In other words, the action of disabling, then enabling system restore clears the restore folder? correct

0

When I run combofix, there was a point where it says "C:\WINDOWS\hosts" FINDSTR: Search string too long. SED: Couldn't flush stdout then two lines of "C"\Documents and Settings stuff" Rebooting Windows ... Please wait The system cannot find the path specified. Please allow ComboFix to Reboot your system The system hangs ... but now it has finally rebooted! yay! So, should i be concerned about the search string error? In any event, here are the combofix and hijack this logfiles ComboFix 07-10-19.1 - Steven Chang 2007-10-18 18:54:54.1 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.256 [GMT -4:00] Running from: C:\Documents and Settings\Steven Chang\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\#SharedObjects\BEE22YS9\www.broadcaster.com C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\#SharedObjects\BEE22YS9\www.broadcaster.com\played_list.sol C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\#SharedObjects\BEE22YS9\www.broadcaster.com\played_list.sol C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\#SharedObjects\BEE22YS9\www.broadcaster.com\played_list.sol C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\#SharedObjects\BEE22YS9\www.broadcaster.com\video_queue.sol C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\#SharedObjects\BEE22YS9\www.broadcaster.com\video_queue.sol C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\#SharedObjects\BEE22YS9\www.broadcaster.com\video_queue.sol C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\Documents and Settings\Steven Chang\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\WINDOWS\hosts . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\nm ((((((((((((((((((((((((( Files Created from 2007-09-19 to 2007-10-19 ))))))))))))))))))))))))))))))) . 2007-10-18 18:53 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-18 15:22 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-10-18 15:22 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-10-18 15:22 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-10-18 15:22 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-10-18 15:22 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-10-18 15:22 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-10-18 15:22 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-18 15:21 <DIR> d-------- C:\Program Files\Alwil Software 2007-10-18 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-10-17 02:34 225,509 --a------ C:\WINDOWS\system32\rayaftnig.exe 2007-10-13 12:30 <DIR> d-------- C:\Program Files\uTorrent 2007-10-13 12:30 <DIR> d-------- C:\Documents and Settings\Steven Chang\Application Data\uTorrent 2007-10-13 12:30 <DIR> d-------- C:\Documents and Settings\Steven Chang\Application Data\uTorrent 2007-10-13 12:30 <DIR> d-------- C:\Documents and Settings\Steven Chang\Application Data\uTorrent 2007-10-01 18:58 <DIR> d-------- C:\Program Files\iPod . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-18 06:07 --------- d-----w C:\Program Files\BitTorrent 2007-10-17 23:24 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\Skype 2007-10-17 23:24 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\Skype 2007-10-17 23:24 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\Skype 2007-10-16 14:35 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\BitTorrent 2007-10-16 14:35 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\BitTorrent 2007-10-16 14:35 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\BitTorrent 2007-10-13 16:43 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-06 17:55 --------- d-----w C:\Program Files\Norton AntiVirus 2007-10-04 04:14 --------- d-----w C:\Program Files\Lexmark X1100 Series 2007-10-03 22:15 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-10-03 22:15 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-10-03 22:15 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-10-03 22:15 --------- d-----w C:\Program Files\Symantec 2007-10-01 22:58 --------- d-----w C:\Program Files\iTunes 2007-10-01 21:47 --------- d-----w C:\Program Files\Java 2007-09-21 01:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2007-09-18 18:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat 2007-09-18 18:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat 2007-09-18 18:44 10,658 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat 2007-09-18 18:44 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf 2007-09-18 18:44 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf 2007-09-18 18:44 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf 2007-09-18 18:43 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys 2007-09-18 18:43 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys 2007-09-18 18:43 278,576 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys 2007-09-17 22:12 --------- d-----w C:\Program Files\QuickTime 2007-09-17 22:07 --------- d-----w C:\Program Files\Apple Software Update 2007-09-17 22:06 --------- d-----w C:\Program Files\Common Files\Apple 2007-09-17 22:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2007-08-30 06:00 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\DivX 2007-08-30 06:00 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\DivX 2007-08-30 06:00 --------- d-----w C:\Documents and Settings\Steven Chang\Application Data\DivX 2007-08-30 03:03 --------- d-----w C:\Program Files\Google 2007-08-30 03:03 --------- d-----w C:\Program Files\DivX 2007-02-15 19:01 25,408 -c--a-w C:\Documents and Settings\Steven Chang\Application Data\GDIPFONTCACHEV1.DAT 2007-02-15 19:01 25,408 -c--a-w C:\Documents and Settings\Steven Chang\Application Data\GDIPFONTCACHEV1.DAT 2007-02-15 19:01 25,408 -c--a-w C:\Documents and Settings\Steven Chang\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-07-11 00:10] "CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2004-06-14 08:00] "CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2004-08-19 21:14] "EzButton"="C:\Program Files\EzButton\EzButton.exe" [2004-05-13 22:29] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-10-30 04:46] "TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2004-03-14 23:17] "NDSTray.exe"="NDSTray.exe" [] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-07-20 04:04] "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-02-03 17:47] "LtMoh"="C:\\Program Files\\ltmoh\\Ltmoh.exe" [2003-09-26 18:43] "AGRSMMSG"="AGRSMMSG.exe" [2004-02-20 18:00 C:\WINDOWS\agrsmmsg.exe] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-08-09 15:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "USBPhoneforSkype"="C:\Program Files\USBPhoneforSkype\General\USBPhoneforSkype.exe" [2006-03-02 19:08] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59] "osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-05 21:22] "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 06:43] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 06:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 06:24] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-10-13 18:20] "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-23 23:47] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-07-28 06:43:40] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-07-28 06:43:40] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 01:01:04] RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2004-10-04 17:54:57] TabUserW.exe.lnk - C:\WINDOWS\system32\Wtablet\TabUserW.exe [2003-12-04 12:48:40] Windows Desktop Search.lnk - C:\Program Files\MSN Toolbar Suite\DS\[u]0[/u]2.05.0001.1119\en-ca\bin\WindowsSearch.exe [2005-09-20 18:10:04] R0 atiide;atiide;C:\WINDOWS\system32\DRIVERS\atiide.sys R1 SrvcEKIOMngr;SrvcEKIOMngr;C:\WINDOWS\system32\Drivers\EKIoMngr.sys R1 SrvcEPECioctl;SrvcEPECioctl;C:\WINDOWS\system32\Drivers\ECioctl.sys R1 SrvcEPIOMngr;SrvcEPIOMngr;C:\WINDOWS\system32\Drivers\EPIoMngr.sys R1 SrvcSSIOMngr;SrvcSSIOMngr;C:\WINDOWS\system32\Drivers\SSIoMngr.sys R1 SrvcTPIOMngr;SrvcTPIOMngr;C:\WINDOWS\system32\Drivers\TPIoMngr.sys R2 DgiVecp;Team MFP Comm Driver;C:\WINDOWS\system32\Drivers\DgiVecp.sys R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys R3 EPOWER;Compal E-POWER Driver;C:\WINDOWS\system32\Drivers\hkdrv.sys R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys R3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys S0 IFP700;iRiver Internet Audio Player IFP-700;C:\WINDOWS\system32\drivers\ifp700.sys S1 UdfReadr;UdfReadr;C:\WINDOWS\system32\drivers\UdfReadr.sys S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys S3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys S4 yg8wyyie8w;Print Spooler Service;C:\WINDOWS\system32\chnjjm.exe /service . Contents of the 'Scheduled Tasks' folder "2007-10-13 22:23:47 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" "2007-10-13 00:02:22 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Steven Chang.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-19 19:05:00 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-19 19:10:42 - machine was rebooted . --- E O F --- Logfile of HijackThis v1.99.1 Scan saved at 7:11:34 PM, on 19/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ACS.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe C:\Program Files\TOSHIBA\Power Management\CePMTray.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\TOSHIBA\TouchPad\TPTray.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe C:\Program Files\ltmoh\Ltmoh.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\USBPhoneforSkype\General\USBPhoneforSkype.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\RAMASST.exe C:\WINDOWS\system32\Wtablet\TabUserW.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.msu.edu:8080 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-ca\msntb.dll O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-ca\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe O4 - HKLM\..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [USBPhoneforSkype] C:\Program Files\USBPhoneforSkype\General\USBPhoneforSkype.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-ca\bin\WindowsSearch.exe O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-ca\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0A76211B-A2ED-4A88-A547-0527440E7642} (Install119 Control) - http://samsungdp.com/Install119.CAB O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/c... O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} - https://a248.e.akamai.net/f/248/5462/2h/www.symantecstore.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M... O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.exe O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe So, is this it? Am I done???

