Google Redirect Virus

Microelectronic inc / POWER SPEC
December 29, 2008 at 20:16:37
Specs: Windows XP, AMD AthlonXP2600+ 2.13ghz
My wife has picked up the Google redirect virus on her computer. Please let me know what steps I must take to remove it. Thank you in advance.


See More: Google Redirect Virus

Report •


#1
December 30, 2008 at 05:18:52
why don't you run antispyware scan? it is the easiest way to deal with this kind of infections.

i know you gonna say you can't download any antispyware because you get redirected. BUT you can download antispyware on another computer and put the install on a thumbdrive or cd and bring it to the infected machine. just make sure you download free antispyware otherwise you won't be able to remove anything. i recommend malwarebyte's antimalware, you can download it at their official website: malwarebytes anti-malware


Report •

#2
December 30, 2008 at 07:48:47
I have run several malware programs including Malwarebytes and they have not solved the problem. They now come back clean and the problem still exists.

Report •

#3
December 30, 2008 at 16:47:00
First try this as it should temporarily stop the redirecting:

Click on Start, click Run, and then type devmgmt.msc and click OK
On the View menu click on Show hidden devices
Browse to Non-Plug and Play Drivers and click the + sign to the left, you should see something like TDSSserv.sys in that list.
Highlight that driver and right click on it and select DISABLE - NOT uninstall.
Now RESTART your computer.

We need the Malware bytes log you ran to help determine which version of the baddie you have. Click the Malwarebytes icon on your desktop, logs tab> double click the first scan you made and post it if you have it.

Please download and install the latest version of HijackThis v2.0.2:


Download the "HijackThis" Installer from this link:
Hijack This


1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

If it will not run rename the Hijack This.exe file to somethingelse.exe and try installing it again.


Report •

Related Solutions

#4
December 30, 2008 at 17:05:39
looks like I ran 2 Malewarebytes scans on 12/17 - both are posted below along with Hijack this at the bottom:

Malwarebytes' Anti-Malware 1.31
Database version: 1512
Windows 5.1.2600 Service Pack 3

12/17/2008 9:20:47 PM
mbam-log-2008-12-17 (21-20-47).txt

Scan type: Quick Scan
Objects scanned: 27434
Time elapsed: 16 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 33
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\retro64_loader.r64loader (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\retro64_loader.r64loader.1 (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{014da6c4-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{014da6c6-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{450b9e4d-4014-4de3-b34e-014a81468293} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{288c5f13-7e52-4ada-a32e-f5bf9d125f99} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c7f00a9a-f1bc-436e-82c7-e8cae6fd67f7} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ca356d79-679b-4b4c-8e49-5af97014f4c1} (Adware.Starware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{288c5f13-7e52-4ada-a32e-f5bf9d125f99} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{288c5f13-7e52-4ada-a32e-f5bf9d125f99} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features\9ee2330ae5f4470cac801baac83818c9 (Adware.Zango) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Scan 2:

Malwarebytes' Anti-Malware 1.31
Database version: 1512
Windows 5.1.2600 Service Pack 3

12/17/2008 10:24:44 PM
mbam-log-2008-12-17 (22-24-44).txt

Scan type: Quick Scan
Objects scanned: 108543
Time elapsed: 1 hour(s), 1 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 12
Files Infected: 25

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\zango 10.0.341.0 (Adware.Zango) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.
C:\Program Files\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Troy Johnson\Local Settings\Temporary Internet Files\Content.IE5\HUZ7DK4O\._file[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History\search2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache\01C6005D.jpg (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache\01C63400.jpg (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache\01C639BD.jpg (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache\01C64390.jpg (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache\01C64843.jpg (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\070F02E8.urr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\0710E053.urr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\f3wallpp.bmp (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\wrkparam.lst (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\01C4991C.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\094420D4.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\8C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\8E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\A3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\A5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\AD.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\RECYCLER\ADAPT_Installer.exe (Heuristics.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Troy Johnson\Local Settings\Temp\TDSS9426.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Troy Johnson\Local Settings\Temp\TDSS954f.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSqiyk.dll (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSwghd.log (Trojan.TDSS) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:53 PM, on 12/29/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Garmin\ANT Agent\ANT Agent.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Troy Johnson\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPHUPD08] C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ANT Agent] C:\Garmin\ANT Agent\ANT Agent.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [E07AXLRD_24361296] "C:\Program Files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE" -m
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - S-1-5-18 Startup: Microsoft Office Outlook 2003.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: Microsoft Office Outlook 2003.lnk = ? (User 'Default user')
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/active...
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/Onlin...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso...
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eo...
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://download.shockwave.com/pub/o...
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/h...
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewo...
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yah...
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/...
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g...
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/pl...
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://real.gamehouse.com/games/cin...
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/ac...
O16 - DPF: {E6EB803E-DD89-11D3-80C4-0050DA2E09D0} (LightSurfUploadCtl Class) - http://picturecenter.kodak.com/acti...
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--


Report •

#5
December 30, 2008 at 17:39:16
Once you get SDFix downloaded go offline, turn off your Nortons antivirus, and turn off any antispyware that you have, run SDFix from safe mode and restart the Antivirus before you get back on line to post the log.

Download SDFix.exe and save it to your Desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Remember to re-enable the protection again afterwards before connecting to the Internet.

1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
2. Open the c:\SDFix folder and double click RunThis.cmd to start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
3. Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt


Report •

#6
December 30, 2008 at 18:53:15
here is the SDFIX log:

[b]SDFix: Version 1.240 [/b]
Run on Tue 12/30/2008 at 08:10 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found


Removing Temp Files

[b]ADS Check [/b]:


[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-30 20:31:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:


Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Tue 25 Jan 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 9 Apr 2007 53 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti53D.tmp"
Fri 8 Feb 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 18 Jan 2008 400 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg"
Fri 18 Jan 2008 403 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg"
Fri 28 Nov 2003 1,206 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\ccReg.reg"
Fri 28 Nov 2003 12,368 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\CommonClient.reg"
Mon 13 Feb 2006 10,198 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off1.tmp"
Fri 3 Mar 2006 10,678 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off16.tmp"
Thu 15 Dec 2005 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off16h.tmp"
Thu 15 Dec 2005 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off16s.tmp"
Mon 16 Jan 2006 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off1h.tmp"
Mon 16 Jan 2006 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off1s.tmp"
Sun 26 Feb 2006 10,678 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off2.tmp"
Thu 24 Nov 2005 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off2h.tmp"
Thu 24 Nov 2005 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off2s.tmp"
Thu 25 Nov 2004 10,678 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off3.tmp"
Thu 2 Mar 2006 10,678 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off4.tmp"
Sat 4 Mar 2006 10,678 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off5.tmp"
Mon 5 Dec 2005 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off71Ah.tmp"
Mon 5 Dec 2005 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Off71As.tmp"
Fri 26 Nov 2004 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Officeh.tmp"
Fri 26 Nov 2004 8,246 A..H. --- "C:\Program Files\Microsoft Office\Office\Shortcut Bar\Offices.tmp"
Fri 2 May 2008 3,493,888 A..H. --- "C:\Documents and Settings\Troy Johnson\Application Data\U3\temp\Launchpad Removal.exe"
Tue 25 Jan 2005 4,348 A..H. --- "C:\Documents and Settings\All Users\Documents\My Music\My Music\License Backup\drmv1key.bak"
Fri 10 Feb 2006 20 A..H. --- "C:\Documents and Settings\All Users\Documents\My Music\My Music\License Backup\drmv1lic.bak"
Wed 18 Jan 2006 400 A.SH. --- "C:\Documents and Settings\All Users\Documents\My Music\My Music\License Backup\drmv2key.bak"

[b]Finished![/b]


Report •

#7
December 30, 2008 at 18:58:58
Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

In your case to run Combofix do the following:
1. Go offline turn off your Nortons antivirus, and any other antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.


Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.


Report •

#8
December 30, 2008 at 19:32:20
here is the combofix log:

ComboFix 08-12-30.01 - Troy Johnson 2008-12-30 21:11:07.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.96 [GMT -6:00]

* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-31 )))))))))))))))))))))))))))))))
.

2008-12-30 20:08 . 2008-12-30 20:08 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-12-29 21:29 . 2008-12-29 21:29 <DIR> d-------- c:\windows\ERUNT
2008-12-29 18:02 . 1996-03-13 16:46 41,024 --a------ c:\windows\system\HUDSONB2.TTF
2008-12-29 18:02 . 1996-05-08 10:41 39,636 --a------ c:\windows\system\HUDSON2.TTF
2008-12-28 21:34 . 2008-12-28 21:34 <DIR> d-------- c:\windows\system32\N360_BACKUP
2008-12-28 21:10 . 2008-12-28 21:10 <DIR> d-------- c:\program files\Windows Sidebar
2008-12-28 21:10 . 2008-12-29 06:18 <DIR> d-------- c:\program files\Norton 360
2008-12-28 21:08 . 2008-12-30 19:27 123,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS
2008-12-28 21:08 . 2008-12-30 19:27 60,800 --a------ c:\windows\system32\S32EVNT1.DLL
2008-12-28 21:08 . 2008-12-30 19:27 10,671 --a------ c:\windows\system32\drivers\SYMEVENT.CAT
2008-12-28 21:08 . 2008-12-30 19:27 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF
2008-12-28 19:28 . 2008-12-28 19:28 133,408 --ah----- c:\windows\system32\mlfcache.dat
2008-12-28 17:37 . 2008-12-28 17:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-28 17:36 . 2008-12-30 17:57 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-12-28 17:36 . 2008-12-28 17:36 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-28 17:36 . 2008-12-28 17:36 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\SUPERAntiSpyware.com
2008-12-28 12:27 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-28 12:26 . 2008-12-28 12:26 <DIR> d-------- c:\program files\Panda Security
2008-12-28 12:21 . 2008-12-28 12:21 <DIR> d-------- C:\!KillBox
2008-12-28 12:13 . 2008-12-28 12:13 <DIR> d-------- c:\program files\SpywareBlaster
2008-12-28 11:18 . 2008-12-30 20:41 <DIR> d-------- C:\SDFix
2008-12-28 10:17 . 2008-12-28 10:17 <DIR> d-------- c:\program files\Exterminate It!
2008-12-27 19:23 . 2008-12-27 19:23 <DIR> d-------- c:\program files\ESET
2008-12-27 16:28 . 2008-12-27 18:14 <DIR> d-------- c:\program files\EsetOnlineScanner
2008-12-27 11:35 . 2008-12-27 11:34 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-27 10:51 . 2008-12-27 11:34 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-27 08:13 . 2008-12-27 08:13 122,480 --a------ c:\windows\~GLC0004.TMP
2008-12-26 17:36 . 2008-12-26 17:37 <DIR> d-------- C:\32788R22FWJFW.0.tmp
2008-12-26 10:01 . 2008-12-26 10:01 122,480 --a------ c:\windows\~GLC0002.TMP
2008-12-25 11:39 . 2008-12-25 11:39 535 --a------ c:\windows\eReg.dat
2008-12-25 11:38 . 2008-12-25 11:38 <DIR> d-------- c:\program files\Maxis
2008-12-25 11:21 . 2008-12-25 11:21 24 --a------ c:\windows\AM_D6.PRF
2008-12-25 07:14 . 2008-12-25 07:14 <DIR> d-------- c:\program files\Bonjour
2008-12-25 07:10 . 2008-12-25 07:11 <DIR> d-------- c:\program files\iTunes
2008-12-25 07:10 . 2008-12-25 07:10 <DIR> d-------- c:\program files\iPod
2008-12-25 07:10 . 2008-12-25 07:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-17 21:00 . 2008-12-27 18:42 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-17 21:00 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-17 21:00 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-14 18:08 . 2008-12-14 18:08 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\Malwarebytes
2008-12-14 18:07 . 2008-12-14 18:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-14 17:26 . 2008-12-14 17:26 <DIR> d-------- c:\program files\Enigma Software Group
2008-12-14 16:55 . 2008-12-15 20:01 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\ByteCrusher
2008-12-14 16:54 . 2008-12-15 19:51 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-13 12:14 . 2008-12-13 12:14 <DIR> d-------- c:\program files\SesameWorkshop
2008-12-12 11:18 . 2008-12-12 11:18 87,336 --a------ c:\windows\system32\dns-sd.exe
2008-12-12 11:11 . 2008-12-12 11:11 61,440 --a------ c:\windows\system32\dnssd.dll
2008-12-06 12:53 . 2008-12-06 12:53 <DIR> d-------- c:\documents and settings\Evan\Application Data\Sony
2008-11-15 14:50 . 2008-11-15 14:50 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\Jamdat
2008-11-15 14:47 . 2008-11-15 14:47 <DIR> d-------- C:\users
2008-11-15 14:47 . 2008-12-25 14:46 <DIR> d-------- C:\My Games
2008-11-15 14:46 . 2008-12-25 15:11 <DIR> d-------- c:\program files\RealArcade
2008-11-11 16:00 . 2008-10-24 05:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 15:59 . 2008-09-04 11:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-04 10:30 . 2008-11-04 10:30 90,112 --a------ c:\windows\system32\QuickTimeVR.qtx
2008-11-04 10:30 . 2008-11-04 10:30 57,344 --a------ c:\windows\system32\QuickTime.qts
2008-11-02 21:11 . 2008-11-02 21:11 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\Sony
2008-11-02 21:11 . 2008-11-02 21:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony
2008-11-02 21:06 . 2008-11-02 21:06 <DIR> d-------- c:\program files\Sony Setup

