Active Computer Hijacked Completely

[Active] Computer Hijacked Completely

Running XP can't restore or anything, can't run any spyware programs and AVG dosn't find anything. Here is a log from Hijacker

"Silent Runners.vbs ", revision 59, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++} "


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"MSMSGS" = " "C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"BitTorrent DNA" = " "C:\Program Files\DNA\btdna.exe" " [ "BitTorrent, Inc."]
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"gStart" = "C:\Garmin\gStart.exe" [ "GARMIN Corp."]
"SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [ "Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AVG8_TRAY" = "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [ "AVG Technologies CZ, s.r.o."]
"AlcxMonitor" = "ALCXMNTR.EXE" [ "Realtek Semiconductor Corp."]
"RoxWatchTray" = " "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" " [ "Sonic Solutions"]
"Adobe Reader Speed Launcher" = " "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" " [ "Adobe Systems Incorporated"]
"Nikon Transfer Monitor" = "C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe" [ "Nikon Corporation"]
"QuickTime Task" = " "C:\Program Files\QuickTime\QTTask.exe" -atboottime" [ "Apple Inc."]
"iTunesHelper" = " "C:\Program Files\iTunes\iTunesHelper.exe" " [ "Apple Inc."]
"GrooveMonitor" = " "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" " [MS]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe" [ "HP"]
"HPHUPD06" = "C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [ "Hewlett-Packard"]
"HP Software Update" = " "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" " [ "Hewlett-Packard Company"]
"HP Component Manager" = " "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" " [ "Hewlett-Packard Company"]
"HPHmon06" = "C:\WINDOWS\system32\hphmon06.exe" [ "Hewlett-Packard"]
"Acrobat Assistant 8.0" = " "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" " [ "Adobe Systems Inc."]
"Adobe_ID0EYTHM" = "C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [ "Adobe Systems Incorporated"]
"SunJavaUpdateSched" = " "C:\Program Files\Java\jre6\bin\jusched.exe" " [ "Sun Microsystems, Inc."]
"NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [ "Nero AG"]
"Intuit SyncManager" = "C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup" [null data]
"(Default)" = "(empty string)" [file not found]
"ISTray" = " "C:\Program Files\Spyware Doctor\pctsTray.exe" " [ "PC Tools"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{074C1DC5-9320-4A9A-947D-C042949C6216}\(Default) = (no title provided)
-> {HKLM...CLSID} = "ContributeBHO Class "
\InProcServer32\(Default) = "C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll" [ "Adobe Systems Incorporated."]
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\(Default) = "AcroIEHelperStub "
-> {HKLM...CLSID} = "Adobe PDF Link Helper "
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll" [ "Adobe Systems Incorporated"]
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\(Default) = "WormRadar.com IESiteBlocker.NavFilter "
-> {HKLM...CLSID} = "AVG Safe Search "
\InProcServer32\(Default) = "C:\Program Files\AVG\AVG8\avgssie.dll" [ "AVG Technologies CZ, s.r.o."]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Spybot-S&D IE Protection "
\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" [ "Safer Networking Limited"]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Groove GFS Browser Helper "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
{AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Conversion Toolbar Helper "
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" [ "Adobe Systems Incorporated"]
{DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper "
\InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" [ "Sun Microsystems, Inc."]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl "
-> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class "
\InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" [ "Sun Microsystems, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension "
-> {HKLM...CLSID} = "Display Panning CPL Extension "
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext "
-> {HKLM...CLSID} = "HyperTerminal Icon Ext "
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" [ "Hilgraeve, Inc."]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG8 Shell Extension "
-> {HKLM...CLSID} = "AVG8 Shell Extension Class "
\InProcServer32\(Default) = "C:\Program Files\AVG\AVG8\avgse.dll" [ "AVG Technologies CZ, s.r.o."]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes "
-> {HKLM...CLSID} = "iTunes "
\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" [ "Apple Inc."]
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper "
-> {HKLM...CLSID} = "Groove GFS Browser Helper "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar "
-> {HKLM...CLSID} = "Groove Folder Synchronization "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler "
-> {HKLM...CLSID} = "Groove GFS Stub Icon Handler "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook "
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler "
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler "
-> {HKLM...CLSID} = "Groove XML Icon Handler "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder) "
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder) "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub) "
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub) "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark) "
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark) "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub) "
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub) "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) "
-> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler "
-> {HKLM...CLSID} = "Outlook File Icon Extension "
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler "
-> {HKLM...CLSID} = "Microsoft Office Outlook "
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search "
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search "
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler "
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler "
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler "
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler "
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler "
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension "
-> {HKLM...CLSID} = "7-Zip Shell Extension "
\InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" [ "Igor Pavlov"]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu "
-> {HKLM...CLSID} = "Acrobat Elements Context Menu "
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" [ "Adobe Systems Inc."]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons "
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class "
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" [ "Nero AG"]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler "
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class "
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" [ "Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler "
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class "
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" [ "Nero AG"]
"{7D5C4BDD-B015-4401-8731-1507B87DE297}" = "QBVersionTool "
-> {HKLM...CLSID} = "VersionShellExt Class "
\InProcServer32\(Default) = "C:\Program Files\Common Files\Intuit\QuickBooks\QBVersionTool.dll" [ "Intuit Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook "
-> {HKLM...CLSID} = "Groove GFS Stub Execution Hook "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> avgrsstarter\DLLName = "avgrsstx.dll" [ "AVG Technologies CZ, s.r.o."]

