Hijack THis log

[keeperofthenotes]

Here is my log. Could someone tell me how it looks as far as removing anything from it?

Thanks,

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 4:24:45 PM, on 5/16/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

C:\WINDOWS\system32\mfevtps.exe

C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe

C:\Program Files\Microsoft\BingBar\SeaPort.EXE

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe

C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\WINDOWS\system32\devldr32.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\msiexec.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.my.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110514163332.dll

O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)

O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe

O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe

O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://*.mcafee.com

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1268263428922

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe

O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Kodak AiO Network Discovery Service - Eastman Kodak Company - C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe

O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe

O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe

O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe

O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe

O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe

O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe (file missing)

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--

End of file - 10512 bytes

[screen317]

Hi and welcome to Malwarebytes.

Are you currently experiencing any symptoms of infection?

[keeperofthenotes]

I had just recovered my computer from a malware attack. This attack actually turned off my MBR so I couldn't F8 into safe mode.

Now that I have everything running again, at start up, on my desktop, I get a "winlogon.exe" missing from my Doucuments and Settings folder.

I go into that folder (although it is empty) and try to delete it but it says I don't have permissions. I am the admin!

I'd like to

1. Get rid of the "winlogon.exe" error

2. Get rid of a folder in documents and setting that is empty

Thanks,

[screen317]

Thank you for describing your issues.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

[keeperofthenotes]

Thank you for describing your issues.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

Here it is. .

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Doug at 17:59:02 on 2011-05-20

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.767.338 [GMT -4:00]

.

AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Firewall *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://att.my.yahoo.com/

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

uURLSearchHooks: H - No File

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll

uWinlogon: shell=explorer.exe "c:\documents and settings\doug.home\winlogon.exe

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110514163332.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn3\YTSingleInstance.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"

TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet

mRun: [EKIJ5000StatusMonitor] c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe

mRun: [ContentTransferWMDetector.exe] c:\program files\sony\content transfer\ContentTransferWMDetector.exe

mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Conime] %windir%\system32\conime.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

Trusted Zone: internet

Trusted Zone: intuit.com\ttlc

Trusted Zone: mcafee.com

DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1268263428922

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\doug.home\application data\mozilla\firefox\profiles\e4hn1boq.default\

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\program files\canon\mycamera download plugin\NPCIG.dll

FF - plugin: c:\program files\common files\motive\npMotive.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mcafee\supportability\mvt\NPMVTPlugin.dll

.

============= SERVICES / DRIVERS ===============

.

R? BBSvc;Bing Bar Update Service

R? mfendisk;McAfee Core NDIS Intermediate Filter

R? mferkdet;McAfee Inc. mferkdet

R? mferkdk;McAfee Inc. mferkdk

R? mfesmfk;McAfee Inc. mfesmfk

R? ptssvc;ptssvc

R? WinRM;Windows Remote Management (WS-Management)

S? cfwids;McAfee Inc. cfwids

S? Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service

S? McAfee SiteAdvisor Service;McAfee SiteAdvisor Service

S? McMPFSvc;McAfee Personal Firewall Service

S? McNaiAnn;McAfee VirusScan Announcer

S? McProxy;McAfee Proxy Service

S? McShield;McShield

S? mfeavfk;McAfee Inc. mfeavfk

S? mfebopk;McAfee Inc. mfebopk

S? mfefire;McAfee Firewall Core Service

S? mfefirek;McAfee Inc. mfefirek

S? mfehidk;McAfee Inc. mfehidk

S? mfendiskmp;mfendiskmp

S? mfetdi2k;McAfee Inc. mfetdi2k

S? mfevtp;McAfee Validation Trust Protection Service

S? PdiService;Portrait Displays SDK Service

.

=============== Created Last 30 ================

.

2011-05-17 20:58:53 -------- d-----w- c:\documents and settings\doug.home\local settings\application data\Temp

2011-05-17 19:43:10 -------- d-----w- c:\windows\system32\winrm

2011-05-17 19:43:04 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$

2011-05-16 20:24:11 388096 ----a-r- c:\documents and settings\doug.home\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe

2011-05-16 20:24:09 -------- d-----w- c:\program files\Trend Micro

2011-05-16 09:05:15 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll

2011-05-16 09:04:52 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll

2011-05-16 09:04:24 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2011-05-16 09:02:24 455936 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2011-05-16 09:01:53 718336 -c----w- c:\windows\system32\dllcache\ntdll.dll

2011-05-16 09:01:52 2148864 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2011-05-16 09:01:51 2192768 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe

2011-05-16 09:01:50 2069376 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe

2011-05-16 09:01:50 2027008 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2011-05-16 09:01:41 45568 -c----w- c:\windows\system32\dllcache\wab.exe

