Trojan.Agent or PWS:Win32/Zbot.gen!Y

[jg00d3]

I have run malwarebytes a dozen times and it keeps finding c:\windows\svchost.exe and I quarantine and reboot and it finds it again. I have ran combofix and it finds the same thing, I reboot and it finds it again. I ran DDS.scr and attached are the DDS.txt and Attach.txt. Please help. Thanks...

Attach.txt

DDS.txt

[jg00d3]

Here is a copy/paste of the attach.txt log:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 3/18/2011 8:22:55 PM

System Uptime: 11/1/2011 10:19:31 AM (0 hours ago)

.

Motherboard: Hewlett-Packard | | 1439

Processor: Intel® Core i3 CPU M 370 @ 2.40GHz | CPU | 2399/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 448 GiB total, 382.58 GiB free.

D: is FIXED (NTFS) - 17 GiB total, 2.463 GiB free.

E: is CDROM ()

F: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP190: 10/19/2011 8:29:19 AM - Windows Update

RP191: 10/21/2011 12:24:20 PM - Windows Update

RP192: 10/25/2011 8:11:23 AM - Windows Update

RP193: 10/25/2011 11:58:14 AM - Windows Update

RP194: 10/25/2011 11:59:01 AM - Windows Update

RP195: 10/25/2011 12:00:12 PM - Windows Update

RP196: 10/25/2011 12:01:30 PM - Windows Update

RP197: 10/26/2011 9:38:50 AM - Windows Update

RP198: 10/27/2011 10:17:29 AM - Windows Update

RP199: 10/29/2011 8:07:21 AM - Windows Update

RP200: 10/31/2011 9:48:10 AM - Windows Update

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

Acrobat.com

ActiveCheck component for HP Active Support Library

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Reader 9.3 MUI

Adobe Shockwave Player 11.5

Amsco Window Navigator

Bejeweled 2 Deluxe

Bing Bar Platform

Blackhawk Striker 2

Build-a-lot 2

Chuzzle Deluxe

CinemaNow Media Manager

CyberLink DVD Suite

CyberLink MediaShow

CyberLink PowerDVD 9

CyberLink YouCam

D3DX10

Diner Dash 2 Restaurant Rescue

Dora's Carnival Adventure

Driver Detective

Energy Star Digital Logo

Escape Rosecliff Island

ESU for Microsoft Windows 7

FATE

Final Drive Nitro

Google Chrome

Google Earth

Google Update Helper

Heroes of Hellas 2 - Olympia

Hewlett-Packard ACLM.NET v1.1.0.0

HP Advisor

HP Customer Experience Enhancements

HP Documentation

HP Game Console

HP Games

HP MediaSmart CinemaNow 2.0

HP Photo Creations

HP Power Manager

HP Product Detection

HP Quick Launch

HP Setup

HP Software Framework

HP Support Assistant

HPAsset component for HP Active Support Library

Intel® Control Center

Intel® Graphics Media Accelerator Driver

Intel® Management Engine Components

Intel® Rapid Storage Technology

Java Auto Updater

Java 6 Update 22

Jewel Quest 3

Jewel Quest Solitaire 2

Junk Mail filter update

LabelPrint

LightScribe System Software

Malwarebytes' Anti-Malware version 1.51.1.1800

Microsoft .NET Framework 1.1

Microsoft Default Manager

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft WSE 3.0 Runtime

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

NetSupport Manager

Norton Online Backup

Norton PC Checkup

Penguins!

PhotoNow!