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945} "
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter "
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler "
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class "
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" [ "Nero AG"]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info "
-> {HKLM...CLSID} = "PDF Shell Extension "
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" [ "Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000} "
-> {HKLM...CLSID} = "7-Zip Shell Extension "
\InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" [ "Igor Pavlov"]
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "
-> {HKLM...CLSID} = "Acrobat Elements Context Menu "
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" [ "Adobe Systems Inc."]
AVG8 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} "
-> {HKLM...CLSID} = "AVG8 Shell Extension Class "
\InProcServer32\(Default) = "C:\Program Files\AVG\AVG8\avgse.dll" [ "AVG Technologies CZ, s.r.o."]
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7} "
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class "
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" [ "Nero AG"]
SDContextExt\(Default) = "{70F8E90E-353A-47AB-B297-C576345EE693} "
-> {HKLM...CLSID} = "PC Tools Context Menu Extension "
\InProcServer32\(Default) = "C:\PROGRA~1\SPYWAR~1\SDCONT~1.DLL" [ "PC Tools"]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D} "
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000} "
-> {HKLM...CLSID} = "7-Zip Shell Extension "
\InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" [ "Igor Pavlov"]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D} "
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "
-> {HKLM...CLSID} = "Acrobat Elements Context Menu "
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" [ "Adobe Systems Inc."]
AVG8 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} "
-> {HKLM...CLSID} = "AVG8 Shell Extension Class "
\InProcServer32\(Default) = "C:\Program Files\AVG\AVG8\avgse.dll" [ "AVG Technologies CZ, s.r.o."]
SDContextExt\(Default) = "{70F8E90E-353A-47AB-B297-C576345EE693} "
-> {HKLM...CLSID} = "PC Tools Context Menu Extension "
\InProcServer32\(Default) = "C:\PROGRA~1\SPYWAR~1\SDCONT~1.DLL" [ "PC Tools"]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D} "
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D} "
-> {HKLM...CLSID} = "Groove GFS Context Menu Handler "
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"HonorAutoRunSetting" = (REG_DWORD) dword:0x00000001
{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Bliss.bmp "

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Bliss.bmp "


Autostart via AUTORUN.INF on local fixed drives:
------------------------------------------------

J:\
<<!>> J:\AUTORUN.INF -> "OPEN=Info.exe folder.htt 480 480" [ "XSS"]


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

AdobePremiereProCS3CameraArrival\
"Provider" = "Adobe Premiere Pro "
"ProgID" = "Shell.HWEventHandlerShellExecute "
"InitCmdLine" = " "C:\Program Files\Adobe\Adobe Premiere Pro CS3\Adobe Premiere Pro.exe" "
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7} "
-> {HKLM...CLSID} = "ShellExecute HW Event Handler "
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

BridgeCS3ImportMediaOnArrival\
"Provider" = "Adobe Bridge CS3 "
"InvokeProgID" = "Adobe.adobebridge "
"InvokeVerb" = "launch "
HKLM\SOFTWARE\Classes\Adobe.adobebridge\shell\launch\command\(Default) = "C:\Program Files\Adobe\Adobe Bridge CS3\bridgeproxy.exe -v %1" [ "Adobe Systems, Inc."]

CanonZB4PicturesOnArrival\
"Provider" = "ZoomBrowser EX "
"InvokeProgID" = "Zb.AutoplayHandler "
"InvokeVerb" = "open "
HKLM\SOFTWARE\Classes\Zb.AutoplayHandler\shell\open\command\(Default) = "C:\Program Files\Canon\ZoomBrowser EX\Program\ZoomBrowser.exe /AUTOPLAY "%1" " [empty string]

