CoreyFeldmanHero Posted March 24, 2011 ID:404116 Share Posted March 24, 2011 There are a couple threads with the same problem, but I didn't want to follow the fixes there if the problem didn't turn out to be identical.All virus scans run clean, but the Google redirect issue is still there. Here's HijackThis and a Malwarebytes scan (with current updates)Malwarebytes:Malwarebytes' Anti-Malware 1.50.1.1100www.malwarebytes.orgDatabase version: 6146Windows 5.1.2600 Service Pack 3Internet Explorer 7.0.5730.133/23/2011 8:54:51 PMmbam-log-2011-03-23 (20-54-51).txtScan type: Full scan (C:\|)Objects scanned: 271948Time elapsed: 22 minute(s), 10 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)HijackThis:Logfile of Trend Micro HijackThis v2.0.4Scan saved at 8:56:51 PM, on 3/23/2011Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.17091)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\WiFi\bin\S24EvMon.exeC:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exeC:\Program Files\Lavasoft\Ad-Aware\AAWService.exeC:\WINDOWS\system32\spoolsv.exec:\drivers\media\sthda_5.10.6257.0_d8553cd24557931bd6c69e1fbf4a39de\STacSV.exeC:\Program Files\LSI SoftModem\agrsmsvc.exec:\Program Files\BT Common Client\btomosrv.exeC:\WINDOWS\system32\CCM\CcmExec.exec:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\WINDOWS\system32\DWRCS.EXEC:\Program Files\Intel\WiFi\bin\EvtEng.exeC:\Program Files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exeC:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exeC:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exeC:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Microsoft Forefront\Client Security\Client\Microsoft Operations Manager 2005\MOMService.exeC:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeC:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exeC:\Documents and Settings\All Users\Application Data\Rpcnet\Bin\rpcld.exeC:\WINDOWS\system32\rpcnet.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\DWRCST.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Microsoft Office Communicator\communicator.exeC:\Program Files\Nuance\PDF Professional 6\pdfpro6hook.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\WINDOWS\system32\AESTFltr.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exeC:\Program Files\Intel\WiFi\bin\ZCfgSvc.exeC:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exeC:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exeC:\WINDOWS\system32\wbem\unsecapp.exeC:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exeC:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeC:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exeC:\Documents and Settings\86044\My Documents\Downloads\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.c-a-m.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.c-a-m.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.c-a-m.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by CameronO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDF Professional 6\Bin\PlusIEContextMenu.dllO2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO2 - BHO: ZeonIEEventHelper Class - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: Nuance PDF - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dllO4 - HKLM\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\communicator.exe" /fromrunkeyO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [PDFHook] C:\Program Files\Nuance\PDF Professional 6\pdfpro6hook.exeO4 - HKLM\..\Run: [PDF6 Registry Controller] C:\Program Files\Nuance\PDF Professional 6\RegistryController.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [snp2uvc] rundll32.exe C:\WINDOWS\system32\csnp2uvc.dll,ResetCIDSO4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlgO4 - HKLM\..\Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe /hiddenO4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /StartO4 - HKLM\..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hiddenO4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless TrayO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKLM\..\Run: [Microsoft Forefront Client Security Antimalware Service] "C:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe" -hideO4 - HKLM\..\Run: [DameWare MRC Agent] C:\WINDOWS\system32\DWRCST.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hiddenO4 - HKUS\S-1-5-18\..