Plants vs. Zombies

Poker Superstars III

Polar Bowler

Polar Golfer

Power2Go

PowerDirector

PS_AIO_05_C309_Software_Min

QuickBooks Pro 2007

QuickBooks Product Listing Service

Quotemaster uninstall

Quotemaster uninstall

Realtek Ethernet Controller Driver For Windows 7

Realtek High Definition Audio Driver

Realtek USB 2.0 Card Reader

Recovery Manager

Roxio CinemaNow 2.0

Scan

Security Update for 2007 Microsoft Office System (KB2288621)

Security Update for 2007 Microsoft Office System (KB2288931)

Security Update for 2007 Microsoft Office System (KB2345043)

Security Update for 2007 Microsoft Office System (KB2553074)

Security Update for 2007 Microsoft Office System (KB2553089)

Security Update for 2007 Microsoft Office System (KB2553090)

Security Update for 2007 Microsoft Office System (KB2584063)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft Office Excel 2007 (KB2553073)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office PowerPoint 2007 (KB2535818)

Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2344993)

SupportSoft Assisted Service

Toolbox

Update for 2007 Microsoft Office System (KB2284654)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 System (KB2539530)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 (KB980729)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 (KB2583910)

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update for Outlook 2007 Junk Email Filter (KB2596560)

Virtual Families

Virtual Villagers - The Secret City

VZAccess Manager

Wheel of Fortune 2

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Windsor Power Tools

WTS Paradigm Base Camp

Zuma Deluxe

.

==== Event Viewer Messages From Past Week ========

.

11/1/2011 9:36:09 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800031683fa, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 110111-20233-01.

11/1/2011 10:20:45 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPWMISVC service.

11/1/2011 10:20:27 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the LabTech Monitoring Service service to connect.

11/1/2011 10:20:27 AM, Error: Service Control Manager [7000] - The LabTech Monitoring Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

11/1/2011 10:19:52 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1005] - Unable to produce a minidump file from the full dump file.

11/1/2011 10:19:52 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800031c63fa, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: .

11/1/2011 10:18:01 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

11/1/2011 10:16:58 AM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

10/31/2011 9:30:55 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.115.712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7801.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

10/31/2011 9:20:42 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0

10/31/2011 2:45:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}

10/31/2011 2:41:56 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

10/31/2011 2:41:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

10/31/2011 2:41:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

10/31/2011 2:41:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

10/31/2011 2:41:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

10/31/2011 2:41:51 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

10/31/2011 2:41:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

10/31/2011 2:35:52 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache MpFilter NetBIOS NetBT nsiproxy PCISys Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

10/31/2011 2:35:52 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

10/31/2011 11:06:15 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

10/31/2011 10:42:50 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

10/28/2011 10:44:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.115.712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7801.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

10/28/2011 10:34:37 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

10/28/2011 10:34:11 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001, 0xfffff80002e66f95). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 102811-15288-01.

10/28/2011 10:32:36 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

10/28/2011 10:32:11 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800031be3fa, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 102811-22791-01.

10/28/2011 10:30:23 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

10/27/2011 8:50:02 AM, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.

10/27/2011 3:39:52 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

10/27/2011 11:04:35 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

10/25/2011 8:15:21 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002e61703, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 102511-23400-01.

10/25/2011 11:59:01 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242004: Realtek - Network - Realtek PCIe FE Family Controller.

10/25/2011 11:59:01 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242004: Microsoft - Other hardware - Microsoft Hardware USB Wireless Mouse.

10/25/2011 11:59:01 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242004: Microsoft - Other hardware - HID Non-User Input Data Filter (KB 911895).

.

==== End Of File ===========================

[jg00d3]

And here is the DDS.txt log:

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7600.16385

Run by mike at 10:21:33 on 2011-11-01

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3894.2278 [GMT -7:00]

.

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe

C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\LTSvc\LTTray.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\WTS Paradigm\BaseCamp\BaseCampService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

-netsvcs

C:\Windows\system32\conhost.exe

C:\Program Files (x86)\Windsor\WindsorPowerTools\ParadigmPlus.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\sysWOW64\wbem\wmiprvse.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\WUDFHost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.msn.com

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll

TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [WTSParadigmBaseCamp] C:\Program Files (x86)\WTS Paradigm\BaseCamp\BaseCampTray.exe

mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETWOR~1.LNK - C:\Windows\LTSvc\LTTray.exe

mPolicies-explorer: HideSCAHealth = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

mPolicies-system: SoftwareSASGeneration = 1 (0x1)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

