

RP223: 12/27/2011 5:41:41 PM - Software Distribution Service 3.0

RP224: 12/28/2011 7:14:27 PM - Software Distribution Service 3.0

.

==== Installed Programs ======================

.

AboutTime

ACDSee

Acrobat.com

Adobe AIR

Adobe Flash Player 11 Plugin

Adobe Reader 9.4.5

AIM 6

Akamai NetSession Interface

Akamai NetSession Interface Service

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ArcSoft PhotoImpression

Autodesk Design Review 2012

Autodesk Design Review Browser Add-on v1.2

Bonjour

Brother HL-5170DN

Brother MFL-Pro Suite

Choice Guard

Compatibility Pack for the 2007 Office system

Critical Update for Windows Media Player 11 (KB959772)

Crown Print Monitor

DIGOpt

DIGReqEx

Easy CD Creator 5 Basic

eDocPrinter PDF Pro Ver 6.48

getPlus® for Adobe

Google Earth

Google Update Helper

HighMAT Extension to Microsoft Windows XP CD Writing Wizard

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Internet Explorer 7 (KB947864)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB942288-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

Intel® 536EP Modem

iolo technologies' System Mechanic

iTunes

Java Auto Updater

Java 6 Update 26

LogMeIn

Macromedia Shockwave Player

magicolor 2200 DeskLaser

magicolor 6100 DeskLaser

Malwarebytes Anti-Malware version 1.60.0.1800

MathPlayer

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2572067)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Antimalware

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Data Access Components KB870669

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office 2000 SR-1 Premium

Microsoft Picture It! Express 9

Microsoft Picture It! Library 9

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Mozilla Firefox 8.0 (x86 en-US)

MSI4400, 8vsb Analyzer

MSN

MSN Encarta Plus Support Files

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6.0 Parser

MUSICMATCH® Jukebox

No-IP.com DUC (remove only)

NVIDIA Audio Driver

NVIDIA Drivers

NVIDIA Windows 2000/XP Display Drivers

NvMixer

Octoshape add-in for Adobe Flash Player

PaperPort

QuickTime

Rhozet Carbon Coder

Roxio BackOnTrack

Roxio Burn

Roxio CinePlayer

Roxio CinePlayer Decoder Pack

Roxio Creator 2011

Roxio Creator 2011 Content

Roxio PhotoShow

Roxio Video Capture USB

Second Copy 7

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 7 (KB928090)

Security Update for Windows Internet Explorer 7 (KB929969)

Security Update for Windows Internet Explorer 7 (KB931768)

Security Update for Windows Internet Explorer 7 (KB933566)

Security Update for Windows Internet Explorer 7 (KB937143)

Security Update for Windows Internet Explorer 7 (KB938127)

Security Update for Windows Internet Explorer 7 (KB939653)

Security Update for Windows Internet Explorer 7 (KB942615)

Security Update for Windows Internet Explorer 7 (KB944533)

Security Update for Windows Internet Explorer 7 (KB950759)

Security Update for Windows Internet Explorer 7 (KB953838)

Security Update for Windows Internet Explorer 7 (KB956390)

Security Update for Windows Internet Explorer 7 (KB958215)

Security Update for Windows Internet Explorer 7 (KB960714)

Security Update for Windows Internet Explorer 7 (KB961260)

Security Update for Windows Internet Explorer 7 (KB963027)

Security Update for Windows Internet Explorer 7 (KB969897)

Security Update for Windows Internet Explorer 8 (KB2183461)

Security Update for Windows Internet Explorer 8 (KB2360131)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB969897)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB972260)

Security Update for Windows Internet Explorer 8 (KB974455)

Security Update for Windows Internet Explorer 8 (KB976325)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 10 (KB911565)

Security Update for Windows Media Player 10 (KB917734)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Search 4 - KB963093

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951376)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953839)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165-v2)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Segoe UI

Setup

SmartSound Common Data

SmartSound Quicktracks 5

Spelling Dictionaries Support For Adobe Reader 9

Typing Tutor 7

United Devices Agent

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft Windows (KB971513)

Update for Windows Internet Explorer 8 (KB2362765)

Update for Windows Internet Explorer 8 (KB2447568)

Update for Windows Internet Explorer 8 (KB971930)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows Internet Explorer 8 (KB976749)

Update for Windows Internet Explorer 8 (KB980182)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676-v2)

Update for Windows XP (KB2641690)

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB961503)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Verizon Online

Verizon Online Support Center

Viewpoint Media Player

VMware Player

WebFldrs XP

Winbond HWDoctor

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage v1.3.0254.0

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 7

Windows Internet Explorer 8

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live Messenger

Windows Live Sign-in Assistant

Windows Live Upload Tool

Windows Management Framework Core

Windows Media Format 11 runtime

Windows Media Player 11

Windows Search 4.0

Windows XP Service Pack 3

.