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-31 03:20 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-31 01:27 --------- d-----w c:\program files\Symantec
2008-12-30 15:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-30 00:02 --------- d-----w c:\program files\Scholastic
2008-12-29 19:45 --------- d-----w c:\program files\Microsoft Money
2008-12-29 03:27 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\Symantec
2008-12-29 01:29 --------- d-----w c:\documents and settings\All Users\Application Data\Norton
2008-12-29 01:26 --------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2008-12-27 17:34 --------- d-----w c:\program files\Java
2008-12-27 16:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-25 21:26 --------- d-----w c:\program files\Microsoft Games
2008-12-25 21:09 --------- d-----w c:\program files\Real
2008-12-25 20:48 --------- d-----w c:\program files\Common Files\Scanner
2008-12-25 20:43 --------- d-----w c:\program files\Cheat Engine
2008-12-25 20:43 --------- d-----w c:\program files\Atari
2008-12-25 13:10 --------- d-----w c:\program files\Common Files\Apple
2008-12-25 13:03 --------- d-----w c:\program files\QuickTime
2008-12-25 12:38 --------- d-----w c:\program files\Safari
2008-12-21 03:11 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\U3
2008-12-16 12:28 --------- d-----w c:\program files\Windows Live
2008-12-16 12:27 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-12 03:13 --------- d-----w c:\program files\Electronic Arts
2008-12-12 03:13 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\My Battle for Middle-earth(tm) II Files
2008-12-12 03:09 --------- d-----w c:\program files\PackMasterME
2008-11-30 21:35 31 ----a-w c:\documents and settings\Troy Johnson\jagex_runescape_preferences.dat
2008-11-16 19:14 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\Apple Computer
2008-11-15 20:50 --------- d-----w c:\program files\Google
2008-11-03 03:07 --------- d-----w c:\program files\Sony
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 20:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 20:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 20:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 22:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-03-10 23:31 1,653,826 ----a-w c:\program files\PackMasterME.zip
2006-01-21 00:24 32 ----a-r c:\documents and settings\All Users\hash.dat
2005-12-12 00:16 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-06-30 19:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2008-09-13 13:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091320080914\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-27_12.53.20.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-06-30 16:39:58 128,256 ----a-w c:\windows\Downloaded Program Files\as2stubie.dll
+ 2008-10-05 02:16:46 1,887,080 ----a-w c:\windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
- 2008-10-10 03:00:36 22,016 ----a-w c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP\WiseCustomCall.dll
+ 2008-12-29 02:26:04 22,016 ----a-w c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP\WiseCustomCall.dll
+ 2008-08-07 21:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2008-12-31 02:02:25 7,471,104 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-12-31 02:02:25 487,424 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 21:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-12-30 03:29:55 7,471,104 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-12-30 03:29:55 487,424 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-12-28 23:37:06 18,944 ----a-r c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2008-12-28 23:37:06 65,024 ----a-r c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2007-08-09 00:39:56 36,056 ----a-w c:\windows\system32\drivers\CO_Mon.sys
+ 2008-07-30 23:42:12 23,888 ----a-w c:\windows\system32\drivers\COH_Mon.sys
+ 2008-02-01 01:51:16 279,088 ----a-w c:\windows\system32\drivers\srtsp.sys
+ 2008-02-01 01:51:16 317,616 ----a-w c:\windows\system32\drivers\srtspl.sys
+ 2008-02-01 01:51:16 43,696 ----a-w c:\windows\system32\drivers\srtspx.sys
+ 2008-06-13 20:13:38 13,616 ----a-w c:\windows\system32\drivers\symdns.sys
+ 2008-06-13 20:13:38 96,432 ----a-w c:\windows\system32\drivers\symfw.sys
+ 2008-06-13 20:13:38 38,576 ----a-w c:\windows\system32\drivers\symids.sys
- 2008-12-12 03:08:17 36,272 ----a-r c:\windows\system32\drivers\SymIM.sys
+ 2008-06-13 20:14:02 31,280 ----a-w c:\windows\system32\drivers\SymIM.sys
+ 2008-06-13 20:13:38 37,424 ----a-w c:\windows\system32\drivers\symndis.sys
+ 2008-06-13 20:13:40 41,008 ----a-w c:\windows\system32\drivers\symndisv.sys
+ 2008-06-13 20:13:38 22,320 ----a-w c:\windows\system32\drivers\symredrv.sys
+ 2008-06-13 20:13:40 184,240 ----a-w c:\windows\system32\drivers\symtdi.sys
- 2008-12-25 20:24:19 1,041,200 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-12-30 03:16:45 1,041,200 ----a-w c:\windows\system32\FNTCACHE.DAT
- 2008-04-17 19:12:54 107,368 ----a-w c:\windows\system32\GEARAspi.dll
+ 2008-01-29 18:02:30 107,368 ----a-w c:\windows\system32\GEARAspi.dll
+ 2007-07-27 20:49:02 196,683 ----a-w c:\windows\system32\lnod32apiA.dll
+ 2007-07-27 20:49:02 225,355 ----a-w c:\windows\system32\lnod32apiW.dll
+ 2005-12-06 01:25:22 139,264 ----a-w c:\windows\system32\lnod32umc.dll
+ 2005-12-05 18:37:10 106,496 ----a-w c:\windows\system32\lnod32upd.dll
+ 2008-10-05 03:16:26 235,936 ----a-r c:\windows\system32\Macromed\Flash\FlashUtil10a.exe
+ 2008-12-31 01:52:35 89,102 ----a-w c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
+ 2008-02-11 15:39:26 253,952 ----a-w c:\windows\system32\OnlineScannerDLLA.dll
+ 2008-02-11 15:39:18 237,568 ----a-w c:\windows\system32\OnlineScannerDLLW.dll
+ 2008-02-08 19:53:46 110,592 ----a-w c:\windows\system32\OnlineScannerLang.dll
+ 2008-02-05 14:48:04 77,824 ----a-w c:\windows\system32\OnlineScannerUninstaller.exe
+ 2008-06-13 20:45:48 579,464 ----a-w c:\windows\system32\SymNeti.dll
+ 2008-06-13 20:45:44 207,240 ----a-w c:\windows\system32\SymRedir.dll
+ 2004-12-07 17:11:34 258,352 ----a-w c:\windows\system32\unicows.dll
+ 2008-12-31 02:21:00 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_108.dat
+ 2008-12-31 02:21:13 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_170.dat
+ 2008-12-31 02:20:56 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_600.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"ANT Agent"="c:\garmin\ANT Agent\ANT Agent.exe" [2008-05-20 8232024]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"E07AXLRD_24361296"="c:\program files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE" [2006-06-10 351000]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-30 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 335872]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-27 136600]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"SoundMan"="SOUNDMAN.EXE" [2003-02-10 c:\windows\SOUNDMAN.EXE]
"BluetoothAuthenticationAgent"="irprops.cpl" [2008-04-13 c:\windows\system32\irprops.cpl]

c:\documents and settings\Evan\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Handspring\HOTSYNC.EXE [2007-03-31 299008]

c:\documents and settings\Troy Johnson\Start Menu\Programs\Startup\
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\outicon.exe [2006-03-08 794624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 73728]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-30 17:57 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm
"MSACM.CEGSM"= mobilev.acm
"aux"= wdmaud.sys

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-28 28544]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPortIO.sys [2005-01-29 3584]
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-02-18 149352]
R3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-12 23888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-28 99376]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
S3 EraserUtilDrv10720;EraserUtilDrv10720;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10720.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9489b43f-ee21-11dc-86be-000c7618c9b1}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fbf6f5cc-cb46-11dc-86ad-000c7618c9b1}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-12-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.excite.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
Trusted Zone: free.aol.com
Trusted Zone: *.turbotax.com