HPUnloadAutoplay\
"Provider" = "HP Image Transfer Software "
"InvokeProgID" = "HpqUnApl.Autoplay "
"InvokeVerb" = "Play "
HKLM\SOFTWARE\Classes\HpqUnApl.Autoplay\shell\Play\DropTarget\CLSID = "{E1A1C814-FD09-4c9d-BB4A-0394B836A1F0} "
-> {HKLM...CLSID} = (no title provided)
\LocalServer32\(Default) = "C:\Program Files\HP\Digital Imaging\Unload\HpqUnApl.exe" [ "Hewlett-Packard"]

iTunesBurnCDOnArrival\
"Provider" = "iTunes "
"InvokeProgID" = "iTunes.BurnCD "
"InvokeVerb" = "burn "
HKLM\SOFTWARE\Classes\iTunes.BurnCD\shell\burn\command\(Default) = " "C:\Program Files\iTunes\iTunes.exe" /AutoPlayBurn "%L" " [ "Apple Inc."]

iTunesImportSongsOnArrival\
"Provider" = "iTunes "
"InvokeProgID" = "iTunes.ImportSongsOnCD "
"InvokeVerb" = "import "
HKLM\SOFTWARE\Classes\iTunes.ImportSongsOnCD\shell\import\command\(Default) = " "C:\Program Files\iTunes\iTunes.exe" /AutoPlayImportSongs "%L" " [ "Apple Inc."]

iTunesPlaySongsOnArrival\
"Provider" = "iTunes "
"InvokeProgID" = "iTunes.PlaySongsOnCD "
"InvokeVerb" = "play "
HKLM\SOFTWARE\Classes\iTunes.PlaySongsOnCD\shell\play\command\(Default) = " "C:\Program Files\iTunes\iTunes.exe" /playCD "%L" " [ "Apple Inc."]

iTunesShowSongsOnArrival\
"Provider" = "iTunes "
"InvokeProgID" = "iTunes.ShowSongsOnCD "
"InvokeVerb" = "showsongs "
HKLM\SOFTWARE\Classes\iTunes.ShowSongsOnCD\shell\showsongs\command\(Default) = " "C:\Program Files\iTunes\iTunes.exe" /AutoPlayShowSongs "%L" " [ "Apple Inc."]

LightScribeOnArrivalAP\
"Provider" = "LightScribe Direct Disc Labeling "
"InvokeProgID" = "LightScribe.AutoPlayHandler "
"InvokeVerb" = "LabelLightScribeDisc "
HKLM\SOFTWARE\Classes\LightScribe.AutoPlayHandler\shell\LabelLightScribeDisc\command\(Default) = "C:\Program Files\Common Files\LightScribe\LsLauncher.exe" [ "Hewlett-Packard Company"]

MediaCapture9Music\
"Provider" = "Media Import "
"InvokeProgID" = "RoxioMediaCapture9 "
"InvokeVerb" = "Audio "
HKLM\SOFTWARE\Classes\RoxioMediaCapture9\shell\Audio\command\(Default) = "C:\Program Files\Roxio\Media Import 9\MediaCapture9.exe -audio %L" [ "Sonic Solutions"]

MediaCapture9Photos\
"Provider" = "Media Import "
"InvokeProgID" = "RoxioMediaCapture9 "
"InvokeVerb" = "Photo "
HKLM\SOFTWARE\Classes\RoxioMediaCapture9\shell\Photo\command\(Default) = "C:\Program Files\Roxio\Media Import 9\MediaCapture9.exe -photo %L" [ "Sonic Solutions"]

MediaCapture9VideoCamera\
"Provider" = "Media Import "
"ProgID" = "Shell.HWEventHandlerShellExecute "
"InitCmdLine" = "C:\Program Files\Roxio\Media Import 9\MediaCapture9.exe "
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7} "
-> {HKLM...CLSID} = "ShellExecute HW Event Handler "
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

MediaCapture9Videos\
"Provider" = "Media Import "
"InvokeProgID" = "RoxioMediaCapture9 "
"InvokeVerb" = "Video "
HKLM\SOFTWARE\Classes\RoxioMediaCapture9\shell\Video\command\(Default) = "C:\Program Files\Roxio\Media Import 9\MediaCapture9.exe -video %L" [ "Sonic Solutions"]

NeroAutoPlay7AudioToNeroDigital\
"Provider" = "Nero Burning ROM "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "AudioToNeroDigital_PlayCDAudioOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\AudioToNeroDigital_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe /Dialog:SaveTracks %L" [ "Nero AG"]

NeroAutoPlay7CDAudio\
"Provider" = "Nero Express "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "CDAudio_HandleCDBurningOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\CDAudio_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe -w /New:AudioCD" [ "Nero AG"]

NeroAutoPlay7CopyCD\
"Provider" = "Nero Burning ROM "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "CopyCD_PlayMusicFilesOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\CopyCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe /DialogiscCopy %L" [ "Nero AG"]

NeroAutoPlay7DataDisc\
"Provider" = "Nero Express "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "DataDisc_HandleCDBurningOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\DataDisc_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe -w /New:ISODisc" [ "Nero AG"]