==== Event Viewer Messages From Past Week ========

.

12/28/2011 7:56:10 PM, error: nv [6] - Parse Error on CMDCD 0000001e 00000000 00000000 00000000 00000000

12/28/2011 7:56:09 PM, error: nv [8] - Idle Timeout Error Channel 00000000

12/28/2011 7:53:10 PM, error: Service Control Manager [7016] - The BrSplService service has reported an invalid current state 0.

12/28/2011 7:05:11 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.117.1814.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7903.0 Error code: 0x80240022 Error description: The program can't check for definition updates.

12/28/2011 7:05:11 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.117.1814.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7903.0 Error code: 0x80240022 Error description: The program can't check for definition updates.

12/28/2011 5:38:36 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.117.1814.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7903.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

12/26/2011 5:34:28 PM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).

12/26/2011 5:34:28 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 12 service to connect.

12/26/2011 5:34:28 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Google Update Service (gupdate1c9b18d7ed92f3c) service to connect.

12/26/2011 5:34:28 PM, error: Service Control Manager [7000] - The Google Update Service (gupdate1c9b18d7ed92f3c) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

.

==== End Of File ===========================

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26

Run by Alan2 at 19:59:20 on 2011-12-28

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2015.1352 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\brss01a.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\VMware\VMware Player\hqtray.exe

svchost.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Roxio\BackOnTrack\App\SaibSVC.exe

C:\WINDOWS\System32\svchost.exe -k Akamai

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Roxio\BackOnTrack\App\BService.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\Program Files\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files\Brother\ControlCenter2\brctrcen.exe

C:\WINDOWS\system32\hasplms.exe

C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE

C:\Program Files\Roxio\CinePlayer\5.0\CPMonitor.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\PROGRA~1\SecCopy\SecCopy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe

C:\Documents and Settings\Alan2\Local Settings\Application Data\Akamai\netsession_win.exe

C:\Program Files\AboutTime\AboutTime.exe

C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

C:\Program Files\United Devices\UD.EXE

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\Alan2\Local Settings\Application Data\Akamai\netsession_win.exe

C:\Program Files\No-IP\DUC20.exe

C:\Program Files\Common Files\Rhozet\Carbon Coder\Kernel\PNXSERVR.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe

C:\WINDOWS\system32\vmnat.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\VMware\VMware Player\vmware-authd.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.baynews9.com/Klystron9.html

uInternet Connection Wizard,ShellNext = hxxp://localhost:2002/locallogin:ccd07d95-afd8789d-a94b2b41-5d47a941-78b5fa89-d384080c-cfaa60ea-0a155d73/default.html

uInternet Settings,ProxyOverride = *.local

mSearchAssistant = hxxp://www.google.com/ie

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [second Copy] "c:\progra~1\seccopy\SecCopy.exe"

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Akamai NetSession Interface] "c:\documents and settings\alan2\local settings\application data\akamai\netsession_win.exe"

mRun: [VMware hqtray] "c:\program files\vmware\vmware player\hqtray.exe"

mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [setDefPrt] c:\program files\brother\brmfl04g\BrStDvPt.exe

mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\13.0\sharedcom\RoxWatchTray13.exe"

mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe

mRun: [nwiz] nwiz.exe /install

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"

mRun: [Desktop Disc Tool] "c:\program files\roxio 2011\roxio burn\RoxioBurnLauncher.exe"

mRun: [ControlCenter2.0] c:\program files\brother\controlcenter2\brctrcen.exe /autorun

mRun: [Camera Detector] c:\progra~1\acdsys~1\acdsee\CAMDET~1.EXE

mRun: [CPMonitor] "c:\program files\roxio\cineplayer\5.0\CPMonitor.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

dRun: [ALUAlert] c:\program files\symantec\liveupdate\ALUNotify.exe

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\alan2\startm~1\programs\startup\no-ipd~1.lnk - c:\program files\no-ip\DUC20.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\shortc~1.lnk - c:\program files\abouttime\AboutTime.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\udagen~1.lnk - c:\program files\united devices\UD.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab

DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1133045456297

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37821.2591898148

DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100

Notify: LMIinit - LMIinit.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\alan2\application data\mozilla\firefox\profiles\lhu8spug.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.baynews9.com/Klystron9.html

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\autodesk\autodesk design review browser add-on v1.2\npADRdwf.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npRACtrl.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

.