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
c:\windows\Downloaded Program Files\OnlineScanner.inf
FF - ProfilePath - c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.excite.com
FF - component: c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npigl.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-30 21:20:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2008-12-30 21:28:21
ComboFix-quarantined-files.txt 2008-12-31 03:27:03
ComboFix2.txt 2008-12-28 13:32:59
ComboFix3.txt 2008-12-28 01:19:21
ComboFix4.txt 2008-12-27 18:55:11

Pre-Run: 20,263,063,552 bytes free
Post-Run: 20,267,163,648 bytes free

305 --- E O F --- 2008-12-26 02:24:48


Report •

#9
December 31, 2008 at 03:50:33
Open Notepad and copy/paste everything between the X's into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
KILLALL::
File::
c:\windows\~GLC0004.TMP
C:\32788R22FWJFW.0.tmp
c:\windows\~GLC0002.TMP

Folder::
C:\32788R22FWJFW.0.tmp

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run".

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.


Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Run an online scan with Kaspersky from the following link:
Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
3.Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
4. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
5. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
6. Click View scan report at the bottom.
7. Click the Save Report As... button.
8. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note**

To optimize scanning time and produce a more sensible report for review:
Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


Report •

#10
December 31, 2008 at 16:43:26
I have been trying to send the Combofix log since this morning. Here is half of it and I will send the other half if this is successful.

Combofix run, system restore cleared, ATF run. Kicking off Kaspersky and will reply with log in a few hours. Here is the new Combofix log:

ComboFix 08-12-30.02 - Troy Johnson 2008-12-31 6:31:24.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.103 [GMT -6:00]
Running from: c:\documents and settings\Troy Johnson\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Troy Johnson\Desktop\CFScript.txt
AV: Norton 360 *On-access scanning disabled* (Updated)
FW: Norton 360 *disabled*
* Created a new restore point

FILE ::
C:\32788R22FWJFW.0.tmp
c:\windows\~GLC0002.TMP
c:\windows\~GLC0004.TMP
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\32788R22FWJFW.0.tmp
c:\32788r22fwjfw.0.tmp\OsVer
c:\windows\~GLC0002.TMP
c:\windows\~GLC0004.TMP

.
((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-31 )))))))))))))))))))))))))))))))
.

2008-12-30 20:08 . 2008-12-30 20:08 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-12-29 21:29 . 2008-12-29 21:29 <DIR> d-------- c:\windows\ERUNT
2008-12-29 18:02 . 1996-03-13 16:46 41,024 --a------ c:\windows\system\HUDSONB2.TTF
2008-12-29 18:02 . 1996-05-08 10:41 39,636 --a------ c:\windows\system\HUDSON2.TTF
2008-12-28 21:34 . 2008-12-28 21:34 <DIR> d-------- c:\windows\system32\N360_BACKUP
2008-12-28 21:10 . 2008-12-28 21:10 <DIR> d-------- c:\program files\Windows Sidebar
2008-12-28 21:10 . 2008-12-29 06:18 <DIR> d-------- c:\program files\Norton 360
2008-12-28 21:08 . 2008-12-30 19:27 123,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS
2008-12-28 21:08 . 2008-12-30 19:27 60,800 --a------ c:\windows\system32\S32EVNT1.DLL
2008-12-28 21:08 . 2008-12-30 19:27 10,671 --a------ c:\windows\system32\drivers\SYMEVENT.CAT
2008-12-28 21:08 . 2008-12-30 19:27 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF
2008-12-28 19:28 . 2008-12-28 19:28 133,408 --ah----- c:\windows\system32\mlfcache.dat
2008-12-28 17:37 . 2008-12-28 17:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-28 17:36 . 2008-12-30 17:57 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-12-28 17:36 . 2008-12-28 17:36 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-28 17:36 . 2008-12-28 17:36 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\SUPERAntiSpyware.com
2008-12-28 12:27 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-28 12:26 . 2008-12-28 12:26 <DIR> d-------- c:\program files\Panda Security
2008-12-28 12:21 . 2008-12-28 12:21 <DIR> d-------- C:\!KillBox
2008-12-28 12:13 . 2008-12-28 12:13 <DIR> d-------- c:\program files\SpywareBlaster
2008-12-28 11:18 . 2008-12-30 20:41 <DIR> d-------- C:\SDFix
2008-12-28 10:17 . 2008-12-28 10:17 <DIR> d-------- c:\program files\Exterminate It!
2008-12-27 19:23 . 2008-12-27 19:23 <DIR> d-------- c:\program files\ESET
2008-12-27 16:28 . 2008-12-27 18:14 <DIR> d-------- c:\program files\EsetOnlineScanner
2008-12-27 11:35 . 2008-12-27 11:34 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-27 10:51 . 2008-12-27 11:34 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-25 11:39 . 2008-12-25 11:39 535 --a------ c:\windows\eReg.dat
2008-12-25 11:38 . 2008-12-25 11:38 <DIR> d-------- c:\program files\Maxis
2008-12-25 11:21 . 2008-12-25 11:21 24 --a------ c:\windows\AM_D6.PRF
2008-12-25 07:14 . 2008-12-25 07:14 <DIR> d-------- c:\program files\Bonjour
2008-12-25 07:10 . 2008-12-25 07:11 <DIR> d-------- c:\program files\iTunes
2008-12-25 07:10 . 2008-12-25 07:10 <DIR> d-------- c:\program files\iPod
2008-12-25 07:10 . 2008-12-25 07:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-17 21:00 . 2008-12-27 18:42 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-17 21:00 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-17 21:00 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-14 18:08 . 2008-12-14 18:08 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\Malwarebytes
2008-12-14 18:07 . 2008-12-14 18:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-14 17:26 . 2008-12-14 17:26 <DIR> d-------- c:\program files\Enigma Software Group
2008-12-14 16:55 . 2008-12-15 20:01 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\ByteCrusher
2008-12-14 16:54 . 2008-12-15 19:51 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-13 12:14 . 2008-12-13 12:14 <DIR> d-------- c:\program files\SesameWorkshop
2008-12-12 11:18 . 2008-12-12 11:18 87,336 --a------ c:\windows\system32\dns-sd.exe
2008-12-12 11:11 . 2008-12-12 11:11 61,440 --a------ c:\windows\system32\dnssd.dll
2008-12-06 12:53 . 2008-12-06 12:53 <DIR> d-------- c:\documents and settings\Evan\Application Data\Sony
2008-11-15 14:50 . 2008-11-15 14:50 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\Jamdat
2008-11-15 14:47 . 2008-11-15 14:47 <DIR> d-------- C:\users
2008-11-15 14:47 . 2008-12-25 14:46 <DIR> d-------- C:\My Games
2008-11-15 14:46 . 2008-12-25 15:11 <DIR> d-------- c:\program files\RealArcade
2008-11-11 16:00 . 2008-10-24 05:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 15:59 . 2008-09-04 11:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-04 10:30 . 2008-11-04 10:30 90,112 --a------ c:\windows\system32\QuickTimeVR.qtx
2008-11-04 10:30 . 2008-11-04 10:30 57,344 --a------ c:\windows\system32\QuickTime.qts
2008-11-02 21:11 . 2008-11-02 21:11 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\Sony
2008-11-02 21:11 . 2008-11-02 21:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony
2008-11-02 21:06 . 2008-11-02 21:06 <DIR> d-------- c:\program files\Sony Setup