TCP: DhcpNameServer = 192.168.2.1

TCP: Interfaces\{20D3FDEB-9176-4F3D-A927-3EADC07DAE6D} : DhcpNameServer = 192.168.2.1

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO-X64: Search Helper - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll

TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [WTSParadigmBaseCamp] C:\Program Files (x86)\WTS Paradigm\BaseCamp\BaseCampTray.exe

mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2011-2-19 98208]

R2 CinemaNow Service;CinemaNow Service;C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [2010-5-21 140272]

R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264]

R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-9 26680]

R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]

R2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe [2011-10-17 126392]

R2 WTS Paradigm Base Camp;WTS Paradigm Base Camp;C:\Program Files (x86)\WTS Paradigm\BaseCamp\BaseCampService.exe [2011-1-31 202752]

R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-11 136176]

S2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-6-18 103992]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-2-19 13336]

S2 LTService;LabTech Monitoring Service;C:\Windows\LTSvc\LTSVC.exe [2011-3-21 11143496]

S2 LTSvcMon;LabTech Monitoring Service CheckUp Util;C:\Windows\LTSvc\LTSvcMon.exe [2011-3-21 98632]

S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe [2011-10-17 123320]

S2 RtVOsdService;RtVOsdService Installer;C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [2010-6-17 315392]

S2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-2-19 2320920]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-11 136176]

S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]

S3 PTDUBus;PANTECH UM175 Composite Device Driver ;C:\Windows\system32\DRIVERS\PTDUBus.sys --> C:\Windows\system32\DRIVERS\PTDUBus.sys [?]

S3 PTDUMdm;PANTECH UM175 Drivers;C:\Windows\system32\DRIVERS\PTDUMdm.sys --> C:\Windows\system32\DRIVERS\PTDUMdm.sys [?]

S3 PTDUVsp;PANTECH UM175 Diagnostic Port;C:\Windows\system32\DRIVERS\PTDUVsp.sys --> C:\Windows\system32\DRIVERS\PTDUVsp.sys [?]

S3 PTDUWFLT;PTDUWWAN Filter Driver;C:\Windows\system32\DRIVERS\PTDUWFLT.sys --> C:\Windows\system32\DRIVERS\PTDUWFLT.sys [?]

S3 PTDUWWAN;PANTECH UM175 WWAN Driver;C:\Windows\system32\DRIVERS\PTDUWWAN.sys --> C:\Windows\system32\DRIVERS\PTDUWWAN.sys [?]

S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S3 SMSIVZAM5X64;SMSIVZAM5X64 NDIS Protocol Driver;C:\PROGRA~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64.SYS [2009-5-25 43032]

S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]

S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]

S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]

.

=============== File Associations ===============

.

inffile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1

VBEFile=%SystemRoot%\SysWow64\WScript.exe "%1" %*

VBSFile=%SystemRoot%\SysWow64\WScript.exe "%1" %*

.

=============== Created Last 30 ================

.

2011-11-01 17:21:14 -------- d-----w- C:\Users\mike\AppData\Local\{81BEB5D6-F7A7-47CB-9668-F1725456DE64}

2011-11-01 17:20:01 -------- d-sh--w- C:\$RECYCLE.BIN

2011-11-01 17:11:35 -------- d-----w- C:\ComboFix

2011-11-01 17:10:58 -------- d-----w- C:\Users\mike\AppData\Local\{1E2A9BB3-7F8E-4487-9E8A-6F469D626A62}

2011-10-31 22:52:24 -------- d-----w- C:\Users\mike\AppData\Local\{6103C276-97D6-4951-93D2-203DA4092C0E}

2011-10-31 22:52:14 -------- d-----w- C:\Users\mike\AppData\Local\{1C81FD7C-7C31-4D4F-9E35-BE4548008C86}

2011-10-31 22:46:02 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1A52F316-1ED5-4BB4-87C3-6F4CB24CAF46}\offreg.dll

2011-10-31 22:15:36 -------- d-----w- C:\Users\mike\AppData\Local\{BD88516F-358E-4BDB-AD7C-23B7527DFD59}

2011-10-31 22:15:26 -------- d-----w- C:\Users\mike\AppData\Local\{1A374A9E-6C54-488D-AECD-CCE53AF957E0}

2011-10-31 21:04:33 -------- d-----w- C:\Users\mike\AppData\Local\{DAB4D6AA-8346-4307-9BBF-774C3CC5475D}

2011-10-31 21:04:22 -------- d-----w- C:\Users\mike\AppData\Local\{CC85941A-5081-46B9-A3E5-021C263BE529}

2011-10-31 18:45:55 -------- d-----w- C:\Users\mike\AppData\Local\{09E4F0FD-E896-4D49-BD3D-16FCAD1995E0}

2011-10-31 18:45:44 -------- d-----w- C:\Users\mike\AppData\Local\{097F53D6-A652-4542-A6BD-A83F70344D63}

2011-10-31 18:43:10 -------- d-sh--w- C:\Windows\SysWow64\%USERPROFILE%

2011-10-31 18:22:55 98816 ----a-w- C:\Windows\sed.exe

2011-10-31 18:22:55 518144 ----a-w- C:\Windows\SWREG.exe

2011-10-31 18:22:55 256000 ----a-w- C:\Windows\PEV.exe

2011-10-31 18:22:55 208896 ----a-w- C:\Windows\MBR.exe

2011-10-31 18:07:59 -------- d-----w- C:\Users\mike\AppData\Local\{1561F850-7D70-4704-A75F-6CCFF80C8A31}

2011-10-31 18:07:47 -------- d-----w- C:\Users\mike\AppData\Local\{B56A35CC-DB85-4EC2-808A-62CED2CFAD71}

2011-10-31 17:45:59 -------- d-----w- C:\Users\mike\AppData\Local\{A76D9605-0715-4120-A2E7-64158DEB69EE}

2011-10-31 17:45:50 -------- d-----w- C:\Users\mike\AppData\Local\{99E109BB-2A99-488B-8622-E6193004C1A3}

2011-10-31 16:48:21 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1A52F316-1ED5-4BB4-87C3-6F4CB24CAF46}\mpengine.dll

2011-10-31 16:41:14 -------- d-----w- C:\Users\mike\AppData\Local\{BAD1F580-4537-4D97-B1BF-D7182287419B}

2011-10-31 16:39:38 -------- d-----w- C:\Users\mike\AppData\Local\{40D3AB55-79F4-462D-8E02-89F114F6ABC8}

2011-10-31 16:25:46 -------- d-----w- C:\Users\mike\AppData\Local\{B8748805-4C6A-40EC-A7B5-ABF371239373}

2011-10-29 05:36:21 -------- d-----w- C:\Users\mike\AppData\Local\{BD11D27B-21CD-488E-80E5-A8D76FD0E3F5}

2011-10-29 05:31:10 -------- d-----w- C:\Users\mike\AppData\Local\{49109291-8D01-4319-AF15-344467930ED2}

2011-10-27 22:44:06 -------- d-----w- C:\Users\mike\AppData\Local\{DCDF1FF2-3FC1-47F7-82F5-D51735EB51B8}

2011-10-27 18:05:30 -------- d-----w- C:\Users\mike\AppData\Local\{32168EE9-27C7-403A-B864-129F30248872}

2011-10-27 18:05:20 -------- d-----w- C:\Users\mike\AppData\Local\{47C9568C-89AD-4ECE-B153-4BECD33F1FA2}

2011-10-27 17:41:59 -------- d-----w- C:\Users\mike\AppData\Local\{63009A4D-4730-4CA9-B328-2F45523222BB}

2011-10-27 17:41:49 -------- d-----w- C:\Users\mike\AppData\Local\{026944A9-2F34-40FB-8CD3-58AE97D6C63A}

2011-10-27 17:07:07 -------- d-----w- C:\Users\mike\AppData\Local\{F5551A94-4F0B-4A8B-9689-5A8365E6C69C}

2011-10-27 17:06:47 -------- d-----w- C:\Users\mike\AppData\Local\{AF000745-B2E7-4A18-8A25-FF00B2FEE83D}

2011-10-27 15:30:59 -------- d-----w- C:\Users\mike\AppData\Local\{7CC4801B-4AB8-4D0D-AFAB-960D32EDAA2B}

2011-10-27 15:28:38 -------- d-----w- C:\Users\mike\AppData\Local\{391E8A75-258B-475B-94A2-E0EE55E00B3C}

2011-10-25 17:19:12 -------- d-----w- C:\Users\mike\AppData\Local\{56312CE4-CE75-48BD-A54B-F39429A546B3}

2011-10-25 17:19:00 -------- d-----w- C:\Users\mike\AppData\Local\{009541C8-9B9B-4675-AA3C-17DEAD686CDE}

2011-10-25 15:22:08 -------- d-----w- C:\Users\mike\AppData\Local\{1E92D33D-CDD1-4E92-A3B9-AEA132619AEB}

2011-10-25 15:21:43 -------- d-----w- C:\Users\mike\AppData\Local\{A523A28F-FBFA-403E-9803-E176F8DFE46C}

2011-10-25 15:05:31 -------- d-----w- C:\Users\mike\AppData\Local\{082D1782-93C0-404A-A80D-309715D6D8C1}

2011-10-25 15:05:20 -------- d-----w- C:\Users\mike\AppData\Local\{1646F49F-B58C-4B8F-BAC3-E3CC09AF5C09}

2011-10-24 19:41:17 -------- d-----w- C:\Users\mike\AppData\Roaming\Erc

2011-10-24 19:41:17 -------- d-----w- C:\Users\mike\AppData\Roaming\Ahfo

2011-10-24 14:38:54 -------- d-----w- C:\Users\mike\AppData\Local\{C291071A-6C14-447F-98C5-00B5526ABD49}

2011-10-21 19:15:25 -------- d-----w- C:\Users\mike\AppData\Local\{8CCB9E37-00E3-447A-9AA6-5324B3497D35}

2011-10-21 19:15:14 -------- d-----w- C:\Users\mike\AppData\Local\{17B19695-AE81-42C4-8856-F5B84AA8ED2B}

2011-10-21 15:04:30 -------- d-----w- C:\Users\mike\AppData\Local\{3F5CE741-9E87-4392-9FE0-510C7152660B}

2011-10-21 15:02:14 -------- d-----w- C:\Users\mike\AppData\Local\{AFFD661B-9FF0-4EF6-B042-D58E84354581}

2011-10-19 15:27:23 -------- d-----w- C:\Users\mike\AppData\Local\{47AFFF58-4FA9-4050-B27E-9197B99B4DA3}

2011-10-19 15:27:10 -------- d-----w- C:\Users\mike\AppData\Local\{9485A86E-F26A-4EB3-A7C1-058770EBB3CE}

2011-10-18 16:19:45 -------- d-----w- C:\Users\mike\AppData\Local\{E8E8323F-B2F0-42B1-BEAB-5EC3050F8B48}

2011-10-18 16:19:28 -------- d-----w- C:\Users\mike\AppData\Local\{CDB9E5CA-FCDA-448D-A1AE-3ECEBF38A086}

2011-10-17 23:36:40 -------- d-----w- C:\Users\mike\AppData\Roaming\Tific

2011-10-17 23:36:40 -------- d-----w- C:\Users\mike\AppData\Local\Tific

2011-10-17 23:36:31 -------- d-----w- C:\Windows\System32\drivers\NortonPCCheckupx64\02000C0.01B

2011-10-17 23:36:31 -------- d-----w- C:\Windows\System32\drivers\NortonPCCheckupx64

2011-10-17 23:36:31 -------- d-----w- C:\Program Files (x86)\Norton PC Checkup

2011-10-17 23:36:28 -------- d-----w- C:\Program Files (x86)\NortonInstaller

2011-10-17 23:22:37 -------- d-----w- C:\Users\mike\AppData\Local\{F02F626F-B884-4C57-9220-9FBF63657B53}

2011-10-17 23:22:13 -------- d-----w- C:\Users\mike\AppData\Local\{7268A46F-AD37-40FB-AF63-503E924E3C24}

2011-10-17 22:40:22 -------- d-----w- C:\Users\mike\AppData\Local\{10800EA4-C966-4FB0-A76B-B8772F6CE16F}

2011-10-17 22:26:47 -------- d-----w- C:\Program Files (x86)\Common Files\HP

2011-10-17 22:26:32 -------- d-----w- C:\Program Files (x86)\Common Files\Hewlett-Packard

2011-10-17 22:26:05 266752 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzpp696.dll

2011-10-17 22:26:00 131072 ----a-w- C:\Windows\System32\hpz3l696.dll

2011-10-17 22:24:53 338744 ----a-w- C:\Windows\System32\hpzids40.dll

2011-10-17 22:24:51 966656 ----a-w- C:\Windows\System32\hposwia_p02a.dll

2011-10-17 22:24:51 510464 ----a-w- C:\Windows\System32\hposc_p02a.dll

2011-10-17 22:24:51 1405952 ----a-w- C:\Windows\System32\hpost_p02a.dll

2011-10-17 21:58:37 -------- d-----w- C:\Program Files (x86)\HP

2011-10-17 21:44:05 -------- d--h--w- C:\ProgramData\UAB

2011-10-17 21:44:02 -------- d-----w- C:\Users\mike\AppData\Local\PC_Drivers_Headquarters

2011-10-17 21:43:54 -------- d--h--w- C:\ProgramData\PC Drivers HeadQuarters

2011-10-17 21:43:08 -------- d-----w- C:\Program Files (x86)\PC Drivers HeadQuarters

2011-10-17 20:58:49 258048 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\hpfppw73.dll

2011-10-17 20:34:49 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%

2011-10-17 20:25:22 -------- d-----w- C:\Users\mike\AppData\Local\{63354163-6F74-408F-8C16-1FE0FEBC3734}

2011-10-15 01:04:22 -------- d-----w- C:\Users\mike\AppData\Local\{02DBBE3D-2AA8-4D1C-A92E-3D36D99A135E}

2011-10-15 01:02:25 20480 ----a-w- C:\Windows\svchost.exe

2011-10-15 00:18:04 -------- d-----w- C:\Users\mike\AppData\Local\{C09ED68F-1F0B-4C9C-B206-F9D579BEC3FC}

2011-10-13 16:03:07 -------- d-----w- C:\Users\mike\AppData\Local\{766EF87A-AABC-47BF-B013-49552ABDEDA7}

2011-10-13 16:02:56 -------- d-----w- C:\Users\mike\AppData\Local\{2550FC5D-C4C3-4BCE-894A-F2918AB1F769}

2011-10-12 15:40:22 -------- d-----w- C:\Users\mike\AppData\Local\{801BB023-30BA-4B46-8DD5-F467B8B84373}

2011-10-12 15:40:07 -------- d-----w- C:\Users\mike\AppData\Local\{8D3E16A7-532C-4EB3-BB5E-CF16CD69AF50}

2011-10-11 19:39:12 3134976 ----a-w- C:\Windows\System32\win32k.sys

2011-10-11 19:23:40 917840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9F374AD5-CA0C-43B7-8751-46D2BEEF06D4}\gapaengine.dll

2011-10-11 15:01:58 -------- d-----w- C:\Users\mike\AppData\Local\{1059039A-9F57-4C7C-B1CC-5146F3E9F40E}

2011-10-11 15:01:47 -------- d-----w- C:\Users\mike\AppData\Local\{CD46F8CD-3633-45F2-8F3F-EAB303AA564B}

2011-10-10 19:11:22 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2011-10-10 19:11:22 2048 ----a-w- C:\Windows\System32\tzres.dll