NeroAutoPlay7LaunchNeroStartSmart\
"Provider" = "Nero StartSmart "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "LaunchNeroStartSmart_HandleCDBurningOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\LaunchNeroStartSmart_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe /AutoPlay" [ "Nero AG"]

NeroAutoPlay7PlayAudioCD\
"Provider" = "Nero ShowTime "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "PlayAudioCD_PlayMusicFilesOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\PlayAudioCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe /Play %L" [ "Nero AG"]

NeroAutoPlay7PlayDVD\
"Provider" = "Nero ShowTime "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "PlayDVD_PlayVideoFilesOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\PlayDVD_PlayVideoFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe /Play %L" [ "Nero AG"]

NeroAutoPlay7RipCD\
"Provider" = "Nero Burning ROM "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "RipCD_PlayCDAudioOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\RipCD_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe /Dialog:SaveTracks %L" [ "Nero AG"]

NeroAutoPlay7TranscodeVideo\
"Provider" = "Nero Recode "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "TranscodeVideo_PlayDVDMovieOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\TranscodeVideo_PlayDVDMovieOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Nero Recode\Recode.exe /New:CopyDVDVideo" [ "Nero AG"]

NeroAutoPlay7VideoCapture\
"Provider" = "Nero Vision "
"ProgID" = "Shell.HWEventHandlerShellExecute "
"InitCmdLine" = " "C:\Program Files\Nero\Nero 7\Nero Vision\NeroVision.exe" /New:VideoCapture "
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7} "
-> {HKLM...CLSID} = "ShellExecute HW Event Handler "
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

NeroAutoPlay7ViewPhotos\
"Provider" = "Nero PhotoSnap Viewer "
"InvokeProgID" = "Nero.AutoPlay7 "
"InvokeVerb" = "ViewPhotos_ShowPicturesOnArrival "
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\ViewPhotos_ShowPicturesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Nero PhotoSnap\PhotoSnapViewer.exe /" [ "Nero AG"]

Nikon Transfer\
"Provider" = "Nikon Transfer "
"InvokeProgID" = "Nikon Transfer "
"InvokeVerb" = "open "
HKLM\SOFTWARE\Classes\Nikon Transfer\shell\open\command\(Default) = "C:\Program Files\Nikon\Nikon Transfer\NktTransfer.exe /D=%L" [ "Nikon Corporation"]


Startup items in "Mike" & "All Users" startup folders:
------------------------------------------------------

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\digital imaging\bin\hpqtra08.exe" [ "Hewlett-Packard Co."]
"Monitor Apache Servers" -> shortcut to: "C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe" [ "Apache Software Foundation"]
"QuickBooks Update Agent" -> shortcut to: "C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe" [ "Intuit Inc."]


Enabled Scheduled Tasks:
------------------------

"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" [ "Apple Inc."]
"HP Usg Daily FY04" -> launches: "C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped06.exe" [empty string]
"{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}" -> launches: "C:\WINDOWS\TEMP\tempo-2133718.tmp" [file not found]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" [ "Apple Inc."]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93} "
-> {HKLM...CLSID} = "Adobe PDF "
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" [ "Adobe Systems Incorporated"]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF "
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" [ "Adobe Systems Incorporated"]
"{517BDDE4-E3A7-4570-B21E-2B52B6139FC7}" = (no title provided)
-> {HKLM...CLSID} = "Contribute Toolbar "
\InProcServer32\(Default) = "C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll" [ "Adobe Systems Incorporated."]

Explorer Bars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF "
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" [ "Adobe Systems Incorporated"]

HKLM\SOFTWARE\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization "
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Research "
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "Send to OneNote "
"MenuText" = "S&end to OneNote "
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C} "
-> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button "
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research "

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\
"MenuText" = "Spybot - Search && Destroy Configuration "
"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F} "
-> {HKLM...CLSID} = "Spybot-S&D IE Protection "
\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" [ "Safer Networking Limited"]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001 "
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger "
"MenuText" = "Windows Messenger "
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Apple Mobile Device, Apple Mobile Device, " "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" " [ "Apple Inc."]
AVG Free8 E-mail Scanner, avg8emc, "C:\PROGRA~1\AVG\AVG8\avgemc.exe" [ "AVG Technologies CZ, s.r.o."]
AVG Free8 WatchDog, avg8wd, "C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe" [ "AVG Technologies CZ, s.r.o."]
Bonjour Service, Bonjour Service, " "C:\Program Files\Bonjour\mDNSResponder.exe" " [ "Apple Inc."]
FLEXnet Licensing Service, FLEXnet Licensing Service, " "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" " [ "Macrovision Europe Ltd."]
iPod Service, iPod Service, " "C:\Program Files\iPod\bin\iPodService.exe" " [ "Apple Inc."]
Java Quick Starter, JavaQuickStarterService, " "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" " [ "Sun Microsystems, Inc."]
LightScribeService Direct Disc Labeling Service, LightScribeService, " "C:\Program Files\Common Files\LightScribe\LSSrvc.exe" " [ "Hewlett-Packard Company"]
PC Tools Auxiliary Service, sdAuxService, "C:\Program Files\Spyware Doctor\pctsAuxs.exe" [ "PC Tools"]
PC Tools Security Service, sdCoreService, "C:\Program Files\Spyware Doctor\pctsSvc.exe" [ "PC Tools"]
PLFlash DeviceIoControl Service, PLFlash DeviceIoControl Service, "C:\WINDOWS\system32\IoctlSvc.exe" [ "Prolific Technology Inc."]
Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\system32\HPZipm12.exe" [ "HP"]
QBCFMonitorService, QBCFMonitorService, " "C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe" " [null data]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" [ "Adobe Systems Incorporated."]
hpzlnt11\Driver = "hpzlnt11.dll" [ "HP"]
Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]