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-31 12:41 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-31 01:27 --------- d-----w c:\program files\Symantec
2008-12-30 15:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-30 00:02 --------- d-----w c:\program files\Scholastic
2008-12-29 19:45 --------- d-----w c:\program files\Microsoft Money
2008-12-29 03:27 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\Symantec
2008-12-29 01:29 --------- d-----w c:\documents and settings\All Users\Application Data\Norton
2008-12-29 01:26 --------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2008-12-27 17:34 --------- d-----w c:\program files\Java
2008-12-27 16:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-25 21:26 --------- d-----w c:\program files\Microsoft Games
2008-12-25 21:09 --------- d-----w c:\program files\Real
2008-12-25 20:48 --------- d-----w c:\program files\Common Files\Scanner
2008-12-25 20:43 --------- d-----w c:\program files\Cheat Engine
2008-12-25 20:43 --------- d-----w c:\program files\Atari
2008-12-25 13:10 --------- d-----w c:\program files\Common Files\Apple
2008-12-25 13:03 --------- d-----w c:\program files\QuickTime
2008-12-25 12:38 --------- d-----w c:\program files\Safari
2008-12-21 03:11 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\U3
2008-12-16 12:28 --------- d-----w c:\program files\Windows Live
2008-12-16 12:27 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-12 03:13 --------- d-----w c:\program files\Electronic Arts
2008-12-12 03:13 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\My Battle for Middle-earth(tm) II Files
2008-12-12 03:09 --------- d-----w c:\program files\PackMasterME
2008-11-30 21:35 31 ----a-w c:\documents and settings\Troy Johnson\jagex_runescape_preferences.dat
2008-11-16 19:14 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\Apple Computer
2008-11-15 20:50 --------- d-----w c:\program files\Google
2008-11-03 03:07 --------- d-----w c:\program files\Sony
2008-03-10 23:31 1,653,826 ----a-w c:\program files\PackMasterME.zip
2006-01-21 00:24 32 ----a-r c:\documents and settings\All Users\hash.dat
2005-12-12 00:16 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-06-30 19:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2008-09-13 13:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091320080914\index.dat
.

((((((((((((((((((((((((((((( snapshot_2008-12-30_21.26.34.67 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-31 12:41:49 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_540.dat
+ 2008-12-31 12:41:17 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_6fc.dat
+ 2008-12-31 12:41:33 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_770.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"ANT Agent"="c:\garmin\ANT Agent\ANT Agent.exe" [2008-05-20 8232024]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"E07AXLRD_24361296"="c:\program files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE" [2006-06-10 351000]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-30 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 335872]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-27 136600]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"SoundMan"="SOUNDMAN.EXE" [2003-02-10 c:\windows\SOUNDMAN.EXE]
"BluetoothAuthenticationAgent"="irprops.cpl" [2008-04-13 c:\windows\system32\irprops.cpl]

c:\documents and settings\Evan\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Handspring\HOTSYNC.EXE [2007-03-31 299008]

c:\documents and settings\Troy Johnson\Start Menu\Programs\Startup\
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\outicon.exe [2006-03-08 794624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 73728]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-30 17:57 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm
"MSACM.CEGSM"= mobilev.acm
"aux"= wdmaud.sys

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-28 28544]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPortIO.sys [2005-01-29 3584]
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-02-18 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-28 99376]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-12 23888]
S3 EraserUtilDrv10720;EraserUtilDrv10720;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10720.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9489b43f-ee21-11dc-86be-000c7618c9b1}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fbf6f5cc-cb46-11dc-86ad-000c7618c9b1}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-12-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.excite.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
Trusted Zone: free.aol.com
Trusted Zone: *.turbotax.com

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
c:\windows\Downloaded Program Files\OnlineScanner.inf
FF - ProfilePath - c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.excite.com
FF - component: c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npigl.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-31 06:43:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\.Default\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Ding.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\AppGPFault\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\CCSelect\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\Close\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Battery Critical.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\DeviceConnect\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Hardware Insert.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Hardware Remove.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\DeviceFail\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Hardware Fail.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Battery Low.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\MailBeep\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="Office97\\EXPLODE.WAV"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\Maximize\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\MenuCommand\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\MenuPopup\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\Minimize\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\NMain-MouseClick\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\Common Files\\Symantec Shared\\NIMClick.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\NMain-MouseLeave\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\NMain-MouseOver\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\Common Files\\Symantec Shared\\NIMOver.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\Open\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\PrintComplete\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\RestoreDown\d*NULL*o*NULL*g*NULL*0*NULL*H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""


Report •

#11
December 31, 2008 at 16:46:53
Ok, breaking the log in half allowed me to send. THe post above is the 1st half of the combofix log and this is the second half. I am now down to the Kaspersky step and will forward that log when complete. Thanks

HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\RestoreUp\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\ShowBand\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\SystemAsterisk\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Error.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\SystemExclamation\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Exclamation.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\SystemExit\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Shutdown.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\SystemHand\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Critical Stop.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\SystemNotification\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Balloon.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\SystemQuestion\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\SystemStart\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Startup.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\WindowsLogoff\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Logoff Sound.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\.Default\WindowsLogon\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Logon Sound.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Conf\Person Joins\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\NetMeeting\\Blip.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Conf\Person Leaves\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\NetMeeting\\Blip.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Conf\Receive Call\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="RingIn.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Conf\Receive Request to Join\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="RingIn.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Explorer\ActivatingDocument\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Explorer\BlockedPopup\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="Windows Pop-up Blocked.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=expand:"%SystemRoot%\\media\\Windows XP Recycle.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="Windows Feed Discovered.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Explorer\MoveMenuItem\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Explorer\Navigating\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@=""