\Run: [iSUSPM] "C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [iSUSPM] "C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler (User 'Default user')O4 - S-1-5-18 Startup: IE7fix.vbs (User 'SYSTEM')O4 - .DEFAULT Startup: IE7fix.vbs (User 'Default user')O4 - .DEFAULT User Startup: IE7fix.vbs (User 'Default user')O4 - Global Startup: VPN Client.lnk = ?O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: Append the content of the link to existing PDF file - res://C:\Program Files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTMLO8 - Extra context menu item: Append the content of the selected links to existing PDF file - res://C:\Program Files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTMLO8 - Extra context menu item: Append to existing PDF file - res://C:\Program Files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTMLO8 - Extra context menu item: Create PDF file - res://C:\Program Files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTMLO8 - Extra context menu item: Create PDF file from the content of the link - res://C:\Program Files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTMLO8 - Extra context menu item: Create PDF files from the selected links - res://C:\Program Files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTMLO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O8 - Extra context menu item: Open with Nuance PDF Converter 6.0 - res://C:\Program Files\Nuance\PDF Professional 6\cnvres_eng.dll /100O8 - Extra context menu item: Open with PDF Professional 6 - res://C:\Program Files\Nuance\PDF Professional 6\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htmO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO15 - Trusted Zone: *.c-a-m.comO15 - Trusted Zone: *.cctrainer.comO15 - Trusted Zone: *.ccc.coopcam.comO15 - Trusted Zone: camclysm02.ccc.coopcam.comO15 - Trusted Zone: ccceqis01.ccc.coopcam.comO15 - Trusted Zone: *.ihs.comO15 - Trusted Zone: *.ihserc.comO15 - Trusted Zone: *.liveperson.netO15 - ESC Trusted Zone: http://runonce.msn.comO15 - ESC Trusted Zone: http://www.wise.comO16 - DPF: {0CE39AB9-27D9-4D58-9DC1-99405AFB86F4} (WMIRegistryDLL.WMIRegistry) - http://camccp.c-a-m.com/mypcinfo/bin/WMIRegistryDLL.CABO16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://atlvpn.c-a-m.com/CACHE/stc/2/binaries/vpnweb.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272314941921O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272399515171O16 - DPF: {C3CBFE35-9BE8-11D1-B31B-006008948294} (OrgPublisher PluginX) - http://www.aquire.com/codebase81/OrgPubX.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO16 - DPF: {EF55A67E-D9E4-4151-B026-1BE1B535ABFD} (ESDComputerName.ESDGetComputerName) - http://software.ccc.coopcam.com/ESD/ESDComputerName.CABO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ccc.coopcam.comO17 - HKLM\Software\..\Telephony: DomainName = ccc.coopcam.comO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ccc.coopcam.comO17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ccc.coopcam.comO18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO20 - AppInit_DLLs: c:\progra~1\citrix\system32\mfaphook.dllO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLLO22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dllO23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agrsmsvc.exeO23 - Service: BT Common Client - British Telecommunications Plc. - c:\Program Files\BT Common Client\btomosrv.exeO23 - Service: Citrix Diagnostic Facility COM Server (CdfSvc) - Citrix Systems, Inc. - C:\Program Files\Common Files\Citrix\System32\CdfSvc.exeO23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exeO23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - c:\Program Files\Cisco Systems\VPN Client\cvpnd.exeO23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\system32\DWRCS.EXEO23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exeO23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: HP Power Assistant Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exeO23 - Service: HP Wireless Assistant Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exeO23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeO23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeO23 - Service: Citrix Streaming Service (RadeSvc) - Citrix Systems, Inc. - C:\Program Files\Citrix\Streaming Client\RadeSvc.exeO23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exeO23 - Service: Remote Procedure Call (RPC) LD (rpcld) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Rpcnet\Bin\rpcld.exe (file missing)O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exeO23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exeO23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\drivers\media\sthda_5.10.6257.0_d8553cd24557931bd6c69e1fbf4a39de\STacSV.exeO23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe--End of file - 15727 bytes Link to post Share on other sites More sharing options...