0

You are running two antivirus programs which is not a good idea as they will conflict. You should decide which one you want ot keep and uninstall the other. Update your java. Go to start> control panel> java> update> update now> uncheck/decline any google toolbar options. One update go to control panel> add/remove programs and unistall all the other java versions on the computer except for the jre1.6.0_03 version you just installed. Those older version are one way you could have been infected. How is the computer operating.

0

Thank you so much for all of your help. It's nice to know there are people willing to help out there. The computer is working great. No more attempts by my computer to send out spam emails. I will delete the other anti-virus stuff. Some of the other forums I was looking at in desperation suggested running two programs as a backup? And thanks for the tip on java ... i wasn't sure if you could delete the old installs or not. Again, thank you so much. You have brightened my outlook. I was gloomy and this has been weighing on me since Tuesday. A thousand thank yous. You are a wonderful person!

0

Glad we could help.

0

One last thing ... deleting the old java versions .. i didn't get a prompt about google toolbar (not really significant), but how do I know which version is the newest one? I don't see anything that says jre1.6.0_03, just Java TM 6 Update 2 and Java TM SE Runtime Environment 6 Update 1. I also have one that is related (it looks like) to statistical software that I use (SAS). Is it okay to delete that? I've deleted all the other javas. Thanks once again.

0

Those are older versions, I don't know about (SAS) so leave it. You must not have downloaded it or either it is waiting to be installed. If it was waiting to be installed there would be an icon in the systray (usually bottom right of the screen) orange in color (I think). Place the cursor on it if found, a box should pop up saying "ready to install" just double click it or click ok. If that is not the case download the update again.

0