Trojan returns with every new scan

dchen · February 22, 2009

Many thanks for providing MalwareBytes! I got the "google redirect" problem; installed malwarebytes; and was able to fix my original problem. On subsequent rescans, I notice about 250 new items every time. After quarantine and deletion it seems the file names have changed slightly each time. Attached are the logs...

hijackthis.log

==========

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:26:45 AM, on 2/22/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe

C:\WINDOWS\system32\ntvdm.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slashdot.org/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125076715015

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1220192943387

O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--

End of file - 8639 bytes

mbam-log-2009-02-22 (09-42-09).txt

=============================

Malwarebytes' Anti-Malware 1.34

Database version: 1792

Windows 5.1.2600 Service Pack 3

2/22/2009 9:42:09 AM

mbam-log-2009-02-22 (09-42-09).txt

Scan type: Full Scan (C:\|)

Objects scanned: 215677

Time elapsed: 1 hour(s), 7 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 254

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock v2.32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Presentation Wizard v2.0.24a.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Presto Transfer My Photos 1.7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prey iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PrimalScript 4 Professional.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia - The Two Thrones.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia The Two Thrones 3RIPS Technic KPS RFG.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\#1 Video Converter 3.8.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\.C.A.R. Squadra Corse Alfa Romeo 2005.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\007 - Live And Let Die ( 1973 ).exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\007 Live and Let Die.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1 Click DVD COPY 5.0.1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1 DVD Ripper v5.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\100 Hojdare S01E06 PDTV XViD SWEDiSH SQC 3246813....exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Business.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Rtm En Nl.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Unveiled.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP 9 In 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Gold Edition 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Password Administrator 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Pro SP2 OEM Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional Corporate SP2 Octob.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional SP2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP SP3 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.70.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.64.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyStopper Pro v4.0A.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Detector Enterprise v2.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 3.5.0.478.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 3.8.0.2582 for Windows.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2603Latest Build.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2621 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v.4.0.0.2613.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v3.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v4.0.02602.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor ver.5.0.0.179.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Die Hard.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Anarchy Texture v2.0 For Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor v4.5.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Camera Media Studio 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Film Tools EZ Mask v1.01 for Adobe Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1Click DVD Copy Pro 1.x.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\2 Fiddy MP3 Alarm Pro 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\3D Live Pool v2.64.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\A Secret Handshake 2007 DVDRip XviD-VoMiT.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Acronis True Image 9.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Acrobat 3D v8.1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Photoshop 8 cs with cracks by lestercity12.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Advanced RAR Repair v1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Agnitum Outpost Firewall Pro v3.5.738..exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Hackman Hex Editor 9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Life 2 Collectors Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Life 2 iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Nelson 2006 DVDRip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 - Digital Zone (ISO), Half-Life 2 Valve.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 Episode One iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup 4.6.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup v.5.4.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Hannibal Rising 2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Happy Feet 2006 FS DVDRip XviD-LRC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trillian 3 Pro Alpha 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trillian Pro 3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover 6.4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover v. 6.5.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover ver.6.5.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\True Crime New York City CLONEDVD-PLEX.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\True Launch Bar v2.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Auto Power-on and Shut-down 1.44.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Auto USdownloder.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AutoCAD AutoCAD LT All-in-One Desk Reference For Du.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk 3D Studio MAX 9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Alias Studio Tools v13.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Autocad 2007 Professional.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk AutoCAD v.2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Inventor Professional v11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Maya v8.5 - 64 Bits.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Revit Structure 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AutoDWG DWGSee 2006 v1.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Automate unDRM DRM is cracked.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Automize 7.02 Enterprise.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Automize Enterprise v7.06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AutoPatcher for Windows XP SP 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 9.64 final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 v9.64.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2007 v10.10.06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Powerdesk Pro 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerDVD 7 NO Activation or Keygen or Sno..exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Powerful Cookies v1.0.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerISO v.3.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer 5.7.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v.6.2.0.1254.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v6.3.0.2132.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio Personal Firewall v.4.3.268.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WinAVI Video Converter V. 7.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WinBackup Professional v2.1.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WinBoost 4.46.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Window Builder Pro v5.0.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds 5 Build 49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds 5.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds v5.02 Golden.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Windows 2003 - Tiny Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Extra Drive Creator Professional 7.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Extreme Chickfights 2006 DVDRip Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Extreme Movie Manager Pro v4.4.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\EZ Extract Resource v1.82.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\EZ Soft MP3 CD Ripper v1.71b1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\EZB Systems EasyBoot 5.1.0.565.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\F-Secure Anti-Virus Client Security v5.55.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R First Encounter Assault Recon.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R. First Encounter Assault and Recon iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Aibase-CS v1.199c.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO - Coffee Cup Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO ASTROLOGICAL SOFT.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO DVD X Studios.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO Mobile Phone Unlocker.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO Recovery 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO total security PC 2006 NEW.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Air Assault Task Force iSO PC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rock Manager.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa 2007 DVDRip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rocky II.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rogue Remover v1.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\RollerCoaster Tycoon 3 Wild.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rome Season 2 Episode 10 HDTV.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Romeo And Juliet Sealed With A Kiss.DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Room 6 2006 DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Charm DVD To Real Converter v5.9.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Charm Real Converter Pro v5.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Chat Watch 4.49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\CheckMail v.3.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Nvidia DVD Player New.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA Gelato v2.0 R1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA PureVideo Decoder v1 02 233.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\O DIA DA PROVA

AdvancedSetup · February 23, 2009

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

When we're done you can go back and install the latest version but for now please do not install any.

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java

Then run the following tool

CCleaner

CCleaner
Double-click on the downloaded file "ccsetup216.exe" and install the application.
Keep the default installation folder "C:\Program Files\CCleaner"
Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
Click finish when done and close ALL PROGRAMS
Start the CCleaner program.
Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
Click on Run Cleaner button on the bottom right side of the program.
Click OK to any prompts

Then run this tool

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

dchen · February 24, 2009

Ran all programs as suggested--took about 2 hours to do. Posting logs ...

Thanks for the help!

-dchen

=====================

ComboFix 09-02-21.01 - david 2009-02-23 22:50:14.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.245 [GMT -5:00]

Running from: c:\documents and settings\david\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\winupdates

c:\program files\winupdates\a.zip

c:\windows\IE4 Error Log.txt

c:\windows\system32\bszip.dll

c:\windows\system32\taskkill.exe

.

((((((((((((((((((((((((( Files Created from 2009-01-24 to 2009-02-24 )))))))))))))))))))))))))))))))

.

2009-02-23 22:22 . 2009-02-23 22:22 <DIR> d-------- c:\program files\CCleaner

2009-02-22 10:26 . 2009-02-22 10:26 <DIR> d-------- c:\program files\Trend Micro

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\david\Application Data\Malwarebytes

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-02-20 23:15 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-20 23:15 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-02-20 20:11 . 2009-02-20 20:11 0 --a------ c:\windows\system32\drivers\nfr.dll.gpref

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-24 03:26 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-02-21 02:25 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-01-17 00:46 --------- d-----w c:\program files\Google

2008-12-29 03:52 --------- d-----w c:\documents and settings\david\Application Data\U3

2008-12-27 20:01 --------- d--h--w c:\program files\InstallShield Installation Information

2008-12-27 20:01 --------- d-----w c:\program files\Canon

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-12-27 106496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"nwiz"=nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"80:TCP"= 80:TCP:nfr

"7070:TCP"= 7070:TCP:nfr

R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]

R2 hypervisor;Parallels Hypervisor;c:\windows\system32\drivers\hypervisor.sys [2007-09-16 51200]

R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]

R2 PRLDHCP;Parallels DHCP Service for Virtual NIC;c:\program files\Parallels\Parallels Workstation\PRLDHCP.exe [2007-09-16 32768]

R2 pvs;Parallels Kernel Driver;c:\windows\system32\drivers\pvs.sys [2007-09-16 28480]

R2 pvsnet;Parallels Network Driver;c:\windows\system32\drivers\pvsnet.sys [2007-09-25 12310]

R2 pvspth;Parallels Passthrough Driver;c:\windows\system32\drivers\pvspth.sys [2007-09-16 13344]

R2 pvsum;Parallels USB Manager;c:\windows\system32\drivers\PvsUM.sys [2007-09-16 8320]

R3 PVSVNIC;Parallels Virtual NIC Driver;c:\windows\system32\drivers\pvsvnic.sys [2007-09-16 4412]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{076b156f-b8d1-11dc-a89e-000123456789}]

\Shell\Auto\command - E:\winsys2.exe

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL winsys2.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://slashdot.org/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

FF - ProfilePath - c:\documents and settings\david\Application Data\Mozilla\Firefox\Profiles\2wdke8oe.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-23 22:56:30

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2009-02-23 23:01:42

ComboFix-quarantined-files.txt 2009-02-24 04:00:42

Pre-Run: 31,987,781,632 bytes free

Post-Run: 34,698,899,456 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

123 --- E O F --- 2009-02-11 08:03:24

========================

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:16:44 PM, on 2/23/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows NT\Accessories\wordpad.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\explorer.exe