2011-05-16 09:00:32 590848 -c----w- c:\windows\system32\dllcache\rpcrt4.dll

2011-05-16 00:44:05 79872 -c----w- c:\windows\system32\dllcache\msxml6r.dll

2011-05-16 00:44:04 1372672 -c----w- c:\windows\system32\dllcache\msxml6.dll

2011-05-16 00:43:40 10752 ------w- c:\windows\system32\smtpapi.dll

2011-05-16 00:43:39 9728 ------w- c:\windows\system32\rwnh.dll

2011-05-16 00:43:30 19569 ----a-w- c:\windows\006459_.tmp

2011-05-16 00:06:56 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2011-05-16 00:06:56 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2011-05-16 00:06:55 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll

2011-05-16 00:06:55 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe

2011-05-16 00:06:54 445952 -c--a-w- c:\windows\system32\dllcache\ieapfltr.dll

2011-05-16 00:06:54 3698584 -c--a-w- c:\windows\system32\dllcache\ieapfltr.dat

2011-05-16 00:06:54 11080704 -c----w- c:\windows\system32\dllcache\ieframe.dll

2011-05-16 00:06:53 59904 -c--a-w- c:\windows\system32\dllcache\icardie.dll

2011-05-15 23:55:18 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe

2011-05-15 23:53:39 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll

2011-05-15 23:53:38 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll

2011-05-15 23:53:14 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2011-05-15 23:49:45 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

2011-05-15 23:48:47 2066432 -c----w- c:\windows\system32\dllcache\mstscax.dll

2011-05-15 23:46:44 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll

2011-05-15 23:46:44 284160 -c----w- c:\windows\system32\dllcache\pdh.dll

2011-05-15 23:46:43 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll

2011-05-15 23:46:43 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe

2011-05-15 23:46:43 110592 -c----w- c:\windows\system32\dllcache\services.exe

2011-05-15 23:46:42 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll

2011-05-15 23:46:42 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll

2011-05-15 23:46:07 218112 -c----w- c:\windows\system32\dllcache\wordpad.exe

2011-05-15 23:44:52 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll

2011-05-15 23:44:46 331776 -c----w- c:\windows\system32\dllcache\msadce.dll

2011-05-15 23:43:40 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys

2011-05-15 22:52:50 -------- d-----w- c:\windows\system32\wbem\repository.004\FS

2011-05-15 22:52:50 -------- d-----w- c:\windows\system32\wbem\Repository.004

2011-05-15 21:24:18 1082368 ----a-w- c:\windows\system32\esent.dll

2011-05-15 21:13:18 18944 ----a-w- c:\windows\system32\qmgrprxy.dll

2011-05-15 21:13:17 354816 ----a-w- c:\windows\system32\winhttp.dll

2011-05-15 21:08:10 217816 ----a-w- c:\windows\system32\wuaucpl.cpl

2011-05-15 17:50:59 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe

2011-05-15 17:49:59 132608 -c--a-w- c:\windows\system32\dllcache\fxsclntr.dll

2011-05-15 17:48:58 176640 ----a-w- c:\windows\system32\LXACSUI.DLL

2011-05-15 17:47:35 73728 -c--a-w- c:\windows\system32\dllcache\icwtutor.exe

2011-05-15 17:47:35 73728 ----a-w- c:\program files\internet explorer\connection wizard\icwtutor.exe

2011-05-15 17:47:35 61440 -c--a-w- c:\windows\system32\dllcache\icwres.dll

2011-05-15 17:47:35 61440 ----a-w- c:\program files\internet explorer\connection wizard\icwres.dll

2011-05-15 17:47:35 61440 ----a-w- c:\program files\internet explorer\connection wizard\icwconn.dll

2011-05-15 17:47:35 49152 ----a-w- c:\program files\internet explorer\connection wizard\icwutil.dll

2011-05-15 17:47:35 40960 -c--a-w- c:\windows\system32\dllcache\trialoc.dll

2011-05-15 17:47:35 40960 ----a-w- c:\program files\internet explorer\connection wizard\trialoc.dll

2011-05-15 17:47:35 24576 ----a-w- c:\program files\internet explorer\connection wizard\icwrmind.exe

2011-05-15 17:47:35 172032 ----a-w- c:\program files\internet explorer\connection wizard\icwhelp.dll