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Explorer\SecurityBand\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="Windows Information Bar.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_1to3line\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\switview.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_3to1line\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\switview.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_AdvRt\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\plyscrol.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_AvHelpOff\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\avhlpoff.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_AvHelpOn\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\avhlpon.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_Balance\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\balancin.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_Balance0\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\balazero.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_BillAdd\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\adbildep.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_CalendarFlip\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\pageturn.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_DelTrn\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\delete.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_Done\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\done.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_Error\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\error.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_FormHide\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\sohifrm2.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_FormShow\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\sohifrm1.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_HelpPaneIcons\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\hlppicns.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_Intro\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\launch.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_IUEFinish\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\Congrats.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_LowOn\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\lowwonn.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_MenuClose\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\menuopen.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_MenuOpen\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\menuopen.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_MenuOver\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\rollover.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_MoveBack\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\moveback.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_MoveForward\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\moveforw.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_NavBar\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\navbar.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_PostIUE\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\postiue.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_ScrollOpen\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\plyscrol.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_Search\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\summwind.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_SideBar\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\sidebar.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_SmartFill\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\smarfill.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_SplitTran\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\splitent.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_Summary\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\summwind.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_Tab\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\switch.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_TransEnter\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\cashpls.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_TransEnterNeg\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\cashmin.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_TransMod\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\transclr.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMoney\MSMoney_TrnOrder\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\Microsoft Money 2005\\MNYCoreFiles\\sounds\\chngordr.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMSGS\MSMSGS_ContactOnline\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\Messenger\\online.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMSGS\MSMSGS_NewAlert\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\Messenger\\newalert.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMSGS\MSMSGS_NewMail\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\Messenger\\newemail.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSMSGS\MSMSGS_NewMessage\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\Messenger\\type.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_Buzz\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\MSN Messenger\\nudge.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_ContactOnline\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\MSN Messenger\\online.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewAlert\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\MSN Messenger\\newalert.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewMail\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\MSN Messenger\\newemail.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewMessage\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\MSN Messenger\\type.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewSMSMessage\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\MSN Messenger\\ring.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_PhoneRing\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\MSN Messenger\\phone.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_VoiceIMFinished\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="c:\\Program Files\\MSN Messenger\\vimdone.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Office97\Office97-Reminder\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security="Inherited"
@="Office97\\REMINDER.WAV"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Wcescomm\PegConnectConfirm\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\Microsoft ActiveSync\\pegconn.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Apps\Wcescomm\PegDisconnectConfirm\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="c:\\Program Files\\Microsoft ActiveSync\\pegdisc.wav"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\AppEvents\Schemes\Names\d*NULL*o*NULL*g*NULL*0*NULL* H]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
@="dog"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\SystemCertificates\AddressBook*NULL*]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\SystemCertificates\AddressBook*NULL*\Certificates]
@Security="Inherited"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\SystemCertificates\AddressBook*NULL*\CRLs]
@Security="Inherited"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\SystemCertificates\AddressBook*NULL*\CTLs]
@Security="Inherited"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\Windows Mobile Disc\P*NULL*a*NULL*l*NULL*m*NULL*®*NULL* *NULL*T*NULL*r*NULL*e*NULL*o*NULL*"! *NULL*7*NULL*0*NULL*0*NULL*w*NULL*x*NULL* *NULL*s*NULL*m*NULL*a*NULL*r*NULL*t*NULL* *NULL*d*NULL*e*NULL*v*NULL*i*NULL*c*NULL*e*NULL*]
@Security="Inherited"
"Version"=dword:04001106
"IntroComplete"=dword:ffffffff
"CDComplete"=dword:ffffffff

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\Windows Mobile Disc\P*NULL*a*NULL*l*NULL*m*NULL*®*NULL* *NULL*T*NULL*r*NULL*e*NULL*o*NULL*"! *NULL*7*NULL*0*NULL*0*NULL*w*NULL*x*NULL* *NULL*s*NULL*m*NULL*a*NULL*r*NULL*t*NULL* *NULL*d*NULL*e*NULL*v*NULL*i*NULL*c*NULL*e*NULL*\CriticalAppInstall]
@Security="Inherited"

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\Windows Mobile Disc\P*NULL*a*NULL*l*NULL*m*NULL*®*NULL* *NULL*T*NULL*r*NULL*e*NULL*o*NULL*"! *NULL*7*NULL*0*NULL*0*NULL*w*NULL*x*NULL* *NULL*s*NULL*m*NULL*a*NULL*r*NULL*t*NULL* *NULL*d*NULL*e*NULL*v*NULL*i*NULL*c*NULL*e*NULL*\CriticalAppInstall\ActiveSync]
@Security="Inherited"
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:00000020

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\Windows Mobile Disc\P*NULL*a*NULL*l*NULL*m*NULL*®*NULL* *NULL*T*NULL*r*NULL*e*NULL*o*NULL*"! *NULL*7*NULL*0*NULL*0*NULL*w*NULL*x*NULL* *NULL*s*NULL*m*NULL*a*NULL*r*NULL*t*NULL* *NULL*d*NULL*e*NULL*v*NULL*i*NULL*c*NULL*e*NULL*\CriticalAppInstall\CriticalApp1]
@Security="Inherited"
"Name"="CriticalApp1"
"DisplayName"="Treo™ 700wx User Guide"
"Param1"="OEM\\UGInstaller.exe"
"Type"="createprocess"
"Order"=dword:00000005
"State"=dword:00000000

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\Windows Mobile Disc\P*NULL*a*NULL*l*NULL*m*NULL*®*NULL* *NULL*T*NULL*r*NULL*e*NULL*o*NULL*"! *NULL*7*NULL*0*NULL*0*NULL*w*NULL*x*NULL* *NULL*s*NULL*m*NULL*a*NULL*r*NULL*t*NULL* *NULL*d*NULL*e*NULL*v*NULL*i*NULL*c*NULL*e*NULL*\CriticalAppInstall\IESettings]
@Security="Inherited"
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000004
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\Windows Mobile Disc\P*NULL*a*NULL*l*NULL*m*NULL*®*NULL* *NULL*T*NULL*r*NULL*e*NULL*o*NULL*"! *NULL*7*NULL*0*NULL*0*NULL*w*NULL*x*NULL* *NULL*s*NULL*m*NULL*a*NULL*r*NULL*t*NULL* *NULL*d*NULL*e*NULL*v*NULL*i*NULL*c*NULL*e*NULL*\CriticalAppInstall\MediaFiles]
@Security="Inherited"
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000003
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\Windows Mobile Disc\P*NULL*a*NULL*l*NULL*m*NULL*®*NULL* *NULL*T*NULL*r*NULL*e*NULL*o*NULL*"! *NULL*7*NULL*0*NULL*0*NULL*w*NULL*x*NULL* *NULL*s*NULL*m*NULL*a*NULL*r*NULL*t*NULL* *NULL*d*NULL*e*NULL*v*NULL*i*NULL*c*NULL*e*NULL*\CriticalAppInstall\NPW]
@Security="Inherited"
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000002
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Microsoft\Windows Mobile Disc\P*NULL*a*NULL*l*NULL*m*NULL*®*NULL* *NULL*T*NULL*r*NULL*e*NULL*o*NULL*"! *NULL*7*NULL*0*NULL*0*NULL*w*NULL*x*NULL* *NULL*s*NULL*m*NULL*a*NULL*r*NULL*t*NULL* *NULL*d*NULL*e*NULL*v*NULL*i*NULL*c*NULL*e*NULL*\CriticalAppInstall\Outlook]
@Security="Inherited"
"Name"="Outlook"
"DisplayName"="Microsoft Outlook"
"Param1"="Outlook"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:00000020

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Sony Creative Software\M*NULL*e*NULL*d*NULL*i*NULL*a*NULL* *NULL*M*NULL*a*NULL*n*NULL*a*NULL*g*NULL*e*NULL*r*NULL* *NULL*f*NULL*o*NULL*r*NULL* *NULL*P*NULL*S*NULL*P*NULL*"!]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-2374512986-2269229956-2491670152-1006
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (S-1-5-21-2374512986-2269229956-2491670152-1006)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)