============= SERVICES / DRIVERS ===============

.

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2011-5-11 21488]

R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2011-5-11 15856]

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 165648]

R1 MpKsl73eacc4d;MpKsl73eacc4d;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e2a7c383-b621-4696-821c-eed2b377c690}\MpKsl73eacc4d.sys [2011-12-28 29904]

R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [2011-5-11 25584]

R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\roxio\backontrack\app\SaibSVC.exe [2009-6-2 457200]

R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2002-8-29 14336]

R2 BOT4Service;BOT4Service;c:\program files\roxio\backontrack\app\BService.exe [2010-8-30 39408]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-7-7 55152]

R2 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe -run --> c:\windows\system32\hasplms.exe -run [?]

R2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2011-7-30 722616]

R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2011-1-27 374152]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-3-30 47640]

R2 Nexus Server;Nexus Server (Carbon Coder);c:\program files\common files\rhozet\carbon coder\kernel\PNXSERVR.exe [2010-2-12 753795]

S1 MpKsl25e32d4c;MpKsl25e32d4c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53bc480c-b496-48c3-8882-ea5b12b7086c}\mpksl25e32d4c.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53bc480c-b496-48c3-8882-ea5b12b7086c}\MpKsl25e32d4c.sys [?]

S1 MpKsl73ea1d11;MpKsl73ea1d11;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53bc480c-b496-48c3-8882-ea5b12b7086c}\mpksl73ea1d11.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53bc480c-b496-48c3-8882-ea5b12b7086c}\MpKsl73ea1d11.sys [?]

S1 MpKsl76b5da7a;MpKsl76b5da7a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f2df1cf0-6a6c-4f5a-806e-3a89d725e4b8}\mpksl76b5da7a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f2df1cf0-6a6c-4f5a-806e-3a89d725e4b8}\MpKsl76b5da7a.sys [?]

S1 MpKsle256bb1a;MpKsle256bb1a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f2df1cf0-6a6c-4f5a-806e-3a89d725e4b8}\mpksle256bb1a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f2df1cf0-6a6c-4f5a-806e-3a89d725e4b8}\MpKsle256bb1a.sys [?]

S1 MpKslfc5a0eb1;MpKslfc5a0eb1;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53bc480c-b496-48c3-8882-ea5b12b7086c}\mpkslfc5a0eb1.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53bc480c-b496-48c3-8882-ea5b12b7086c}\MpKslfc5a0eb1.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate1c9b18d7ed92f3c;Google Update Service (gupdate1c9b18d7ed92f3c);c:\program files\google\update\GoogleUpdate.exe [2009-3-30 133104]

S2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\common files\roxio shared\13.0\sharedcom\RoxWatch13.exe [2010-7-16 354288]

S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]

S3 RoxMediaDB13;RoxMediaDB13;c:\program files\common files\roxio shared\13.0\sharedcom\RoxMediaDB13.exe [2010-7-16 1099248]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2002-8-29 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

=============== File Associations ===============

.

JSEFile=NOTEPAD.EXE %1

VBEFile=NOTEPAD.EXE %1

VBSFile=NOTEPAD.EXE %1

.exe=8C

.

=============== Created Last 30 ================

.

2011-12-29 00:27:37 319488 ----a-w- c:\documents and settings\alan2\local settings\application data\fwp.exe

2011-12-29 00:23:28 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e2a7c383-b621-4696-821c-eed2b377c690}\MpKsl73eacc4d.sys

2011-12-29 00:23:11 56200 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e2a7c383-b621-4696-821c-eed2b377c690}\offreg.dll

2011-12-29 00:14:38 6823496 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e2a7c383-b621-4696-821c-eed2b377c690}\mpengine.dll

.