---------- (launch time: 2009-06-25 20:46:02)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 59 seconds, including 7 seconds for message boxes)

 

Combo Fix log

ComboFix 09-06-26.02 - Mike 06/27/2009 9:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.215 [GMT -7:00]
Running from: c:\documents and settings\Mike\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090626-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Help\agt0405.hlp
c:\windows\Help\agt0408.hlp
c:\windows\Help\agt0415.hlp
c:\windows\Help\agt0419.hlp
c:\windows\system32\MSIVXblhhbattampmwmiqnkxyeymyjqosfbdw.dll
c:\windows\system32\MSIVXcount
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
J:\Autorun.inf
J:\Desktop.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSIVXSERV.SYS
-------\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 )))))))))))))))))))))))))))))))
.

2009-06-27 07:14 . 2009-06-27 07:25 -------- d-----w- c:\documents and settings\Kelly\Application Data\BitTorrent
2009-06-27 05:17 . 2009-06-27 05:17 -------- d-----w- c:\documents and settings\Mike\Application Data\Malwarebytes
2009-06-26 06:12 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-06-26 06:12 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-06-26 06:12 . 2009-02-05 20:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-06-26 06:12 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-06-26 06:12 . 2009-02-05 20:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-06-26 06:12 . 2009-02-05 20:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-06-26 06:12 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-06-26 06:12 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-06-26 06:12 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-06-26 06:12 . 2009-06-26 06:12 -------- d-----w- c:\program files\Alwil Software
2009-06-26 06:06 . 2009-06-17 18:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-26 06:06 . 2009-06-26 06:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-26 06:06 . 2009-06-26 06:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-26 06:06 . 2009-06-17 18:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-26 03:07 . 2009-06-26 03:07 578560 -c--a-w- c:\windows\system32\dllcache\user32.dll
2009-06-26 03:04 . 2009-06-26 03:04 -------- d-----w- c:\windows\ERUNT
2009-06-26 03:03 . 2009-06-26 03:19 -------- d-----w- C:\SDFix
2009-06-26 02:43 . 2009-06-27 06:37 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-26 02:41 . 2009-06-27 16:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-26 02:41 . 2009-06-26 02:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 21:50 . 2009-06-25 21:50 -------- d-----w- c:\documents and settings\Kelly\Application Data\Apple Computer
2009-06-25 21:37 . 2009-06-27 07:15 -------- d-----w- c:\documents and settings\Kelly\Local Settings\Application Data\Adobe
2009-06-25 21:37 . 2009-06-25 21:37 -------- d-----w- c:\documents and settings\Kelly\Local Settings\Application Data\Ahead
2009-06-24 20:48 . 2009-06-24 20:46 102664 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-06-24 20:46 . 2009-06-24 22:44 -------- d-----w- c:\documents and settings\Mike\.housecall6.6
2009-06-23 21:25 . 2009-06-23 21:25 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-06-21 05:03 . 2009-06-21 05:03 -------- d-----w- c:\documents and settings\Mike\Application Data\Xilisoft Corporation
2009-06-21 03:57 . 2009-06-21 03:57 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Intuit
2009-06-21 03:21 . 2009-06-21 03:20 737280 ----a-w- c:\windows\iun6002.exe
2009-06-21 03:05 . 2009-06-21 03:05 -------- d-----w- c:\documents and settings\Mike\Local Settings\Application Data\WinAVI
2009-06-19 14:28 . 2009-06-19 14:28 -------- d-----w- c:\program files\Common Files\supportsoft
2009-06-19 06:19 . 2007-06-28 21:09 1843200 ----a-w- c:\windows\system32\acXMLParser.dll
2009-06-19 06:19 . 2007-07-30 21:44 3518464 ----a-w- c:\windows\system32\cdintf300.dll
2009-06-19 06:12 . 2009-06-19 06:14 -------- d-----w- c:\program files\Common Files\Intuit
2009-06-19 06:12 . 2009-06-21 03:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Intuit
2009-06-19 06:12 . 2009-06-19 06:12 -------- d-----w- c:\program files\Intuit
2009-06-19 06:05 . 2009-06-19 06:05 -------- d-----w- c:\documents and settings\All Users\Application Data\SQL Anywhere 10
2009-06-19 06:05 . 2009-06-19 06:05 -------- d-----w- c:\documents and settings\All Users\Application Data\COMMON FILES
2009-06-19 06:04 . 2009-06-19 06:04 -------- d-----w- c:\program files\Microsoft.NET
2009-06-19 05:32 . 2009-06-19 05:33 -------- d-----w- c:\documents and settings\Mike\Application Data\Download Manager
2009-06-17 06:40 . 2009-06-17 06:42 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-17 06:40 . 2009-06-17 06:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-06-16 04:47 . 2009-06-16 04:47 -------- d-----w- c:\program files\Garmin GPS Plugin
2009-06-15 04:44 . 2009-06-15 04:44 -------- d-----w- c:\documents and settings\Mike\Application Data\Blackberry Desktop
2009-06-15 04:43 . 2009-06-19 03:44 256 ----a-w- c:\windows\system32\pool.bin
2009-06-15 04:43 . 2009-06-15 04:43 -------- d-----w- c:\documents and settings\Mike\Application Data\Research In Motion
2009-06-14 17:37 . 2009-06-15 14:46 -------- d-----w- c:\documents and settings\Mike\Application Data\GARMIN
2009-06-14 17:37 . 2009-06-14 17:37 -------- d-----w- c:\program files\DIFX