[HKEY_USERS\S-1-5-21-2374512986-2269229956-2491670152-1006\Software\Sony Creative Software\M*NULL*e*NULL*d*NULL*i*NULL*a*NULL* *NULL*M*NULL*a*NULL*n*NULL*a*NULL*g*NULL*e*NULL*r*NULL* *NULL*f*NULL*o*NULL*r*NULL* *NULL*P*NULL*S*NULL*P*NULL*"!\2.5]
@Security="Inherited"
"FRT"="LEHbFrIag/tGpNgOHyJ/bkdhNLupICkjLu3D+l6S6f+aouPnmt8Eog=="
"PLCK"="YUJmzhIxuH9JvRxpkwyZUAdBWvIkAPaN"
"Percents"="0 0.1118 0.3277 0.641 0.7168 0.8358 0.8388 "
"Increment"=".002717"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(884)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
r Running Proce
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\snmp.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
c:\program files\Symantec\LiveUpdate\AUPDATE.EXE
c:\program files\Symantec\LiveUpdate\LuComServer_3_4.EXE
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2008-12-31 6:57:33 - machine was rebooted [Troy Johnson]
ComboFix-quarantined-files.txt 2008-12-31 12:56:04
ComboFix2.txt 2008-12-31 03:28:22
ComboFix3.txt 2008-12-28 13:32:59
ComboFix4.txt 2008-12-28 01:19:21
ComboFix5.txt 2008-12-31 12:27:02

Pre-Run: 20,229,017,600 bytes free
Post-Run: 20,272,816,128 bytes free

1059 --- E O F --- 2008-12-26 02:24:48


Report •

#12
January 1, 2009 at 05:20:53
I have now tried to run Kapersky 3 times with no luck. Each time it hangs up at about 1 hour on my sent email file. I have let it sit for 8 hours and it has never progressed beyond that point. Any idea what I should do to get it to progress? Thanks.

Report •

#13
January 1, 2009 at 08:26:57
Go to start> control panel> add/remove programs> and uninstall these programs if found:


Eset
Kaspersky
Panda

Run Hijack This , close all windows and browsers except Hijack This , place a check to the left of the following items and press "fix checked":

R3 - URLSearchHook: (no name) - - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/active...


O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/Onlin...

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eo...

Exit Hijack This.

Something corrupted the last Combofix scan, I hope you turned off the antivirus and any antispyware before you ran it.

Please download ComboFix again and run it. Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

In your case to run Combofix do the following:
1. Go offline turn off your Norton antivirus, and any other antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.


Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.

Go to start> run> type in combofix /u (note the space after combofix) then press enter> run. This will uninstall combofix so give the uninstaller a minute to run.

Please run Esets online scanner from this link:

ESET

1. Note: You will need to use Internet explorer for this scan
2. Tick the box next to YES, I accept the Terms of Use.
3. Click Start
4. When asked, allow the activex control to install
5. Click Start
6. Make sure that the option Remove found threats is unticked ( I want to see what is found first), and the option Scan unwanted applications is checked
7. Click Scan
8. Wait for the scan to finish
9. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
10. Copy and paste that log in your next reply.


Report •

#14
January 1, 2009 at 09:54:49
here is the Combofix log, now off to load Eset and run:

ComboFix 08-12-31.01 - Troy Johnson 2009-01-01 11:29:50.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.166 [GMT -6:00]
Running from: c:\documents and settings\Troy Johnson\Desktop\ComboFix.exe
AV: Norton 360 *On-access scanning disabled* (Updated)
FW: Norton 360 *enabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-01 to 2009-01-01 )))))))))))))))))))))))))))))))
.

2009-01-01 07:15 . 2009-01-01 07:15 0 --a------ c:\windows\syscheck.INI
2008-12-30 20:08 . 2008-12-30 20:08 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-12-29 21:29 . 2008-12-29 21:29 <DIR> d-------- c:\windows\ERUNT
2008-12-29 18:02 . 1996-03-13 16:46 41,024 --a------ c:\windows\system\HUDSONB2.TTF
2008-12-29 18:02 . 1996-05-08 10:41 39,636 --a------ c:\windows\system\HUDSON2.TTF
2008-12-28 21:34 . 2008-12-28 21:34 <DIR> d-------- c:\windows\system32\N360_BACKUP
2008-12-28 21:10 . 2008-12-28 21:10 <DIR> d-------- c:\program files\Windows Sidebar
2008-12-28 21:10 . 2008-12-29 06:18 <DIR> d-------- c:\program files\Norton 360
2008-12-28 21:08 . 2008-12-30 19:27 123,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS
2008-12-28 21:08 . 2008-12-30 19:27 60,800 --a------ c:\windows\system32\S32EVNT1.DLL
2008-12-28 21:08 . 2008-12-30 19:27 10,671 --a------ c:\windows\system32\drivers\SYMEVENT.CAT
2008-12-28 21:08 . 2008-12-30 19:27 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF
2008-12-28 19:28 . 2008-12-28 19:28 133,408 --ah----- c:\windows\system32\mlfcache.dat
2008-12-28 17:37 . 2008-12-28 17:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-28 17:36 . 2008-12-30 17:57 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-12-28 17:36 . 2008-12-28 17:36 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-28 17:36 . 2008-12-28 17:36 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\SUPERAntiSpyware.com
2008-12-28 12:26 . 2009-01-01 10:55 <DIR> d-------- c:\program files\Panda Security
2008-12-28 12:21 . 2008-12-28 12:21 <DIR> d-------- C:\!KillBox
2008-12-28 11:18 . 2008-12-30 20:41 <DIR> d-------- C:\SDFix
2008-12-28 10:17 . 2009-01-01 10:59 <DIR> d-------- c:\program files\Exterminate It!
2008-12-27 11:35 . 2008-12-27 11:34 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-27 10:51 . 2008-12-27 11:34 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-25 11:39 . 2008-12-25 11:39 535 --a------ c:\windows\eReg.dat
2008-12-25 11:38 . 2008-12-25 11:38 <DIR> d-------- c:\program files\Maxis
2008-12-25 11:21 . 2008-12-25 11:21 24 --a------ c:\windows\AM_D6.PRF
2008-12-25 07:14 . 2008-12-25 07:14 <DIR> d-------- c:\program files\Bonjour
2008-12-25 07:10 . 2008-12-25 07:11 <DIR> d-------- c:\program files\iTunes
2008-12-25 07:10 . 2008-12-25 07:10 <DIR> d-------- c:\program files\iPod
2008-12-25 07:10 . 2008-12-25 07:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-17 21:00 . 2008-12-27 18:42 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-17 21:00 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-17 21:00 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-14 18:08 . 2008-12-14 18:08 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\Malwarebytes
2008-12-14 18:07 . 2008-12-14 18:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-14 17:26 . 2008-12-14 17:26 <DIR> d-------- c:\program files\Enigma Software Group
2008-12-14 16:55 . 2008-12-15 20:01 <DIR> d-------- c:\documents and settings\Troy Johnson\Application Data\ByteCrusher
2008-12-14 16:54 . 2008-12-15 19:51 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-13 12:14 . 2008-12-13 12:14 <DIR> d-------- c:\program files\SesameWorkshop
2008-12-12 11:18 . 2008-12-12 11:18 87,336 --a------ c:\windows\system32\dns-sd.exe
2008-12-12 11:11 . 2008-12-12 11:11 61,440 --a------ c:\windows\system32\dnssd.dll
2008-12-06 12:53 . 2008-12-06 12:53 <DIR> d-------- c:\documents and settings\Evan\Application Data\Sony