==================== Find3M ====================

.

2011-12-15 21:18:44 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-12 07:35:20 29696 ----a-w- c:\windows\system32\iolobtdfg.exe

2011-12-12 07:35:02 11776 ----a-w- c:\windows\system32\smrgdf.exe

2011-12-12 06:52:12 2083464 ----a-w- c:\windows\system32\Incinerator32.dll

2011-12-10 20:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys

2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec

2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll

2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll

2011-10-25 13:33:08 2192768 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-10-25 12:52:03 2069376 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-10-18 11:13:22 186880 ----a-w- c:\windows\system32\encdec.dll

2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll

.

============= FINISH: 20:01:08.67 ===============

[vtidtv]

Hi, Can someone let me know what I am doing wrong that is preventing my getting a reply and help? I truly appreciate the help.

[LDTate]

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Please run a new MBAM scan being sure to update before scanning.

Post the scan results

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste".

[vtidtv]

The primary problem right now appears to be the XP Antispyware 2012 nag screen and other messages. It has rewritten the messages in the Windows Security Center.

The computer has been shut off for the last several days.

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org

Database version: v2012.01.05.04

Windows XP Service Pack 3 x86 FAT

Internet Explorer 8.0.6001.18702

Alan2 :: ALAN-DESKTOP [administrator]

1/5/2012 4:46:19 PM

mbam-log-2012-01-05 (17-05-09).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 208802

Time elapsed: 6 minute(s), 55 second(s)

Memory Processes Detected: 1

C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe (Trojan.FakeAV) -> 2280 -> No action taken.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCR\AH (Rogue.MultipleAV) -> No action taken.

Registry Values Detected: 2

HKCR\.exe\shell\open\command| (Hijack.ExeFile) -> Data: "C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe" -a "%1" %* -> No action taken.

HKCR\ah|Content Type (Rogue.MultipleAV) -> Data: application/x-msdownload -> No action taken.

Registry Data Items Detected: 9

HKCR\.exe| (Hijacked.exeFile) -> Bad: (YWN) Good: (exefile) -> No action taken.

HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> No action taken.

HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> No action taken.

HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> No action taken.

HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKCR\scrfile\shell\open\command| (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> No action taken.

HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> No action taken.

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe (Trojan.FakeAV) -> No action taken.

(end)

[LDTate]

It shows No Action Taken, Did you remove them?

[vtidtv]

My mistake. I misunderstood. I removed the items and rebooted. Ran the MBAM again and it shows no viruses. I really appreciate your help!

Here is the results after first removing the viruses.

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org

Database version: v2012.01.05.04

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Alan2 :: ALAN-DESKTOP [administrator]

1/5/2012 4:46:19 PM

mbam-log-2012-01-05 (16-46-19).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 208802

Time elapsed: 6 minute(s), 55 second(s)

Memory Processes Detected: 1

C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe (Trojan.FakeAV) -> 2280 -> Delete on reboot.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCR\AH (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Registry Values Detected: 2

HKCR\.exe\shell\open\command| (Hijack.ExeFile) -> Data: "C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe" -a "%1" %* -> Quarantined and deleted successfully.

HKCR\ah|Content Type (Rogue.MultipleAV) -> Data: application/x-msdownload -> Quarantined and deleted successfully.

Registry Data Items Detected: 9

HKCR\.exe| (Hijacked.exeFile) -> Bad: (YWN) Good: (exefile) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKCR\scrfile\shell\open\command| (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and repaired successfully.

HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and repaired successfully.

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Documents and Settings\Alan2\Local Settings\Application Data\fwp.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.

(end)

[LDTate]

How's it running now?

[vtidtv]

It appears to be virus free at this time. I just updated MBAM this morning and I am running a full scan just to confirm. Thanks for your great help!

[LDTate]

Lets give it a day or two and let me know if you have anymore issues.

[vtidtv]

Larry,

I will keep a close watch on this PC. I did run MBAM this morning and had two hits. I run it again over the weekend.

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org

Database version: v2012.01.06.02

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Alan2 :: ALAN-DESKTOP [administrator]

1/6/2012 10:08:22 AM

mbam-log-2012-01-06 (10-08-22).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 316669

Time elapsed: 2 hour(s), 23 minute(s), 44 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 2

HKCR\scrfile\shell\open\command| (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and repaired successfully.

HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and repaired successfully.

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

[LDTate]

Not sure what that is.

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  
• Double click on ComboFix.exe & follow the prompts.
  Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
  Note: If you have XP SP3, use the XP SP2 package.
  If Vista or Windows 7, skip the Recovery Console part
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

[vtidtv]

Computer appears to be working normally. But I have not been using this PC on a regular basis since the infection.

ComboFix 12-01-06.03 - Alan2 01/07/2012 13:16:20.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2015.1311 [GMT -5:00]

Running from: c:\documents and settings\Alan2\My Documents\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\Alan2\WINDOWS

c:\documents and settings\All Users\Application Data\DirectCDUserNameE.txt

c:\documents and settings\All Users\Application Data\DirectCDUserNameF.txt

c:\documents and settings\Debbie\Application Data\ACD Systems\ACDSee\ImageDB.ddf

c:\documents and settings\Debbie\WINDOWS

c:\program files\driver

c:\windows\system32\cseDVH.dll

c:\windows\system32\msnphoto.scr

.

Infected copy of c:\windows\system32\hid.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\hid.dll

.

Infected copy of c:\windows\system32\midimap.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\midimap.dll

.

Infected copy of c:\windows\system32\dsound.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\dsound.dll

.

Infected copy of c:\windows\system32\rasauto.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\rasauto.dll

.

Infected copy of c:\windows\system32\qmgr.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\qmgr.dll

.

Infected copy of c:\windows\system32\netlogon.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\netlogon.dll

.

Infected copy of c:\windows\system32\scecli.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\scecli.dll

.

Infected copy of c:\windows\system32\srsvc.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\srsvc.dll

.

Infected copy of c:\windows\system32\comres.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\comres.dll

.

Infected copy of c:\windows\system32\lpk.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\lpk.dll

.

.

((((((((((((((((((((((((( Files Created from 2011-12-07 to 2012-01-07 )))))))))))))))))))))))))))))))

.

.

2012-01-07 18:28 . 2012-01-07 18:28 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{75AFFF28-2BC5-4FEC-8E45-9B43167843A3}\offreg.dll

2012-01-06 23:12 . 2011-11-21 10:47 6823496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{75AFFF28-2BC5-4FEC-8E45-9B43167843A3}\mpengine.dll

2011-12-28 22:38 . 2011-12-28 22:38 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-15 21:18 . 2011-06-02 13:53 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-12 07:35 . 2011-07-30 19:26 29696 ----a-w- c:\windows\system32\iolobtdfg.exe

2011-12-12 07:35 . 2011-07-30 19:26 11776 ----a-w- c:\windows\system32\smrgdf.exe

2011-12-12 06:52 . 2011-07-30 19:27 2083464 ----a-w- c:\windows\system32\Incinerator32.dll

2011-12-10 20:24 . 2011-01-17 20:08 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-23 13:25 . 2002-08-29 12:00 1859584 ----a-w- c:\windows\system32\win32k.sys

2011-11-21 10:47 . 2010-10-04 23:53 6823496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-11-04 19:20 . 2004-02-06 22:05 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 19:20 . 2002-08-29 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-04 19:20 . 2002-08-29 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-11-04 11:23 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec

2011-11-01 16:07 . 2004-04-28 11:50 1288704 ----a-w- c:\windows\system32\ole32.dll

2011-10-28 05:31 . 2002-08-29 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll

2011-10-25 13:33 . 2002-08-29 12:00 2192768 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-10-25 12:52 . 2002-08-29 01:04 2069376 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-10-18 11:13 . 2002-08-29 12:00 186880 ----a-w- c:\windows\system32\encdec.dll

2011-10-10 14:22 . 2004-06-07 18:19 692736 ----a-w- c:\windows\system32\inetcomm.dll

2007-08-06 16:07 . 2008-10-16 16:59 8784 -c--a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll

2007-07-18 18:54 . 2008-10-16 16:59 245408 -c--a-w- c:\program files\mozilla firefox\plugins\unicows.dll

2011-11-11 21:49 . 2011-06-22 13:30 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Second Copy"="c:\progra~1\SecCopy\SecCopy.exe" [2007-10-17 2425856]