Kenny94 Posted March 24, 2011 ID:404314 Share Posted March 24, 2011 Hi CoreyFeldmanHero and Welcome to Malwarebytes! HijackThis doesn't show a lot as with DDS:We need to look at some information about what is going on in your computer:Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pif[*]Double click on the DDS icon, allow it to run.[*]A small box will open, with an explanation about the tool. [*]When done, DDS will open two (2) logs 1. DDS.txt 2. Attach.txt[*] Save both reports to your desktop.[*] The instructions here ask you to attach the Attach.txt.[*]Instead of attaching, please copy/past both logs into your Thread[*]Close the program window, and delete the program from your desktop.Please note: You may have to disable any script protection running if the scan fails to run.After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HEREThen post your DDS (DDS.txt and Attach.txt NextPlease Download Rootkit Unhooker Save it to your desktop.extract RKUnhooker to your desktop Note** it is zipped up in a .rar file - If you do not have a program to unzip this type of file - you can get a free one from here - http://www.7-zip.org/Now double-click on RKUnhookerLE.exe to run it.Click the Report tab, then click Scan.Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.Wait till the scanner has finished and then click File, Save Report.Save the report somewhere where you can find it. Click Close.Copy the entire contents of the report and paste it in a reply here.Note** you may get this warning it is ok, just ignore "Rootkit Unhooker has detected a parasite inside itself!It is recommended to remove parasite, okay?" "just click on Cancel, then Accept".In your next reply, please include these log(s): 1.DDS.txt2.Attach.txt3.RKU log Link to post Share on other sites More sharing options...
CoreyFeldmanHero Posted March 24, 2011 Author ID:404333 Share Posted March 24, 2011 Thanks so much for your help Kenny! Here are the three logs:1. DDS.txt.DDS (Ver_11-03-05.01) - NTFSx86 Run by 86044 at 8:20:27.36 on Thu 03/24/2011Internet Explorer: 7.0.5730.13Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2998.1772 [GMT -5:00].AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}AV: Microsoft Forefront Client Security *Enabled/Outdated* {926A3D4F-E4E7-4F47-9902-4EDD55FFE1AF}.============== Running Processes ===============.C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MsMpEng.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\Program Files\Intel\WiFi\bin\S24EvMon.exesvchost.exesvchost.exeC:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exeC:\Program Files\Lavasoft\Ad-Aware\AAWService.exeC:\WINDOWS\system32\spoolsv.exec:\drivers\media\sthda_5.10.6257.0_d8553cd24557931bd6c69e1fbf4a39de\STacSV.exesvchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\LSI SoftModem\agrsmsvc.exec:\Program Files\BT Common Client\btomosrv.exeC:\WINDOWS\system32\rundll32.exeC:\WINDOWS\system32\CCM\CcmExec.exec:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\WINDOWS\system32\DWRCS.EXEC:\Program Files\Intel\WiFi\bin\EvtEng.exeC:\Program Files\Microsoft Office Communicator\communicator.exeC:\Program Files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exeC:\Program Files\Nuance\PDF Professional 6\pdfpro6hook.exeC:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\igfxpers.exeC:\WINDOWS\system32\igfxsrvc.exeC:\WINDOWS\system32\AESTFltr.exeC:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exeC:\Program Files\Intel\WiFi\bin\ZCfgSvc.exeC:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exeC:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exeC:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exeC:\WINDOWS\system32\DWRCST.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Microsoft Forefront\Client Security\Client\Microsoft Operations Manager 2005\MOMService.exeC:\WINDOWS\system32\wbem\unsecapp.exeC:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeC:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exeC:\Documents and Settings\All Users\Application Data\Rpcnet\Bin\rpcld.exeC:\WINDOWS\system32\rpcnet.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\msiexec.exeC:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exeC:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\DOCUME~1\86044\LOCALS~1\Temp\LogonApp.exeC:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeC:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\86044\My Documents\Downloads\dds.scr.