2009-06-14 17:37 . 2009-06-15 04:51 -------- d-----w- c:\program files\Garmin
2009-06-13 02:29 . 2001-08-18 05:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-06-13 02:28 . 2008-04-14 12:42 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-06-13 02:28 . 2008-04-14 07:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-13 02:28 . 2008-04-14 07:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-12 19:11 . 2009-06-12 19:11 -------- d-----w- c:\windows\Sun
2009-06-12 18:12 . 2009-06-12 18:11 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-12 18:11 . 2009-06-12 18:11 -------- d-----w- c:\program files\Java
2009-06-12 18:11 . 2009-06-12 18:11 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-06-12 18:11 . 2009-06-12 18:11 152576 ----a-w- c:\documents and settings\Mike\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-12 17:58 . 2007-06-08 00:22 49152 ----a-w- c:\documents and settings\Mike\Application Data\Adobe\Dreamweaver 9\Configuration\JSExtensions\WAGoogleToolkit.dll
2009-06-12 17:57 . 2007-12-27 19:31 49152 ----a-w- c:\documents and settings\Mike\Application Data\Adobe\Dreamweaver 9\Configuration\JSExtensions\WA_Kuler.dll
2009-06-12 17:56 . 2007-06-19 00:56 49152 ----a-w- c:\documents and settings\Mike\Application Data\Adobe\Dreamweaver 9\Configuration\JSExtensions\WAPayPalToolkit.dll
2009-06-12 17:52 . 2009-06-12 18:00 1878984 ----a-w- c:\documents and settings\Mike\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-06-12 17:45 . 2005-02-28 23:58 430080 ----a-w- c:\documents and settings\Mike\Application Data\Adobe\Dreamweaver 9\Configuration\JSExtensions\PLHFO.dll
2009-06-12 17:44 . 2000-12-03 23:22 36864 ----a-w- c:\documents and settings\Mike\Application Data\Adobe\Dreamweaver 9\Configuration\JSExtensions\DWsize.dll
2009-06-12 02:09 . 2009-06-12 02:13 -------- d-----w- c:\program files\Canon
2009-06-11 14:38 . 2009-06-19 04:04 -------- d-----w- c:\program files\World of Warcraft
2009-06-11 14:37 . 2007-03-20 21:49 2781184 ----a-w- c:\documents and settings\Mike\Application Data\Adobe\Dreamweaver 9\Configuration\Flash Player\authplay.dll
2009-06-11 14:24 . 2009-06-11 14:24 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-06-11 07:30 . 2009-06-11 07:30 -------- d-----w- c:\program files\Common Files\Control Panels
2009-06-11 07:21 . 2009-06-11 07:21 -------- d-----w- c:\documents and settings\All Users\Application Data\ALM
2009-06-11 06:24 . 2007-02-20 23:04 190696 ----a-w- c:\windows\system32\NPSWF32_FlashUtil.exe
2009-06-11 06:24 . 2007-02-20 23:04 2463976 ----a-w- c:\windows\system32\NPSWF32.dll
2009-06-11 06:01 . 2009-06-11 06:01 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-10 00:08 . 2009-06-10 00:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2009-06-10 00:03 . 2009-06-11 18:07 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-06-09 02:14 . 2009-06-15 14:46 -------- d-----w- c:\documents and settings\All Users\Application Data\GARMIN
2009-06-09 02:11 . 2007-03-08 23:18 8320 ----a-w- c:\windows\system32\drivers\grmnusb.sys
2009-06-09 02:11 . 2007-03-08 23:18 18432 ----a-w- c:\windows\system32\drivers\grmngen.sys
2009-06-09 02:11 . 2006-07-14 23:12 16512 ----a-w- c:\windows\system32\drivers\grmn0400.sys
2009-06-09 02:11 . 2006-07-14 23:10 17536 ----a-w- c:\windows\system32\drivers\grmn0200.sys
2009-06-09 02:11 . 2006-07-11 20:50 11776 ----a-w- c:\windows\system32\drivers\grmn1200.sys
2009-06-09 02:10 . 2009-06-15 14:45 -------- d-----w- C:\Garmin
2009-06-08 02:56 . 2009-06-08 02:56 -------- d-----w- c:\documents and settings\Mike\Application Data\Nikon
2009-06-08 01:10 . 2006-01-07 04:54 36864 ----a-w- c:\windows\system32\hppapml0.dll
2009-06-08 01:10 . 2006-01-07 04:54 393216 ----a-w- c:\windows\system32\hpzcon11.dll
2009-06-08 01:10 . 2006-01-07 04:54 196608 ----a-w- c:\windows\system32\hpzcoi11.dll
2009-06-08 01:10 . 2006-01-07 04:54 139345 ----a-w- c:\windows\system32\hpzlnt11.dll
2009-06-08 01:10 . 2006-01-07 04:54 9505 ----a-w- c:\windows\system32\hphmon06.dat
2009-06-08 00:30 . 2009-06-08 00:30 -------- d-----w- c:\documents and settings\Kelly\Local Settings\Application Data\Mozilla
2009-06-07 23:40 . 2009-06-25 21:50 -------- d-----w- c:\documents and settings\Kelly\Local Settings\Application Data\Apple Computer
2009-06-07 23:38 . 2009-06-27 07:16 -------- d-----w- c:\documents and settings\Kelly
2009-06-07 22:21 . 2006-10-27 02:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-06-07 22:18 . 2009-06-21 04:48 -------- d-----w- c:\program files\Microsoft Works
2009-06-07 22:18 . 2009-06-07 22:18 -------- d-----w- c:\program files\MSBuild
2009-06-07 22:12 . 2009-06-07 22:17 -------- d-----w- c:\windows\SHELLNEW
2009-06-07 22:11 . 2009-06-07 22:11 -------- d-----w- c:\documents and settings\Mike\Local Settings\Application Data\Microsoft Help
2009-06-07 22:10 . 2009-06-21 04:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-07 22:10 . 2009-06-07 22:10 -------- d--h--r- C:\MSOCache
2009-06-07 21:17 . 2009-06-12 17:42 -------- d-----w- c:\documents and settings\Mike\Local Settings\Application Data\Adobe
2009-06-07 20:50 . 2009-06-07 20:50 -------- d-----w- c:\documents and settings\All Users\Application Data\MySQL
2009-06-07 20:25 . 2009-06-25 21:39 -------- d-----w- c:\documents and settings\Mike\Application Data\BitTorrent
2009-06-07 20:23 . 2009-06-27 16:53 -------- d-----w- c:\documents and settings\Mike\Application Data\DNA