2011-05-15 17:40:58 19017 ----a-w- c:\windows\system32\drivers\RTL8029.sys

2011-05-15 17:39:33 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll

2011-05-15 17:39:33 24661 ----a-w- c:\windows\system32\spxcoins.dll

2011-05-15 17:39:33 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll

2011-05-15 17:39:33 13312 ----a-w- c:\windows\system32\irclass.dll

2011-05-15 17:39:17 13608 ----a-r- c:\windows\SET9A.tmp

2011-05-15 17:39:14 1086182 ----a-r- c:\windows\SET85.tmp

2011-05-15 15:35:59 69632 ----a-w- c:\windows\system32\msconf.dll

2011-05-15 15:34:50 68608 ----a-w- c:\windows\system32\access.cpl

2011-05-15 15:26:32 6272 ----a-w- c:\windows\system32\drivers\splitter.sys

2011-05-15 15:26:31 52864 ----a-w- c:\windows\system32\drivers\dmusic.sys

2011-05-15 15:25:56 57600 ----a-w- c:\windows\system32\drivers\redbook.sys

2011-05-15 15:25:23 4096 ----a-w- c:\windows\system32\ksuser.dll

2011-05-15 15:25:23 129536 ----a-w- c:\windows\system32\ksproxy.ax

2011-05-15 15:25:02 40840 ----a-w- c:\windows\system32\drivers\termdd.sys

2011-05-15 15:25:02 196224 ----a-w- c:\windows\system32\drivers\rdpdr.sys

2011-05-15 15:24:31 741376 ----a-w- c:\program files\common files\microsoft shared\speech\sapi.dll

2011-05-15 15:24:25 74752 ----a-w- c:\windows\system32\storprop.dll

2011-05-15 15:24:25 146432 ----a-w- c:\windows\system\winspool.drv

2011-05-15 15:24:25 11264 ----a-w- c:\windows\system32\drivers\irenum.sys

2011-05-15 15:24:12 13608 ----a-r- c:\windows\SET123.tmp

2011-05-15 15:24:09 1086182 ----a-r- c:\windows\SET10E.tmp

2011-05-08 07:29:00 -------- d-----w- c:\documents and settings\doug.home\application data\Blitware

2011-05-03 00:00:16 -------- d-----w- c:\program files\Driver Robot

2011-05-02 20:40:04 -------- d-----w- c:\documents and settings\doug.home\application data\DisplayTune

2011-05-02 20:36:49 7432 ----a-w- c:\windows\system32\Machnm32.sys

2011-05-02 20:36:49 67536 ----a-w- c:\windows\system32\WPFB.DLL

2011-05-02 20:36:49 11323 ----a-w- c:\windows\system32\drivers\pivotmou.sys

2011-05-02 20:36:48 17465 ----a-w- c:\windows\system32\drivers\pivot.sys

2011-05-02 20:36:44 -------- d-----w- c:\program files\Portrait Displays

2011-05-02 20:36:02 17136 ----a-w- c:\windows\system32\drivers\PdiPorts.sys

2011-05-01 17:40:49 -------- d-----w- c:\program files\Total Video Converter

2011-05-01 17:12:27 -------- d-----w- c:\program files\VideoLAN

2011-04-30 17:07:54 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll

2011-04-24 23:31:01 -------- d-----w- c:\documents and settings\doug.home\application data\Windows Search

2011-04-21 09:31:53 -------- d-----w- c:\documents and settings\doug.home\local settings\application data\Google

.

==================== Find3M ====================

.

2011-04-14 18:01:38 95824 ----a-w- c:\windows\system32\drivers\mfeapfk.sys

2011-04-14 18:01:38 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys

2011-04-14 18:01:38 88736 ----a-w- c:\windows\system32\drivers\mfendisk.sys

2011-04-14 18:01:38 84488 ----a-w- c:\windows\system32\drivers\mferkdet.sys

2011-04-14 18:01:38 84200 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys

2011-04-14 18:01:38 56064 ----a-w- c:\windows\system32\drivers\cfwids.sys

2011-04-14 18:01:38 52320 ----a-w- c:\windows\system32\drivers\mfebopk.sys

2011-04-14 18:01:38 387480 ----a-w- c:\windows\system32\drivers\mfehidk.sys

2011-04-14 18:01:38 314088 ----a-w- c:\windows\system32\drivers\mfefirek.sys

2011-04-14 18:01:38 153280 ----a-w- c:\windows\system32\drivers\mfeavfk.sys

2011-04-14 18:01:38 141792 ----a-w- c:\windows\system32\mfevtps.exe

2011-03-11 14:10:38 471552 ----a-w- c:\windows\apppatch\aclayers.dll

2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-04 06:37:06 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys

2011-02-22 23:06:29 916480 ----a-w- c:\windows\system32\wininet.dll

2011-02-22 23:06:29 43520 ------w- c:\windows\system32\licmgr10.dll

2011-02-22 23:06:29 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-02-22 11:41:59 385024 ------w- c:\windows\system32\html.iec

.

============= FINISH: 18:01:24.50 ===============

[screen317]

Hi,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!