============== Pseudo HJT Report ===============.uWindow Title = Windows Internet Explorer provided by CameronuStart Page = hxxp://intranet.c-a-m.comuDefault_Page_URL = hxxp://intranet.c-a-m.commDefault_Page_URL = hxxp://intranet.c-a-m.commWinlogon: Userinit=c:\windows\system32\userinit.exeBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: PlusIEEventHelper Class: {551a852f-39a6-44a7-9c13-afbec9185a9d} - c:\program files\nuance\pdf professional 6\bin\PlusIEContextMenu.dllBHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllBHO: ZeonIEEventHelper Class: {da986d7d-ccaf-47b2-84fe-bfa1549bebf9} - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllTB: Nuance PDF: {e3286bf1-e654-42ff-b4a6-5e111731df6b} - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dlluRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hiddenmRun: [Communicator] "c:\program files\microsoft office communicator\communicator.exe" /fromrunkeymRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"mRun: [PDFHook] c:\program files\nuance\pdf professional 6\pdfpro6hook.exemRun: [PDF6 Registry Controller] c:\program files\nuance\pdf professional 6\RegistryController.exemRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottimemRun: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exemRun: [igfxTray] c:\windows\system32\igfxtray.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [Persistence] c:\windows\system32\igfxpers.exemRun: [snp2uvc] rundll32.exe c:\windows\system32\csnp2uvc.dll,ResetCIDSmRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlgmRun: [HPPowerAssistant] c:\program files\hewlett-packard\hp power assistant\HPPA_Main.exe /hiddenmRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /StartmRun: [HPWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\delayedappstarter.exe 120 c:\program files\hewlett-packard\hp wireless assistant\HPWA_Main.exe /hiddenmRun: [intelZeroConfig] "c:\program files\intel\wifi\bin\ZCfgSvc.exe"mRun: [intelWireless] "c:\program files\common files\intel\wirelesscommon\iFrmewrk.exe" /tf Intel Wireless TraymRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [Microsoft Forefront Client Security Antimalware Service] "c:\program files\microsoft forefront\client security\client\antimalware\MSASCui.exe" -hidemRun: [DameWare MRC Agent] c:\windows\system32\DWRCST.exedRun: [iSUSPM] "c:\documents and settings\all users\application data\macrovision\flexnet connect\6\ISUSPM.exe" -schedulerdRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -tStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{21e247d4-5e27-4bea-aa4d-19a81203fe2a}\Icon3E5562ED7.icouPolicies-explorer: DisallowRun = 1 (0x1)uPolicies-disallowrun: 1 = av.exeIE: Append the content of the link to existing PDF file - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIEAppend.HTMLIE: Append the content of the selected links to existing PDF file - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTMLIE: Append to existing PDF file - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIEAppend.HTMLIE: Create PDF file - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIECapture.HTMLIE: Create PDF file from the content of the link - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIECapture.HTMLIE: Create PDF files from the selected links - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTMLIE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000IE: Open with Nuance PDF Converter 6.0 - c:\program files\nuance\pdf professional 6\cnvres_eng.dll /100IE: Open with PDF Professional 6 - c:\program files\nuance\pdf professional 6\bin\PlusIEContextMenu.dll/PlusIEContextMenu.htmIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dllIE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLLTrusted Zone: c-a-m.comTrusted Zone: cctrainer.comTrusted Zone: coopcam.com\*.cccTrusted Zone: coopcam.com\camclysm02.cccTrusted Zone: coopcam.com\ccceqis01.cccTrusted Zone: google.com\mapsTrusted Zone: ihs.comTrusted Zone: ihserc.comTrusted Zone: liveperson.netDPF: {0CE39AB9-27D9-4D58-9DC1-99405AFB86F4} - hxxp://camccp.c-a-m.com/mypcinfo/bin/WMIRegistryDLL.CABDPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cabDPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://atlvpn.c-a-m.com/CACHE/stc/2/binaries/vpnweb.cabDPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272314941921DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272399515171DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cabDPF: {C3CBFE35-9BE8-11D1-B31B-006008948294} - hxxp://www.aquire.com/codebase81/OrgPubX.cabDPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cabDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabDPF: {EF55A67E-D9E4-4151-B026-1BE1B535ABFD} - hxxp://software.ccc.coopcam.com/ESD/ESDComputerName.CABHandler: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files\sap\frontend\sapgui\SAPHTMLP.DLLHandler: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files\sap\frontend\sapgui\SAPHTMLP.DLLHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLLNotify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLLNotify: igfxcui - igfxdev.dllAppInit_DLLs: c:\progra~1\citrix\system32\mfaphook.