2009-06-07 20:23 . 2009-06-27 16:10 -------- d-----w- c:\program files\DNA
2009-06-07 20:23 . 2009-06-07 20:23 -------- d-----w- c:\documents and settings\Mike\Local Settings\Application Data\DNA
2009-06-07 20:23 . 2009-06-07 20:23 -------- d-----w- c:\program files\BitTorrent
2009-06-07 20:21 . 2009-06-07 20:21 -------- d-----w- c:\documents and settings\Mike\Application Data\Apple Computer
2009-06-07 20:21 . 2009-03-19 23:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-06-07 20:21 . 2008-04-17 19:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-06-07 20:20 . 2009-06-07 20:20 -------- d-----w- c:\program files\iPod
2009-06-07 20:20 . 2009-06-07 20:20 -------- d-----w- c:\program files\iTunes
2009-06-07 20:20 . 2009-06-07 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-06-07 20:19 . 2009-06-07 20:19 -------- d-----w- c:\program files\Bonjour
2009-06-07 20:19 . 2009-06-07 20:19 -------- d-----w- c:\program files\QuickTime
2009-06-07 20:18 . 2009-06-07 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-07 20:17 . 2009-06-07 20:17 -------- d-----w- c:\documents and settings\Mike\Local Settings\Application Data\Apple
2009-06-07 20:17 . 2009-06-07 20:17 -------- d-----w- c:\program files\Apple Software Update
2009-06-07 20:17 . 2009-06-14 17:37 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-07 20:17 . 2009-05-29 20:36 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-07 20:17 . 2009-05-29 20:36 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-06-07 20:17 . 2009-06-07 20:20 -------- d-----w- c:\program files\Common Files\Apple
2009-06-07 20:17 . 2009-06-07 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-06-07 16:50 . 2009-06-07 16:50 49152 ----a-r- c:\documents and settings\Mike\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2009-06-07 16:48 . 2009-06-07 16:48 335872 ----a-r- c:\documents and settings\Mike\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-27 06:44 . 2009-06-07 23:39 89904 ----a-w- c:\documents and settings\Kelly\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-26 05:12 . 2009-06-26 05:12 691712 ----a-w- c:\windows\isRS-000.tmp
2009-06-08 02:56 . 2009-06-07 16:47 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2009-06-08 01:16 . 2009-06-08 01:11 93422 ----a-w- c:\windows\HPHins03.dat
2009-06-08 01:15 . 2009-06-08 01:12 -------- d-----w- c:\program files\HP
2009-06-08 01:15 . 2009-06-08 01:15 45056 ----a-r- c:\documents and settings\Kelly\Application Data\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
2009-06-07 16:47 . 2003-03-19 02:05 106496 ----a-w- c:\windows\system32\ATL71.DLL
2009-06-07 04:32 . 2009-06-07 02:58 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-06-07 02:59 . 2009-06-07 02:59 -------- d-----w- c:\program files\microsoft frontpage
2009-06-07 02:55 . 2009-06-07 02:55 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-30 19:50 . 2009-05-30 19:50 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-05-07 15:32 . 2001-08-18 12:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:46 . 2001-08-18 12:00 666624 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:46 . 2009-06-07 03:31 81920 ------w- c:\windows\system32\ieencode.dll
2009-04-17 12:26 . 2001-08-18 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2001-08-18 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"BitTorrent DNA "= "c:\program files\DNA\btdna.exe" [2009-06-07 321344]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"gStart "= "c:\garmin\gStart.exe" [2008-08-13 1891416]
"SpybotSD TeaTimer "= "j:\spybot - search & destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxWatchTray "= "c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-03-06 236016]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"Nikon Transfer Monitor "= "c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2008-09-30 485208]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"HPDJ Taskbar Utility "= "c:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2006-01-07 172032]
"HPHUPD06 "= "c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2006-01-07 49152]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager "= "c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"HPHmon06 "= "c:\windows\system32\hphmon06.exe" [2006-01-07 659456]
"Acrobat Assistant 8.0 "= "c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-11 624248]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-06-12 148888]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"Intuit SyncManager "= "c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2008-09-09 623880]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"AlcxMonitor "= "ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\digital imaging\bin\hpqtra08.exe [2004-5-28 241664]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-9-11 984352]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=" "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\DNA\\btdna.exe "=
"c:\\Program Files\\BitTorrent\\bittorrent.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe "=
"c:\\Program Files\\World of Warcraft\\Launcher.exe "=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe "=
"c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP "= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP "= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP "= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP "= 50901:TCP:Adobe Version Cue CS3 Server

