Active We need to remove; adware:win32/bookspace

[Active] We need to remove; adware:win32/bookspace

First; yesterday I downloaded Windows Defender. Everytime we run the McAfee, Windows Defender, SuperAntiSpyware and Ad-aware the computer shuts down about 15 to 20 minutes into the scans, and of course, it never completes the scan - everytime. I am new to this site so let me know if I did not do this correctly. Below please find the log that you requested.
Thank you,
mskriss2009


DDS (Ver_09-12-01.01) - FAT32x86
Run by PAUL W at 12:32:31.42 on Fri 12/11/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.33 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
SVCHOST.EXE
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\fxssvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\pctspk.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\AOL\1098491577\ee\AOLSoftware.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE
C:\Program Files\IC Card Reader Driver v1.8e2\Disk_Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
C:\PROGRA~1\AOL9~1.1\waol.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\AOL9~1.1\shellmon.exe
C:\WINDOWS\system32\sol.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\CHRISTINE\My Documents\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://home.jzip.com
uSearch Page = hxxp://www.google.com
uWindow Title = Microsoft Internet Explorer powered by Verizon Broadband
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar =
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant =
BHO: Yahoo! Companion BHO: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_5_7_0.dll
BHO: {0A94B111-4504-4e26-AB05-E61E474AA38B} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Ask.com Toolbar BHO: {d4027c7f-154a-4066-a1ad-4243d8127440} - Ask.com Toolbar
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
BHO: {F4D76F01-7896-458a-890F-E1F05C46069F} - No File
TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: Yahoo! Companion: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_5_7_0.dll
TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
TB: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - No File
TB: {F4D76F09-7896-458a-890F-E1F05C46069F} - No File
TB: Ask.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} -
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll
uRun: [MSMSGS] "c:\program files\messenger\MSMSGS.EXE" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [AROReminder]
uRun: [OM_Monitor] c:\program files\olympus\olympus master\Monitor.exe
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe "
uRun: [AOL Fast Start] "c:\progra~1\aol9~1.1\AOL.EXE" -b
mRun: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
mRun: [PCTVOICE] pctspk.exe
mRun: [Pad39A-HtEHL] D:\Pad39A.exe
mRun: [OM_Monitor] c:\program files\olympus\olympus master\FirstStart.exe
mRun: [Motive SmartBridge] c:\progra~1\verizo~1\suppor~1\smartb~1\MotiveSB.exe
mRun: [InCD] c:\program files\ahead\incd\InCD.exe
mRun: [HostManager] c:\program files\common files\aol\1098491577\ee\AOLSoftware.exe
mRun: [EPSON Stylus CX6400] c:\windows\system32\spool\drivers\w32x86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400 "
mRun: [Disk Monitor] c:\program files\\ic card reader driver v1.8e2\Disk_Monitor.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
StartupFolder: c:\docume~1\paulw~1\startm~1\programs\startup\eventr~1.lnk - c:\program files\mindscape\printmaster\PMREMIND.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\broadb~1.lnk - c:\program files\verizon online\support center\bin\matcli.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html
IE: &Viewpoint Search - c:\program files\viewpoint\viewpoint toolbar\ViewBar.dll/CXTSEARCH.HTML
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\paulw~1\applic~1\mozilla\firefox\profiles\ynd8atdw.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=WCLV5&o=14201&locale=en_US&q=
FF - plugin: c:\documents and settings\paul w\application data\mozilla\firefox\profiles\ynd8atdw.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07074039.dll
FF - plugin: c:\program files\mcafee\supportability\mvt\NPMVTPlugin.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2003-11-25 9344]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-4-5 214664]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2003-11-25 389504]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2005-11-25 31896]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-4-5 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-4-5 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-4-5 40552]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [2003-5-29 166656]
S2 .NET Connection Service;.NET Framework Service; [x]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-4-5 34248]
S3 pmxscan;Visioneer USB Service;c:\windows\system32\drivers\usbscan.sys [2004-11-12 15104]

=============== Created Last 30 ================

2009-12-07 20:01:50 0 d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-12-07 17:36:10 215920 ----a-w- c:\windows\system32\muweb.dll
2009-12-07 17:36:08 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2009-12-07 17:36:06 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-12-07 04:35:11 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-12-07 02:14:30 0 d-----w- c:\docume~1\paulw~1\applic~1\McAfee

==================== Find3M ====================

2009-12-11 15:10:36 1536 ----a-w- c:\windows\system32\TrueSoft.dat
2009-12-07 02:23:00 61224 ----a-w- c:\documents and settings\paul w\GoToAssistDownloadHelper.exe
2009-11-05 02:36:04 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 07:47:00 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:47:00 832512 ----a-w- c:\windows\system32\dllcache\wininet.dll
2009-10-29 07:47:00 233472 ------w- c:\windows\system32\dllcache\webcheck.dll
2009-10-28 14:36:12 70656 ------w- c:\windows\system32\dllcache\ie4uinit.exe
2009-10-28 14:36:12 13824 ------w- c:\windows\system32\dllcache\ieudinit.exe
2009-10-28 06:54:16 634632 ------w- c:\windows\system32\dllcache\iexplore.exe
2009-10-28 06:52:46 161792 ----a-w- c:\windows\system32\dllcache\ieakui.dll
2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38:36 75776 ------w- c:\windows\system32\dllcache\strmfilt.dll
2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38:36 25088 ------w- c:\windows\system32\dllcache\httpapi.dll
2009-10-20 16:20:16 265728 ------w- c:\windows\system32\drivers\http.sys
2009-10-20 16:20:16 265728 ------w- c:\windows\system32\dllcache\http.sys
2009-10-13 10:30:16 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-13 10:30:16 270336 ------w- c:\windows\system32\dllcache\oakley.dll
2009-10-12 13:38:20 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38:20 149504 ------w- c:\windows\system32\dllcache\rastls.dll
2009-10-12 13:38:18 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:38:18 79872 ------w- c:\windows\system32\dllcache\raschap.dll
1998-11-17 17:09:06 24576 ----a-w- c:\windows\inf\Vizpnpin.exe
1998-10-12 17:23:22 40960 ----a-w- c:\windows\inf\vizpnp\Vipersti.dll
1998-07-30 18:44:02 19112 ----a-w- c:\windows\inf\vizpnp\Pmxscan.sys
2008-08-28 04:10:04 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082720080828\index.dat

============= FINISH: 12:35:24.23 ===============

 

Regarding adware:win32/bookspace

From mskriss2009;
I forgot to paste the second part of the log that you requested. Sorry. Please find it below.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 11/21/2003 3:07:07 PM
System Uptime: 12/11/2009 10:09:30 AM (2 hours ago)

Motherboard: | | SiS-651
Processor: Intel(R) Celeron(R) CPU 2.20GHz | Socket 478 | 2191/100mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (FAT32) - 112 GiB total, 76.422 GiB free.
D: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
Description:
Device ID: ROOT\IMAGE\0000
Manufacturer: Visioneer Inc.
Name:
PNP Device ID: ROOT\IMAGE\0000
Service:

Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
Description:
Device ID: ROOT\IMAGE\0001
Manufacturer: Visioneer Inc.
Name:
PNP Device ID: ROOT\IMAGE\0001
Service:

Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
Description:
Device ID: ROOT\IMAGE\0002
Manufacturer:
Name:
PNP Device ID: ROOT\IMAGE\0002
Service:

==== System Restore Points ===================

RP62: 9/13/2009 3:20:00 AM - System Checkpoint
RP63: 9/14/2009 3:20:48 PM - System Checkpoint
RP64: 9/17/2009 3:55:26 PM - System Checkpoint
RP65: 9/19/2009 12:02:25 AM - System Checkpoint
RP66: 9/21/2009 12:49:32 AM - System Checkpoint
RP67: 9/22/2009 8:06:48 PM - System Checkpoint
RP68: 9/23/2009 8:37:58 PM - System Checkpoint
RP69: 9/26/2009 11:21:32 AM - Software Distribution Service 3.0
RP70: 9/27/2009 1:05:51 PM - System Checkpoint
RP71: 9/28/2009 7:25:45 PM - System Checkpoint
RP72: 9/29/2009 8:59:17 PM - System Checkpoint
RP73: 10/1/2009 12:25:24 PM - System Checkpoint
RP74: 10/2/2009 7:40:29 PM - System Checkpoint
RP75: 10/3/2009 9:54:12 PM - System Checkpoint
RP76: 10/4/2009 10:21:15 PM - System Checkpoint
RP77: 10/6/2009 2:39:25 PM - System Checkpoint
RP78: 10/8/2009 12:22:07 PM - System Checkpoint
RP79: 10/9/2009 7:55:31 PM - System Checkpoint
RP80: 10/11/2009 9:30:39 PM - System Checkpoint
RP81: 10/13/2009 3:27:53 PM - System Checkpoint
RP82: 10/14/2009 5:25:51 PM - System Checkpoint
RP83: 10/15/2009 3:00:29 PM - Software Distribution Service 3.0
RP84: 10/21/2009 4:28:12 PM - System Checkpoint
RP85: 10/22/2009 6:37:53 PM - System Checkpoint
RP86: 10/24/2009 1:54:29 AM - System Checkpoint
RP87: 10/25/2009 3:13:17 PM - System Checkpoint
RP88: 10/31/2009 6:04:12 PM - System Checkpoint
RP89: 11/3/2009 11:28:21 AM - System Checkpoint
RP90: 11/4/2009 4:01:21 PM - Software Distribution Service 3.0
RP91: 11/7/2009 1:03:27 AM - System Checkpoint
RP92: 11/8/2009 5:45:14 PM - System Checkpoint
RP93: 11/11/2009 3:00:59 PM - Software Distribution Service 3.0
RP94: 11/15/2009 1:57:44 PM - System Checkpoint
RP95: 11/24/2009 4:16:16 PM - System Checkpoint
RP96: 11/25/2009 3:00:42 PM - Software Distribution Service 3.0
RP97: 11/26/2009 7:36:09 PM - System Checkpoint
RP98: 12/5/2009 7:24:40 PM - System Checkpoint
RP99: 12/6/2009 9:12:42 PM - Installed McAfee Virtual Technician
RP100: 12/6/2009 11:19:23 PM - Removed SUPERAntiSpyware Free Edition
RP101: 12/6/2009 11:35:00 PM - Software Distribution Service 3.0
RP102: 12/7/2009 12:24:40 AM - Microsoft Antimalware Checkpoint
RP103: 12/7/2009 3:00:56 PM - Software Distribution Service 3.0
RP104: 12/8/2009 6:38:54 PM - Software Distribution Service 3.0
RP105: 12/9/2009 3:00:44 PM - Software Distribution Service 3.0
RP106: 12/10/2009 11:15:41 PM - Installed Windows Defender
RP107: 12/10/2009 11:20:34 PM - Software Distribution Service 3.0

==== Installed Programs ======================


IC Card Reader Driver v1.8e2
1999 World Book (Deluxe)
2020 Search
Acoustica Effects Pack
Acrobat.com
Adobe AIR
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0.1
Adobe Reader 9.2
Ahead InCD
Ahead InCD EasyWrite Reader
Ahead NeroMediaPlayer
American Greetings® Art & More Store
AOL Coach Version 1.0(Build:20040229.1 en)
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Deskbar
AOL Instant Messenger
AOL Toolbar 5.0
AOL Uninstaller (Choose which Products to Remove)
AOL You've Got Pictures Screensaver
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft Software Suite
Ask Toolbar
AuraScope Screen Saver (remove only)
Bonjour
Broadband Support Center
Civil War Generals II Demo
Conference Client Uninstall
Cosmopolitan Virtual Makeover 3
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
Diskeeper Lite
ElectricSheep 2.6.6
Emergency Cash Generators
EPSON CardMonitor
EPSON Copy Utility
EPSON ES CX6400 Manual
EPSON Photo Print
EPSON PhotoStarter3.0
EPSON Printer Software
EPSON Scan
EPSON Smart Panel
EPSON Web-To-Page
eVoice Player 1.0
getPlus(R) for Adobe
Goleads Marketing CRM
Google Earth
GoToMeeting/GoToWebinar 3.0.0.198
Hidden Expedition - Titanic (remove only)
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
HSP56 MR Drivers
Image Web Server IE Plugins 1,7,0,424
ImageMixer VCD/DVD2 for OLYMPUS
InterActual Player
IPRO Tech Coding Client
iTunes
J2SE Runtime Environment 5.0 Update 7
J2SE Runtime Environment 5.0 Update 9
JadeCRM Updater
JadeCRM Updater (C:\Program Files\Jade Updater\)
JadeCRM Updater (C:\Program Files\Jade Updater\) #3
Java(TM) 6 Update 15
Java(TM) 6 Update 7
jZip
Learn2 Player (Uninstall Only)
Lords of Magic Demo
McAfee SecurityCenter
McAfee Virtual Technician
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework Client Profile - PREVIEW
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Professional
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft VC9 runtime libraries
Microsoft Web Publishing Wizard 1.52
Mirage Driver 1.1
MobileMe Control Panel
Mozilla Firefox (3.5.5)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyDSC2
Nero - Burning Rom
NewYorkSample Screen Saver
OLYMPUS CAMEDIA Master 1.11
OLYMPUS Master
OpenOffice.org Installer 1.0
Pdf995
PdfEdit995
PhotoWorks
PowerDVD
Precision Mapping Quick Finder 3.0
Precision Mapping Quick Finder 3.0
PrintMaster 7.00
Pure Networks Port Magic
QuickStitch
QuickTime
R.E. Lee Civil War General
RealPlayer
Rhapsody Player Engine
Safari
ScanToWeb
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
SereneScene Marine Aquarium 2
Serif DrawPlus 3.0
Sierra Utilities
Signature995
SiS Audio Driver
Smart Defrag 1.11
Solitaire Antics Deluxe
Spin It Again
The Weather Channel Desktop 6
Uniblue RegistryBooster 2010
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
URGE
Verizon Online
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar (Remove Only)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Web Savings from Ebates
WebFldrs XP
Windows Defender
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

12/7/2009 2:13:44 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
12/7/2009 2:13:44 AM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/7/2009 2:13:34 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments " " in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
12/7/2009 12:18:41 AM, error: Service Control Manager [7031] - The McAfee Real-time Scanner service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/6/2009 8:57:40 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the McAfee SystemGuards service to connect.
12/6/2009 8:57:40 PM, error: Service Control Manager [7000] - The McAfee SystemGuards service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/6/2009 8:56:29 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
12/6/2009 8:56:29 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/6/2009 8:55:08 PM, error: Service Control Manager [7000] - The .NET Framework Service service failed to start due to the following error: The system cannot find the path specified.
12/6/2009 3:22:48 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the mcmscsvc service.
12/6/2009 11:22:53 PM, error: Microsoft Antimalware [2001] -
12/6/2009 11:19:40 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
12/5/2009 6:16:04 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
12/4/2009 7:50:03 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.

==== End Of File ===========================

 

Dear Broni,
Three things have happened since you so kindly repsonded to our problem in mid- December. 1. my Dad went into the hospital and yesterday went to a rehab after surgery. 2. A friend highly recommened AVAST. Since ComboFixer seems like a Very heavy duty clean up, I decided to run AVAST first. The first run through of AVAST shut down at 93%. Today, on the second run through it made it all the way without shutting down. I have two questions; 1. If I had the full address location for; adware:win32/bookspace I would find the correct file and ask AVAST to run just that file or folder so that I could double check to be sure that the worm is gone and not just hidding. I've been told that it is in Windows. How can I find the address or folder or file for AVAST to run? 2. If you want, I will run another log for you, just let me know. We need to be sure that the worm is gone. What do you think should be the next step? Thank you for all your help!! Christine

 

Dear Broni,
I have run ComboFix and have that log. Also, as you directed, I have run HijackThis and have that log. I'm not clear as to where or how I am supposed to get these logs to you. I am aware of zipping and unzipping but I have not done it so I am not clear on how to do it. Let me know what to do and how to do it and I will take care of it.
Thank you,
Christine

 

Dear Broni,
I downloaded and ran ComboFix and HijackThis. We have AVAST on this system but it was turned off while I ran those other scans. When you say, AV do you mean AVAST? I will past in those logs before. But before I do that I want to tell you that ComboFix found Starware 337. When both scans were done I did a seach on this system for anything with the word Starware and came up with a l-o-t! Obviously ComboFix has not rid this system of that spyware. Then I went looking for a description of Starware and now realize just how difficult it will be to get rid of but we sure want it gone asap. How can we get rid of it? I thought about going down the list that the search produced and just hit delete, delete, delete. Would that cause a problem if I did that? Can you tell us if we have other infections besides Starware?
I'll post the logs now. Thanks......Christine

ComboFix 10-01-03.03 - PAUL W 01/03/2010 18:40:23.1.1 - FAT32x86
Running from: c:\documents and settings\PAUL W\My Documents\Downloads\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100103-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\PAULW~1\Desktop\EDIRec~1.exe
c:\documents and settings\CHRISTINE\Local Settings\Temporary Internet Files\Logger.log
c:\documents and settings\CHRISTINE\Local Settings\Temporary Internet Files\Tvm.log
c:\documents and settings\PAUL W\Local Settings\Temporary Internet Files\Tvm.log
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\desktop
c:\windows\desktop\PhotoWorks v2.41.lnk
c:\windows\inf\dm.inf
c:\windows\inf\dm.PNF
c:\windows\patch.exe
c:\windows\reg.reg
c:\windows\system32\config\systemprofile\Application Data\Starware337
c:\windows\system32\config\systemprofile\Application Data\Starware337\Dating\DatingOptions.xml
c:\windows\system32\config\systemprofile\Application Data\Starware337\Dating\DatingOptions.xml.backup
c:\windows\system32\config\systemprofile\Application Data\Starware337\Free_Credit_Score\Free_Credit_ScoreOptions.xml
c:\windows\system32\config\systemprofile\Application Data\Starware337\Free_Credit_Score\Free_Credit_ScoreOptions.xml.backup
c:\windows\system32\config\systemprofile\Application Data\Starware337\Recipe_RSS\Recipe_RSSOptions.xml
c:\windows\system32\config\systemprofile\Application Data\Starware337\Recipe_RSS\Recipe_RSSOptions.xml.backup
c:\windows\system32\config\systemprofile\Application Data\Starware337\Ringtones\RingtonesOptions.xml
c:\windows\system32\config\systemprofile\Application Data\Starware337\Ringtones\RingtonesOptions.xml.backup
c:\windows\system32\config\systemprofile\Application Data\Starware337\Search_Recipes\Search_RecipesOptions.xml
c:\windows\system32\config\systemprofile\Application Data\Starware337\Search_Recipes\Search_RecipesOptions.xml.backup

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_.NET_CONNECTION_SERVICE
-------\Service_.NET Connection Service


((((((((((((((((((((((((( Files Created from 2009-12-03 to 2010-01-03 )))))))))))))))))))))))))))))))
.

2010-01-02 06:40 . 2009-12-02 13:19 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-01-02 03:25 . 2009-12-02 13:19 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-02 03:20 . 2010-01-02 03:20 -------- d--h--w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2009-12-23 00:58 . 2009-12-23 00:58 -------- d-----w- c:\documents and settings\PAUL W\Local Settings\Application Data\FreeFixer
2009-12-23 00:58 . 2009-12-23 00:58 -------- d-----w- c:\documents and settings\PAUL W\Application Data\FreeFixer
2009-12-23 00:58 . 2009-12-23 00:58 -------- d-----w- c:\program files\FreeFixer
2009-12-14 04:42 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-12-14 04:42 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-12-14 04:42 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-12-14 04:42 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-12-14 04:42 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-12-14 04:42 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-12-14 04:42 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-12-14 04:42 . 2009-11-24 23:51 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-12-14 04:41 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-12-14 04:41 . 2009-12-14 04:41 -------- d-----w- c:\program files\Alwil Software
2009-12-13 00:31 . 2009-12-13 00:31 -------- d-----w- c:\program files\AVG
2009-12-13 00:31 . 2009-12-13 00:31 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-12-12 20:34 . 2009-11-21 15:51 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2009-12-11 04:15 . 2009-12-11 04:15 -------- d-----w- c:\program files\Windows Defender
2009-12-07 20:01 . 2009-12-07 20:01 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-12-07 17:36 . 2009-08-07 00:23 215920 ----a-w- c:\windows\system32\muweb.dll
2009-12-07 17:36 . 2009-08-07 00:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-12-07 04:35 . 2009-11-03 01:42 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-12-07 02:14 . 2009-12-07 02:14 -------- d-----w- c:\documents and settings\PAUL W\Application Data\McAfee
2009-12-05 22:48 . 2002-08-29 10:00 185344 ----a-w- c:\windows\system32\Thawbrkr.dll
2009-12-05 22:48 . 2002-08-29 10:00 185344 ----a-w- c:\windows\system32\dllcache\thawbrkr.dll
2009-12-05 22:48 . 2002-08-29 10:00 10752 ----a-w- c:\windows\system32\dllcache\c_iscii.dll
2009-12-05 22:48 . 2002-08-29 10:00 10752 ----a-w- c:\windows\system32\c_iscii.dll
2009-12-05 22:48 . 2002-08-29 10:00 5632 ----a-w- c:\windows\system32\kbdusa.dll
2009-12-05 22:48 . 2002-08-29 10:00 5632 ----a-w- c:\windows\system32\dllcache\kbdusa.dll
2009-12-05 22:48 . 2002-08-29 10:00 6144 ----a-w- c:\windows\system32\ftlx041e.dll
2009-12-05 22:48 . 2002-08-29 10:00 6144 ----a-w- c:\windows\system32\dllcache\ftlx041e.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 23:54 . 2003-10-09 23:28 1536 ----a-w- c:\windows\system32\TrueSoft.dat
2009-12-07 04:22 . 2004-11-17 21:23 36104 ----a-w- c:\documents and settings\PAUL W\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-07 02:23 . 2008-03-11 23:30 61224 ----a-w- c:\documents and settings\PAUL W\GoToAssistDownloadHelper.exe
2009-11-05 02:36 . 2009-11-05 02:36 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 07:47 . 2004-08-24 01:32 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2003-05-29 20:02 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ------w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2003-05-29 20:02 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2003-05-29 20:02 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2003-05-29 20:02 79872 ----a-w- c:\windows\system32\raschap.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "c:\program files\Messenger\MSMSGS.EXE" [2008-04-14 1695232]
"OM_Monitor "= "c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 57344]
"DW6 "= "c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-10-08 818288]
"AOL Fast Start "= "c:\program files\AOL 9.1\AOL.EXE" [2007-10-27 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager "= "c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"PCTVOICE "= "pctspk.exe" [2002-07-10 167936]
"OM_Monitor "= "c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2006-05-16 40960]
"Motive SmartBridge "= "c:\progra~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe" [2006-06-30 385024]
"HostManager "= "c:\program files\Common Files\AOL\1098491577\ee\AOLSoftware.exe" [2008-06-24 41824]
"EPSON Stylus CX6400 "= "c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE" [2003-06-03 99840]
"Disk Monitor "= "c:\program files\\IC Card Reader Driver v1.8e2\Disk_Monitor.exe" [2002-12-12 440832]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"AOLDialer "= "c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-19 198160]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

c:\documents and settings\PAUL W\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [1998-6-6 325632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Broadband Support Center.lnk - c:\program files\Verizon Online\Support Center\bin\matcli.exe [2006-6-29 217088]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-3-21 113664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\System32\\SPOOL\\DRIVERS\\W32X86\\3\\SAGENT4.EXE "=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe "=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe "=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe "=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\AOLTSMON.EXE "=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\Aoltpspd.exe "=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe "=
"c:\\WINDOWS\\System32\\FXSCLNT.exe "=
"c:\\Program Files\\Common Files\\AOL\\1098491577\\ee\\aolservicehost.exe "=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Common Files\\AOL\\1098491577\\EE\\aolsoftware.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\AIM\\aim.exe "=
"c:\\Program Files\\AOL 9.1\\waol.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\WINDOWS\\System32\\dpvsetup.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP "= 1723:TCPxpsp2res.dll,-22015
"1701:UDP "= 1701:UDPxpsp2res.dll,-22016
"500:UDP "= 500:UDPxpsp2res.dll,-22017

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [11/25/2003 6:15 PM 9344]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/1/2010 10:25 PM 64288]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [12/13/2009 11:42 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/13/2009 11:42 PM 20560]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/2/2009 8:19 AM 1181328]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/26/2007 11:21 PM 24652]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [11/25/2005 5:43 PM 31896]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [5/29/2003 3:03 PM 166656]
S3 pmxscan;Visioneer USB Service;c:\windows\system32\drivers\usbscan.sys [11/12/2004 12:48 AM 15104]
S4 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [11/25/2003 6:15 PM 389504]
.
Contents of the 'Scheduled Tasks' folder

2010-01-03 c:\windows\Tasks\{E4AE0E39-6934-476A-BBD3-94A7EC17F964}_PAULS112003_PAUL W.job
- c:\windows\system32\mobsync.exe [2003-05-29 01:12]

2009-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-12-21 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-08-30 23:15]

2010-01-03 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 03:24]

2010-01-03 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 03:24]

2010-01-03 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 03:24]

2010-01-03 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 03:24]

2010-01-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 03:24]

2010-01-03 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://home.jzip.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar =
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
IE: &Viewpoint Search - c:\program files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {94E5218F-9737-4FC2-8457-567B1FF23DC0} - hxxp://utilities.pcpitstop.com/Nirvana/controls/DiskMD3Ctrl.dll
DPF: {A553720A-BFED-4EA4-A71F-7EFCA690A1F7} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcpitstopAntiVirus.dll
FF - ProfilePath - c:\documents and settings\PAUL W\Application Data\Mozilla\Firefox\Profiles\ynd8atdw.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=WCLV5&o=14201&locale=en_US&q=
FF - plugin: c:\documents and settings\PAUL W\Application Data\Mozilla\Firefox\Profiles\ynd8atdw.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service
.
.
------- File Associations -------
.
.
- - - - ORPHANS REMOVED - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-AROReminder - (no file)
HKLM-Run-Pad39A-HtEHL - D:\Pad39A.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove- IC Card Reader Driver - c:\windows\iun6002.exe
AddRemove-v1.8e2 - c:\windows\iun6002.exe
AddRemove-AOLAntivirus - c:\program files\mcafee.com\antivirus\uninst.exe
AddRemove-SiS7012 - c:\progra~1\SiS7012\Uninst\uninst2k.exe PCI\VEN_1039&DEV_7012



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 18:55
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1149776449-637232851-279249334-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Enroute Imaging\QuickStitch\* "!]
"NumOfRun "= "2 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2216)
c:\windows\system32\WININET.dll
c:\progra~1\VERIZO~1\SUPPOR~1\SMARTB~1\SBHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Common Files\aolshare\aolshcpy.dll
c:\program files\ArcSoft\Software Suite\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\windows\system32\pctspk.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\IC Card Reader Driver v1.8e2\Disk_Monitor.exe
c:\program files\Executive Software\DiskeeperLite\DKService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\fxssvc.exe
c:\program files\AOL 9.1\waol.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Common Files\AOL\1098491577\EE\anotify.exe
c:\program files\AOL 9.1\shellmon.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2010-01-03 19:18:27 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-04 00:18

Pre-Run: 82,052,644,864 bytes free
Post-Run: 82,579,980,288 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 9243B616C93CFB08CB0EB8F70E4CC87D

 

Broni,
We have SuperAnitSpyware installed and have been using it. Should I uninstall it and re-intall it and follow your directions? If not, do your directions change at all? I have printed them out.
Thank you,
Christine

 

Broni,
Thanks, I'll try to get it done tomorrow night since these things Always take more time than you expect. I have conference call tonight that I expect to run late. I'll let you know as soon as I have finished.
Thanks,
Christine

 

Broni,
I ran the SuperAnitSpyware and came up empty. I can run Malwarebytes tomorrow night but I should tell you that we have had it and have run it regularly without it getting rid of Starware. So do you still want me to run it?
Thank you,
Christine

 

Broni,
Sounds really good. I'll do it tomorrow night.
Thanks!!
Christine