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllSEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLLmASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe".================= FIREFOX ===================.FF - ProfilePath - c:\docume~1\86044\applic~1\mozilla\firefox\profiles\gto6am7r.default\FF - prefs.js: browser.startup.homepage - hxxp://intranet.c-a-m.com/FF - prefs.js: network.proxy.type - 0FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dllFF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dllFF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dllFF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dllFF - plugin: c:\program files\nuance\pdf professional 6\bin\nppdf.dllFF - plugin: c:\program files\nuance\pdf professional 6\bin\nppdf.dllFF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtensionFF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ffFF - Ext: XULRunner: {039A5A4D-99B5-4467-9184-BC5DF7B806D2} - c:\documents and settings\86044\local settings\application data\{039A5A4D-99B5-4467-9184-BC5DF7B806D2}FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}.============= SERVICES / DRIVERS ===============.R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-3-17 64512]R1 cdfdrv;cdfdrv;c:\windows\system32\drivers\cdfdrv.sys [2008-7-27 27672]R1 dwvkbd;DameWare Virtual Keyboard 32 bit Driver;c:\windows\system32\drivers\dwvkbd.sys [2007-2-15 26624]R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]R2 BT Common Client;BT Common Client;c:\program files\bt common client\btomosrv.exe [2007-7-3 61440]R2 ctxpidmn;ctxpidmn;c:\windows\system32\drivers\ctxpidmn.sys [2008-8-16 22808]R2 CtxSbx;CtxSbx;c:\windows\system32\drivers\CtxSbx.sys [2008-8-16 185880]R2 FCSAM;Microsoft Forefront Client Security Antimalware Service;c:\program files\microsoft forefront\client security\client\antimalware\MsMpEng.exe [2009-9-3 16880]R2 FcsSas;Microsoft Forefront Client Security State Assessment Service;c:\program files\microsoft forefront\client security\client\ssa\FcsSas.exe [2007-4-6 73120]R2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\hewlett-packard\hp power assistant\HPPA_Service.exe [2009-12-16 102968]R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\hewlett-packard\hp wireless assistant\HPWA_Service.exe [2010-1-27 102968]R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-3-16 1405384]R2 MOM;MOM;c:\program files\microsoft forefront\client security\client\microsoft operations manager 2005\MOMService.exe [2005-7-21 134656]R2 RadeSvc;Citrix Streaming Service;c:\program files\citrix\streaming client\RadeSvc.exe [2008-8-16 398656]R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]R2 rpcld;Remote Procedure Call (RPC) LD;c:\documents and settings\all users\application data\rpcnet\bin\rpcld.exe --> c:\documents and settings\all users\application data\rpcnet\bin\rpcld.exe [?]R2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\cisco\cisco anyconnect vpn client\vpnagent.exe [2009-12-17 497856]R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2010-10-29 113664]R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2010-10-29 227896]R3 DwMirror;DwMirror;c:\windows\system32\drivers\DamewareMini.sys [2007-2-7 3712]R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [2010-4-26 166568]R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2010-10-29 44800]R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-10-29 125696]R3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [2010-10-29 205824]R3 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-3-23 69616]R3 rismc32;RICOH Smart Card Reader;c:\windows\system32\drivers\rismc32.sys [2010-10-29 49152]S0 mjlnju;mjlnju;c:\windows\system32\drivers\sschmsm.sys --> c:\windows\system32\drivers\sschmsm.sys [?]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-12-3 136176]S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336].