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [6/25/2009 11:12 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/25/2009 11:12 PM 20560]
S3 INIDVD;Initio USB DVD Filter Driver;c:\windows\system32\drivers\inidvd.sys [6/6/2009 8:11 PM 7936]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe "
.
Contents of the 'Scheduled Tasks' folder

2009-06-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-06-27 c:\windows\Tasks\HP Usg Daily FY04.job
- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped06.exe [2009-06-08 04:54]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-<NO NAME> - (no file)


.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll
FF - ProfilePath - c:\documents and settings\Mike\Application Data\Mozilla\Firefox\Profiles\nupxds3c.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-27 12:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\INIDVD]
"ImagePath "=multi: "system32\DRIVERS\inidvd.sys\00 "

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\INIDVD]
"ImagePath "=multi: "system32\DRIVERS\inidvd.sys\00 "
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\HPZipm12.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
.
**************************************************************************
.
Completion time: 2009-06-27 12:07 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-27 19:07

Pre-Run: 9,961,312,256 bytes free
Post-Run: 10,013,990,912 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

301 --- E O F --- 2009-06-10 10:05

 

Hijack this log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:34:51 AM, on 6/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Garmin\gStart.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - J:\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe "
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] J:\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\digital imaging\bin\hpqtra08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1244351085125
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\hpbpro.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\hpboid.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

--
End of file - 12138 bytes