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-01 17:13 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-31 01:27 --------- d-----w c:\program files\Symantec
2008-12-30 15:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-30 00:02 --------- d-----w c:\program files\Scholastic
2008-12-29 19:45 --------- d-----w c:\program files\Microsoft Money
2008-12-29 03:27 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\Symantec
2008-12-29 01:29 --------- d-----w c:\documents and settings\All Users\Application Data\Norton
2008-12-29 01:26 --------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2008-12-27 17:34 --------- d-----w c:\program files\Java
2008-12-27 16:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-25 21:26 --------- d-----w c:\program files\Microsoft Games
2008-12-25 21:11 --------- d-----w c:\program files\RealArcade
2008-12-25 21:09 --------- d-----w c:\program files\Real
2008-12-25 20:48 --------- d-----w c:\program files\Common Files\Scanner
2008-12-25 20:43 --------- d-----w c:\program files\Cheat Engine
2008-12-25 20:43 --------- d-----w c:\program files\Atari
2008-12-25 13:10 --------- d-----w c:\program files\Common Files\Apple
2008-12-25 13:03 --------- d-----w c:\program files\QuickTime
2008-12-25 12:38 --------- d-----w c:\program files\Safari
2008-12-21 03:11 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\U3
2008-12-16 12:28 --------- d-----w c:\program files\Windows Live
2008-12-16 12:27 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-12 03:13 --------- d-----w c:\program files\Electronic Arts
2008-12-12 03:13 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\My Battle for Middle-earth(tm) II Files
2008-12-12 03:09 --------- d-----w c:\program files\PackMasterME
2008-11-30 21:35 31 ----a-w c:\documents and settings\Troy Johnson\jagex_runescape_preferences.dat
2008-11-16 19:14 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\Apple Computer
2008-11-15 20:50 --------- d-----w c:\program files\Google
2008-11-15 20:50 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\Jamdat
2008-11-03 03:11 --------- d-----w c:\documents and settings\Troy Johnson\Application Data\Sony
2008-11-03 03:11 --------- d-----w c:\documents and settings\All Users\Application Data\Sony
2008-11-03 03:07 --------- d-----w c:\program files\Sony
2008-11-03 03:06 --------- d-----w c:\program files\Sony Setup
2008-03-10 23:31 1,653,826 ----a-w c:\program files\PackMasterME.zip
2006-01-21 00:24 32 ----a-r c:\documents and settings\All Users\hash.dat
2005-12-12 00:16 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-06-30 19:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2008-09-13 13:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091320080914\index.dat
.

((((((((((((((((((((((((((((( snapshot_2008-12-30_21.26.34.67 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-15 04:45:24 64,372 ----a-w c:\windows\system32\perfc009.dat
+ 2009-01-01 14:15:27 64,372 ----a-w c:\windows\system32\perfc009.dat
- 2008-12-15 04:45:24 409,232 ----a-w c:\windows\system32\perfh009.dat
+ 2009-01-01 14:15:27 409,232 ----a-w c:\windows\system32\perfh009.dat
+ 2009-01-01 17:13:42 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_274.dat
+ 2009-01-01 17:13:24 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_704.dat
+ 2009-01-01 17:13:32 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_e0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"ANT Agent"="c:\garmin\ANT Agent\ANT Agent.exe" [2008-05-20 8232024]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"E07AXLRD_24361296"="c:\program files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE" [2006-06-10 351000]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-30 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 335872]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-27 136600]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"SoundMan"="SOUNDMAN.EXE" [2003-02-10 c:\windows\SOUNDMAN.EXE]
"BluetoothAuthenticationAgent"="irprops.cpl" [2008-04-13 c:\windows\system32\irprops.cpl]

c:\documents and settings\Evan\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Handspring\HOTSYNC.EXE [2007-03-31 299008]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 73728]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-30 17:57 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm
"MSACM.CEGSM"= mobilev.acm
"aux"= wdmaud.sys

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPortIO.sys [2005-01-29 3584]
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-02-18 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-28 99376]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-12 23888]
S3 EraserUtilDrv10720;EraserUtilDrv10720;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10720.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9489b43f-ee21-11dc-86be-000c7618c9b1}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fbf6f5cc-cb46-11dc-86ad-000c7618c9b1}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-12-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.excite.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
Trusted Zone: free.aol.com
Trusted Zone: *.turbotax.com

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.excite.com
FF - component: c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\documents and settings\Troy Johnson\Application Data\Mozilla\Firefox\Profiles\esjwlcsq.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npigl.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-01 11:39:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(876)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2009-01-01 11:48:31
ComboFix-quarantined-files.txt 2009-01-01 17:47:06
ComboFix2.txt 2008-12-31 12:57:36
ComboFix3.txt 2008-12-31 03:28:22
ComboFix4.txt 2008-12-28 13:32:59
ComboFix5.txt 2009-01-01 17:28:52

Pre-Run: 20,376,178,688 bytes free
Post-Run: 20,438,974,464 bytes free

233 --- E O F --- 2008-12-26 02:24:48


Report •

#15
January 1, 2009 at 12:42:18
Eset log :

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3730 (20090101)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=4bfd2055ee93c14395de5cba86bc35dc
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2009-01-01 08:35:45
# local_time=2009-01-01 02:35:45 (-0600, Central Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=465667
# found=0
# scan_time=6446


Report •

#16
January 1, 2009 at 12:55:26
That log is clean, obviously. Before we continue, are you still being redirected?

Report •

#17
January 1, 2009 at 12:57:02
yes, still being redirected.

Report •

#18
January 1, 2009 at 17:24:27
A friend suggested that I run DrWeb so I gave it a try. The scan found a couple of thing the other scans did not. My google problem seems to be fixed now and all scans are coming back clean. Is there anything else that I should do? Below is the DrWeb log:

cachemanager.ocx;c:\windows\downloaded program files;Adware.Cashman;Incurable.Deleted.;
wdmaud.sys;C:\WINDOWS\system32;Trojan.DownLoad.26637;Deleted.;


Report •

#19
January 1, 2009 at 18:14:58
Thanks for the info.

Go to start> run> type in combofix /u (note the space after combofix) then press enter> run. This will uninstall combofix so give the uninstaller a minute to run.

Go to start> control panel> add/remove programs and uninstall these programs:

Hijack This

Malwarebytes

Eset

You should keep AFT Cleaner and run it weekly.


You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster

Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

How is the computer operating?


Report •

#20
January 2, 2009 at 04:47:03
The computer seem to be operating better and we no longer have the redirect problem. My wife and kids thank you as they can now use their computer again.

Report •

#21
January 2, 2009 at 10:15:54
Glad we could help and thank you for your help.

Report •


Ask Question