=============== Created Last 30 ================.2011-03-23 18:19:25 69616 ----a-w- c:\windows\system32\drivers\MpFilter.sys2011-03-22 18:22:29 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-03-22 18:22:27 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2011-03-22 18:18:25 -------- d-----w- c:\program files\CCleaner2011-03-22 15:27:29 -------- d-sh--w- C:\$RECYCLE.BIN2011-03-18 15:08:46 -------- d-----w- c:\program files\ESET2011-03-18 14:18:27 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com2011-03-18 14:18:27 -------- d-----w- c:\docume~1\86044\applic~1\SUPERAntiSpyware.com2011-03-18 14:18:18 -------- d-----w- c:\program files\SUPERAntiSpyware2011-03-18 13:19:58 -------- d-----w- c:\docume~1\86044\applic~1\Malwarebytes2011-03-18 13:19:52 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes2011-03-18 13:19:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-03-18 01:55:24 16432 ----a-w- c:\windows\system32\lsdelete.exe2011-03-18 01:45:44 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys2011-03-18 01:45:41 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys2011-03-18 01:44:13 -------- d-----w- c:\docume~1\86044\locals~1\applic~1\Sunbelt Software2011-03-18 01:35:16 -------- dc-h--w- c:\docume~1\alluse~1\applic~1\{870E601A-FE70-4098-94B2-6E9963FCAA51}2011-03-18 01:35:01 -------- d-----w- c:\program files\Lavasoft2011-03-17 23:33:59 -------- d-----w- c:\docume~1\86044\locals~1\applic~1\{039A5A4D-99B5-4467-9184-BC5DF7B806D2}2011-03-17 23:33:10 117248 --sha-r- c:\windows\system32\ntdsbclin.dll.==================== Find3M ====================.2011-03-24 13:13:02 17920 ----a-w- c:\windows\system32\rpcnetp.exe2011-03-24 13:12:58 17920 ----a-w- c:\windows\system32\rpcnetp.dll2011-03-24 13:12:57 52848 ----a-w- c:\windows\system32\rpcnet.dll2009-07-12 12:24:50 626688 ----a-w- c:\program files\common files\sapconsaccess.dll2009-07-12 12:24:50 40960 ----a-w- c:\program files\common files\DigitalSignature.ocx2009-07-12 12:24:50 3145728 ----a-w- c:\program files\common files\sapxlhelper.dll2009-07-12 12:24:50 192512 ----a-w- c:\program files\common files\sapconsr3.dll.============= FINISH: 8:20:49.72 ===============2. Attach.txt.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_11-03-05.01).Microsoft Windows XP ProfessionalBoot Device: \Device\HarddiskVolume1Install Date: 10/29/2010 8:49:00 PMSystem Uptime: 3/24/2011 8:11:31 AM (0 hours ago).Motherboard: Hewlett-Packard | | 172AProcessor: Intel Pentium II processor | CPU 1 | 2393/133mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 233 GiB total, 214.43 GiB free.D: is CDROM ()I: is NetworkDisk (NTFS) - 2167 GiB total, 177.438 GiB free.M: is NetworkDisk (NTFS) - 262 GiB total, 18.4 GiB free.R: is NetworkDisk (NTFS) - 224 GiB total, 72.494 GiB free.S: is NetworkDisk (NTFS) - 224 GiB total, 72.494 GiB free.T: is NetworkDisk (NTFS) - 224 GiB total, 72.494 GiB free..==== Disabled Device Manager Items =============.Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}Description: Cisco Systems VPN AdapterDevice ID: ROOT\NET\0000Manufacturer: Cisco SystemsName: Cisco Systems VPN AdapterPNP Device ID: ROOT\NET\0000Service: CVirtA.Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}Description: Cisco AnyConnect VPN Virtual Miniport Adapter for WindowsDevice ID: ROOT\NET\0001Manufacturer: Cisco SystemsName: Cisco AnyConnect VPN Virtual Miniport Adapter for WindowsPNP Device ID: ROOT\NET\0001Service: vpnva.==== System Restore Points ===================.RP1: 3/17/2011 6:59:28 PM - System CheckpointRP2: 3/22/2011 2:26:48 PM - System CheckpointRP3: 3/23/2011 12:13:51 PM - Software Distribution Service 3.0RP4: 3/23/2011 1:14:38 PM - Removed Microsoft Forefront Client Security Antimalware ServiceRP5: 3/23/2011 1:15:02 PM - Removed Microsoft Forefront Client Security State Assessment Service.==== Installed Programs ======================.2007 Microsoft Office Suite Service Pack 2 (SP2)Active Directory Management Pack Helper ObjectAd-AwareAdobe Flash Player 10 ActiveXAdobe Flash Player 10 PluginAdobe Reader 9.4.2Adobe Shockwave Player 11.5Apple Application SupportBlackBerry Desktop Software 6.0BootstrapperCCleanerCisco AnyConnect VPN ClientCisco Systems VPN Client 5.0.06.0160Citrix XenApp Plugin for Streamed AppsCitrix XenApp Web PluginConfiguration Manager ClientCutePDF Writer 2.7DameWare Development Mirror Driver UninstallESET Online Scanner v3Fonts_Frutiger_1.0Google Earth Plug-inGoogle Update HelperHotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)Hotfix for Windows Media Format 11 SDK (KB929399)Hotfix for Windows Media Player 11 (KB939683)Hotfix for Windows