2011-10-10 16:32:13 -------- d-----w- C:\Users\mike\AppData\Local\{27710339-C14B-4F00-BD26-3B7B780C424A}

2011-10-10 16:31:56 -------- d-----w- C:\Users\mike\AppData\Local\{D74B49D7-3104-4CA5-846F-5EC99E7F0319}

2011-10-07 14:33:49 -------- d-----w- C:\Users\mike\AppData\Local\{3D86131F-BC8C-4246-A1B3-5661F42B81A2}

2011-10-06 15:11:55 -------- d-----w- C:\Users\mike\AppData\Local\{3CD163D6-322E-486D-85D4-E9F249716FCA}

2011-10-06 15:11:44 -------- d-----w- C:\Users\mike\AppData\Local\{459202CC-F90B-4C4C-BC8A-ED9C8361EACB}

2011-10-05 14:46:22 -------- d-----w- C:\Users\mike\AppData\Local\{FC05D8E6-2814-4665-B124-BB1A471D8359}

2011-10-05 14:45:18 -------- d-----w- C:\Users\mike\AppData\Local\{64E73FAB-8856-49A2-A371-EBCDF60EFB4C}

2011-10-04 14:36:45 -------- d-----w- C:\Users\mike\AppData\Local\{B2598FDF-9370-4423-B57E-AF02EFC9AAEA}

2011-10-04 14:36:31 -------- d-----w- C:\Users\mike\AppData\Local\{A638EC07-3286-4DCC-BFE6-98DC8995B747}

2011-10-03 16:33:07 -------- d-----w- C:\Users\mike\AppData\Local\{617B7276-3168-4614-B8ED-B9C089FCD7A3}

.

==================== Find3M ====================

.

2011-10-01 03:21:20 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

2011-10-01 02:59:14 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-08-27 05:40:28 861184 ----a-w- C:\Windows\System32\oleaut32.dll

2011-08-27 05:40:28 331776 ----a-w- C:\Windows\System32\oleacc.dll

2011-08-27 04:43:07 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll

2011-08-27 04:43:06 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll

2011-08-20 05:45:20 1197568 ----a-w- C:\Windows\System32\wininet.dll

2011-08-20 05:41:16 57856 ----a-w- C:\Windows\System32\licmgr10.dll

2011-08-20 04:38:10 981504 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-08-20 04:35:20 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll

2011-08-20 04:20:23 482816 ----a-w- C:\Windows\System32\html.iec

2011-08-20 03:26:38 386048 ----a-w- C:\Windows\SysWow64\html.iec

2011-08-19 15:12:43 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-08-17 05:32:24 613888 ----a-w- C:\Windows\System32\psisdecd.dll

2011-08-17 05:27:46 75776 ----a-w- C:\Windows\System32\MSDvbNP.ax

2011-08-17 05:27:46 288256 ----a-w- C:\Windows\System32\MSNP.ax

2011-08-17 05:27:46 108032 ----a-w- C:\Windows\System32\psisrndr.ax

2011-08-17 05:27:46 104960 ----a-w- C:\Windows\System32\Mpeg2Data.ax

2011-08-17 04:26:02 465408 ----a-w- C:\Windows\SysWow64\psisdecd.dll

2011-08-17 04:22:23 75776 ----a-w- C:\Windows\SysWow64\psisrndr.ax

2011-08-17 04:22:23 72704 ----a-w- C:\Windows\SysWow64\Mpeg2Data.ax

2011-08-17 04:22:23 59904 ----a-w- C:\Windows\SysWow64\MSDvbNP.ax

2011-08-17 04:22:23 204288 ----a-w- C:\Windows\SysWow64\MSNP.ax

.

============= FINISH: 10:23:15.65 ===============

[jg00d3]

Am I doing something wrong w/ my post? It's been 24 hours and no replies, Malwarebytes can't remove this virus/trojan and I am about to format and reload, can anybody point me in the right direction?

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

[screen317]

Are you still with us? This topic will be closed in a few days if we do not hear back from you.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!