"Akamai NetSession Interface"="c:\documents and settings\Alan2\Local Settings\Application Data\Akamai\netsession_win.exe" [2011-12-13 3305760]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VMware hqtray"="c:\program files\VMware\VMware Player\hqtray.exe" [2007-08-22 55856]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]

"SetDefPrt"="c:\program files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 49152]

"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe" [2010-07-16 307184]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]

"nwiz"="nwiz.exe" [2003-01-10 315392]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-01-10 4263936]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]

"Desktop Disc Tool"="c:\program files\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe" [2010-06-30 477680]

"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 864256]

"CPMonitor"="c:\program files\Roxio\CinePlayer\5.0\CPMonitor.exe" [2010-08-25 84464]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-19 421736]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

c:\documents and settings\Alan2\Start Menu\Programs\Startup\

No-IP DUC.lnk - c:\program files\No-IP\DUC20.exe [2009-6-15 1172992]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

Shortcut to AboutTime.lnk - c:\program files\AboutTime\AboutTime.exe [1999-11-19 282624]

UD Agent.lnk - c:\program files\United Devices\UD.EXE [2002-6-19 475648]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2011-01-26 21:20 87424 ----a-w- c:\windows\system32\LMIinit.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\AboutTime\\AboutTime.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Documents and Settings\\Alan2\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1947:TCP"= 1947:TCP:HASP SRM

"1947:UDP"= 1947:UDP:HASP SRM

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

"1058:TCP"= 1058:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

.

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [5/11/2011 5:32 AM 21488]

R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [5/11/2011 5:32 AM 15856]

R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [5/11/2011 5:32 AM 25584]

R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\App\SaibSVC.exe [6/2/2009 6:05 PM 457200]

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/29/2002 7:00 AM 14336]

R2 BOT4Service;BOT4Service;c:\program files\Roxio\BackOnTrack\App\BService.exe [8/30/2010 10:14 PM 39408]

R2 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe -run --> c:\windows\system32\hasplms.exe -run [?]

R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [7/30/2011 2:27 PM 722616]

R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [1/27/2011 6:13 PM 374152]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 5:46 PM 12856]

R2 Nexus Server;Nexus Server (Carbon Coder);c:\program files\Common Files\Rhozet\Carbon Coder\Kernel\PNXSERVR.exe [2/12/2010 4:51 PM 753795]

S1 MpKsl25e32d4c;MpKsl25e32d4c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53BC480C-B496-48C3-8882-EA5B12B7086C}\MpKsl25e32d4c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53BC480C-B496-48C3-8882-EA5B12B7086C}\MpKsl25e32d4c.sys [?]

S1 MpKsl73ea1d11;MpKsl73ea1d11;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53BC480C-B496-48C3-8882-EA5B12B7086C}\MpKsl73ea1d11.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53BC480C-B496-48C3-8882-EA5B12B7086C}\MpKsl73ea1d11.sys [?]

S1 MpKsl76b5da7a;MpKsl76b5da7a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F2DF1CF0-6A6C-4F5A-806E-3A89D725E4B8}\MpKsl76b5da7a.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F2DF1CF0-6A6C-4F5A-806E-3A89D725E4B8}\MpKsl76b5da7a.sys [?]

S1 MpKsle256bb1a;MpKsle256bb1a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F2DF1CF0-6A6C-4F5A-806E-3A89D725E4B8}\MpKsle256bb1a.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F2DF1CF0-6A6C-4F5A-806E-3A89D725E4B8}\MpKsle256bb1a.sys [?]

S1 MpKslfc5a0eb1;MpKslfc5a0eb1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53BC480C-B496-48C3-8882-EA5B12B7086C}\MpKslfc5a0eb1.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53BC480C-B496-48C3-8882-EA5B12B7086C}\MpKslfc5a0eb1.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 12:16 PM 130384]

S2 gupdate1c9b18d7ed92f3c;Google Update Service (gupdate1c9b18d7ed92f3c);c:\program files\Google\Update\GoogleUpdate.exe [3/30/2009 6:16 PM 133104]

S2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe [7/16/2010 5:48 AM 354288]

S3 RoxMediaDB13;RoxMediaDB13;c:\program files\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe [7/16/2010 5:48 AM 1099248]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/29/2002 7:00 AM 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 12:16 PM 753504]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ getPlusHelper

WINRM REG_MULTI_SZ WINRM

Akamai REG_MULTI_SZ Akamai

.

Contents of the 'Scheduled Tasks' folder

.

2011-12-27 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]

.

2012-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-30 23:15]

.

2012-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-30 23:15]

.

2012-01-07 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.baynews9.com/Klystron9.html

uInternet Connection Wizard,ShellNext = hxxp://localhost:2002/locallogin:ccd07d95-afd8789d-a94b2b41-5d47a941-78b5fa89-d384080c-cfaa60ea-0a155d73/default.html

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.0.1

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\Alan2\Application Data\Mozilla\Firefox\Profiles\lhu8spug.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.baynews9.com/Klystron9.html

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=

.

.

------- File Associations -------

.

JSEFile=NOTEPAD.EXE %1

.

- - - - ORPHANS REMOVED - - - -

.

HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-01-07 13:32

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_b427739.dll"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(656)

c:\windows\system32\LMIinit.dll

c:\windows\system32\LMIRfsClientNP.dll

.

- - - - - - - > 'explorer.exe'(3016)

c:\windows\system32\WININET.dll

c:\windows\system32\msi.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe

c:\windows\system32\brss01a.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\hasplms.exe

c:\windows\System32\nvsvc32.exe

c:\program files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe

c:\windows\system32\vmnat.exe

c:\program files\VMware\VMware Player\vmware-authd.exe

c:\windows\system32\vmnetdhcp.exe

c:\windows\system32\wscntfy.exe

c:\progra~1\ACDSYS~1\ACDSee\CAMDET~1.EXE

c:\windows\system32\SearchIndexer.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\SearchProtocolHost.exe

c:\windows\system32\SearchFilterHost.exe

.

**************************************************************************

.

Completion time: 2012-01-07 13:37:36 - machine was rebooted

ComboFix-quarantined-files.txt 2012-01-07 18:37

.

Pre-Run: 34,601,742,336 bytes free

Post-Run: 35,341,295,616 bytes free

.

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

.

- - End Of File - - A60442DE3C91669F72FD80833BDD360E

[LDTate]

Lets do this and give it another day or two.

Good job

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:

• Click START run
  
• Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.
  

For Vista / Windows 7

• Click START Search
  
• Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.
  

If you used DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

• The application window will appear
  
• Click the Re-enable button to re-enable your CD Emulation drivers
  
• Click Yes to continue
  
• A 'Finished!' message will appear
  
• Click OK
  
• DeFogger will now ask to reboot the machine - click OK
  

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Here's my usual all clean post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

Log looks good

• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
  (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
  Without a firewall your computer is succeptible to being hacked and taken over.
  I am very serious about this and see it happen almost every day with my clients.
  Simply using a Firewall in its default configuration can lower your risk greatly.
  
• Using a secure browser plugin M86 SecureBrowsing makes it safe to search, surf and socialize online. This free browser plug-in displays security icons next to links on search engines and social networking sites like Facebook, Twitter and LinkedIn, so you'll know which pages are safe and which ones to avoid.
  •Free browser plug-in for Internet Explorer and Firefox
  •Real-time safety ratings
  •Ideal for Facebook, Twitter and LinkedIn
  
• JAVA Click this link and click on the Free JAVA Download
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
  This will ensure your computer has always the latest security updates available installed on your computer.
  If there are new updates to install, install them immediately, reboot your computer, and revisit the site
  until there are no more critical updates.
  

Only run one Anti-Virus and Firewall program.

I would suggest you read:

PC Safety and Security--What Do I Need?.

How to Prevent Malware:

The full version of Malwarebytes' Anti-Malware could have helped protect your computer against this threat.

We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
  
• Malware Execution Prevention
  

Save yourself the hassle and get protected.

[vtidtv]

I'll keep checking it. Thanks for all your help!

[vtidtv]

Latest scan. Two items found.

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org

Database version: v2012.01.08.03

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Alan2 :: ALAN-DESKTOP [administrator]

1/8/2012 12:38:55 PM

mbam-log-2012-01-08 (12-38-55).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 312359

Time elapsed: 2 hour(s), 15 minute(s), 47 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 2

HKCR\scrfile\shell\open\command| (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and repaired successfully.

HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and repaired successfully.

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

[LDTate]

explanation by miekiemoes, Administrators at Malwarebytes

http://forums.malwarebytes.org/index.php?s=&showtopic=26336&view=findpost&p=144165

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!