XP (KB2158563)Hotfix for Windows XP (KB942288-v3)Hotfix for Windows XP (KB949764)Hotfix for Windows XP (KB952287)Hotfix for Windows XP (KB953955)Hotfix for Windows XP (KB954550-v5)Hotfix for Windows XP (KB961118)Hotfix for Windows XP (KB969084)Hotfix for Windows XP (KB969238)Hotfix for Windows XP (KB979306)HP ESU for Microsoft Windows XPHP Power AssistantHP Power DataHP Quick Launch ButtonsHP Web CameraHP WebcamHP Wireless AssistantiGrafx 2011Intel PROSet WirelessIntel® Graphics Media Accelerator DriverIntel® Network Connections DriversIntel® PROSet/Wireless WiFi SoftwareInterVideo WinDVD 8Java 6 Update 16LightScribe System SoftwareLSI HDA ModemMalwarebytes' Anti-MalwareMicrosoft .NET Framework 1.1Microsoft .NET Framework 1.1 Security Update (KB2416447)Microsoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5 SP1Microsoft Base Smart Card Cryptographic Service Provider PackageMicrosoft Compression Client Pack 1.0 for Windows XPMicrosoft Conferencing Add-in for Microsoft Office OutlookMicrosoft Forefront Client Security Antimalware ServiceMicrosoft Forefront Client Security State Assessment ServiceMicrosoft Internationalized Domain Names Mitigation APIsMicrosoft Kernel-Mode Driver Framework Feature Pack 1.9Microsoft National Language Support Downlevel APIsMicrosoft Office Access MUI (English) 2007Microsoft Office Access Setup Metadata MUI (English) 2007Microsoft Office Communicator 2007 R2Microsoft Office Excel MUI (English) 2007Microsoft Office InfoPath MUI (English) 2007Microsoft Office Live Meeting 2007Microsoft Office OneNote 2007Microsoft Office OneNote MUI (English) 2007Microsoft Office Outlook MUI (English) 2007Microsoft Office PowerPoint MUI (English) 2007Microsoft Office Professional Plus 2007Microsoft Office Proof (English) 2007Microsoft Office Proof (French) 2007Microsoft Office Proof (Spanish) 2007Microsoft Office Proofing (English) 2007Microsoft Office Publisher MUI (English) 2007Microsoft Office Shared MUI (English) 2007Microsoft Office Shared Setup Metadata MUI (English) 2007Microsoft Office Visio 2007 Service Pack 2 (SP2)Microsoft Office Visio MUI (English) 2007Microsoft Office Visio Standard 2007Microsoft Office Word MUI (English) 2007Microsoft Operations Manager 2005 AgentMicrosoft Outlook Personal Folders BackupMicrosoft redistributable runtime DLLs VS2005 SP1(x86)Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programsMicrosoft SilverlightMicrosoft Software Update for Web Folders (English) 12Microsoft User-Mode Driver Framework Feature Pack 1.0Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053Microsoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17Microsoft WinUsb 1.0MinitabMinitab 16Minitab Software Update ManagerMinitab16MobileXpress clientMozilla Firefox (3.6.13)MSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)MSXML4.0 redistributableNuance PDF Professional 6OGA Notifier 2.0.0048.0psqlODBCQLBCASLQuickTimeRDCSAP Business ExplorerSAP GUI 7.10Scansoft PDF ProfessionalSecurity Update for 2007 Microsoft Office System (KB969559)Security Update for 2007 Microsoft Office System (KB976321)Security Update for 2007 Microsoft Office System (KB978380)Security Update for CAPICOM (KB931906)Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)Security Update for Microsoft Office Excel 2007 (KB978382)Security Update for Microsoft Office Outlook 2007 (KB972363)Security Update for Microsoft Office PowerPoint 2007 (KB957789)Security Update for Microsoft Office Publisher 2007 (KB980470)Security Update for Microsoft Office system 2007 (972581)Security Update for Microsoft Office system 2007 (KB969613)Security Update for Microsoft Office system 2007 (KB974234)Security Update for Microsoft Office Visio Viewer 2007 (KB973709)Security Update for Windows Internet Explorer 7 (KB2360131)Security Update for Windows Internet Explorer 7 (KB938127-v2)Security Update for Windows Media Player (KB2378111)Security Update for Windows Media Player (KB952069)Security Update for Windows Media Player (KB954155)Security Update for Windows Media Player (KB968816)Security Update for Windows Media Player (KB973540)Security Update for Windows Media Player (KB975558)Security Update for Windows Media Player (KB978695)Security Update for Windows Media Player 11 (KB954154)Security Update for Windows XP (KB2079403)Security Update for Windows XP (KB2115168)Security Update for Windows XP (KB2121546)Security Update for Windows XP (KB2229593)Security Update for Windows XP (KB2259922)Security Update for Windows XP (KB2279986)Security Update for Windows XP (KB2286198)Security Update for Windows XP (KB2296011)Security Update for Windows XP (KB2347290)Security Update for Windows XP (KB2360937)Security Update for Windows XP (KB923561)Security Update for Windows XP (KB923789)Security Update for Windows XP (KB941569)Security Update for Windows XP (KB946648)Security Update for Windows XP (KB950760)Security Update for Windows XP (KB950762)Security Update for Windows XP (KB950974)Security Update for Windows XP (KB951066)Security Update for Windows XP (KB951376-v2)Security Update for Windows XP (KB951748)Security Update for Windows XP (KB952004)Security Update for Windows XP (KB952954)Security Update for Windows XP (KB954459)Security Update for Windows XP (KB955069)Security Update for Windows XP (KB956572)Security Update for Windows XP (KB956744)Security Update for Windows XP (KB956802)Security Update for Windows XP (KB956803)Security Update for Windows XP (KB956844)Security Update for Windows XP (KB958644)Security Update for Windows XP (KB958869)Security Update for Windows XP (KB959426)Security Update for Windows XP (KB960225)Security Update for Windows XP (KB960803)Security Update for Windows XP (KB960859)Security Update for Windows XP (KB961501)Security Update for Windows XP (KB969059)Security Update for Windows XP (KB969947)Security Update for Windows XP (KB970238)Security Update for Windows XP (KB970430)Security Update for Windows XP (KB971468)Security Update for Windows XP (KB971657)Security Update for Windows XP (KB971961)Security Update for Windows XP (KB972270)Security Update for Windows XP (KB973354)Security Update for Windows XP (KB973507)Security Update for Windows XP (KB973869)Security Update for Windows XP (KB973904)Security Update for Windows XP (KB974112)Security Update for Windows XP (KB974318)Security Update for Windows XP (KB974392)Security Update for Windows XP (KB974571)Security Update for Windows XP (KB975025)Security Update for Windows XP (KB975467)Security Update for Windows XP (KB975560)Security Update for Windows XP (KB975561)Security Update for Windows XP (KB975562)Security Update for Windows XP (KB975713)Security Update for Windows XP (KB977816)Security Update for Windows XP (KB977914)Security Update for Windows XP (KB978037)Security Update for Windows XP (KB978262)Security Update for Windows XP (KB978338)Security Update for Windows XP (KB978542)Security Update for Windows XP (KB978601)Security Update for Windows XP (KB978706)Security Update for Windows XP (KB979309)Security Update for Windows XP (KB979683)Security Update for Windows XP (KB979687)Security Update for Windows XP (KB980232)Security Update for Windows XP (KB980436)Security Update for Windows XP (KB981322)Security Update for Windows XP (KB981349)Security Update for Windows XP (KB981852)Security Update for Windows XP (KB981997)Security Update for Windows XP (KB982132)Security Update for Windows XP (KB982214)Security Update for Windows XP (KB982665)SkillSoft Course ManagerSkype ToolbarsSkype Link to post Share on other sites More sharing options...
Kenny94 Posted March 24, 2011 ID:404346 Share Posted March 24, 2011 Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.---------------------------------------------------------------------------------------------Please download DeFogger to your desktop.Double click DeFogger to run the tool. The application window will appear Click the Disable button to disable your CD Emulation drivers Click Yes to continue A 'Finished!' message will appear Click OK DeFogger will now ask to reboot the machine - click OKIMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.Do not re-enable these drivers until otherwise instructed.Next Download ComboFix from below:Combofix download* IMPORTANT !!! Place combofix.exe on your DesktopDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.You can get help on disabling your protection programs hereDouble click on combofix.exe & follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:The Recovery Console was successfully installed.Click on Yes, to continue scanning for malware.Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next replyNote:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.---------------------------------------------------------------------------------------------Ensure your AntiVirus and AntiSpyware applications are re-enabled.--------------------------------------------------------------------------------------------- Link to post Share on other sites More sharing options...
LDTate Posted April 7, 2011 ID:412748 Share Posted April 7, 2011 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts