Inactive Redirecting and Just in Time debugging problems

[Inactive] Redirecting and Just in Time debugging problems

http://www.windowsbbs.com/malware-v...-redirecting-just-time-debugging-problem.html

I'm having the exact same issues as this poster, but I hesitated to go through all the steps just in case I don't have exactly what he's seeing. I have installed Malwarebytes' and removed all infected items, but am still seeing the issues.

Where should I go next?

 

Sorry!

Here are the logs:


DDS (Ver_10-03-17.01) - NTFSx86
Run by Owner at 13:01:05.89 on Wed 07/28/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3574.2894 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar =
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [KADxMain] c:\windows\system32\KADxMain.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [GoToMyPC] "c:\program files\citrix\gotomypc\g2svc.exe" -logon
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe "
mRun: [AmazonGSDownloaderTray] c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderTray.exe
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: intuit.com\ttlc
DPF: {08D390AE-5101-4701-A89F-6C6DADCCC402} - hxxp://photos.msn.com/resources/neutral/controls/MsnPPick.cab?10,0,910,0
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photo2.walgreens.com/WalgreensActivia.cab
DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1209836333968
DPF: {6F750203-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://zone.msn.com/bingame/chnz/default/mjolauncher.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} - hxxp://www.photodex.com/pxplay.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} - hxxp://photos.msn.com/resources/neutral/controls/DigWebX2.cab?10,0,910,0
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: GoToMyPC - c:\program files\citrix\gotomypc\G2WinLogon.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli scecli

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-4-14 214664]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-4-27 55152]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2010-5-28 203280]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2010-5-28 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2010-5-28 144704]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\drivers\eacfilt.sys [2007-9-24 26137]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2010-5-28 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-5-28 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-5-28 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2010-5-28 40552]
S3 Amazon Download Agent;Amazon Download Agent;c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderService.exe [2010-4-9 401920]
S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]
S3 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\drivers\ipsecw2k.sys [2007-9-24 157648]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-5-28 34248]
S3 mr7911;Photo Viewer ;c:\windows\system32\drivers\mr7911.sys [2008-12-30 39552]
S3 NVCService;Nortel VPN Service;c:\program files\nortel\nortel vpn client\Extranet_serv.exe [2007-10-15 798720]
S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2010-7-13 25704]
S3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [2010-7-13 25704]
S3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [2010-7-13 25704]
S3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [2010-7-13 25704]
S3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [2010-7-13 25704]

=============== Created Last 30 ================

2010-07-28 13:08:40 0 d-----w- c:\docume~1\owner\applic~1\Malwarebytes
2010-07-28 13:08:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-28 13:08:29 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-07-28 13:08:27 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-28 13:08:26 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 16:34:18 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-27 01:43:45 0 d-----w- c:\program files\iPod
2010-07-27 01:43:39 0 d-----w- c:\program files\iTunes
2010-07-27 01:43:39 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-07-27 01:33:58 0 d-----w- c:\program files\Bonjour
2010-07-27 00:51:26 0 d-----w- c:\docume~1\alluse~1\applic~1\xml_param
2010-07-19 02:21:11 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-13 18:15:21 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(5).sys
2010-07-13 18:15:07 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(4).sys
2010-07-13 18:14:53 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(3).sys
2010-07-13 18:14:38 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(2).sys
2010-07-13 18:14:15 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(1).sys
2010-07-13 18:14:03 0 d-----w- c:\program files\Daniusoft
2010-07-07 17:10:08 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2010-07-07 17:10:07 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2010-07-07 17:10:07 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2010-07-07 17:10:07 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2010-07-07 17:10:07 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2010-07-07 17:10:07 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2010-07-07 17:10:07 206336 ----a-w- c:\windows\system32\ltefx13n.dll
2010-07-07 17:10:07 163840 ----a-w- c:\windows\system32\ltfil13n.dll

==================== Find3M ====================

2010-07-15 20:18:22 120136 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2010-05-28 18:01:34 81984 ----a-w- c:\windows\system32\bdod.bin
2010-05-18 21:35:16 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 21:35:16 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-05-18 21:35:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-04 12:39:27 70656 ------w- c:\windows\system32\dllcache\ie4uinit.exe
2010-05-04 12:39:27 13824 ------w- c:\windows\system32\dllcache\ieudinit.exe
2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-05-02 05:22:50 1851264 ------w- c:\windows\system32\dllcache\win32k.sys
2008-09-01 03:04:15 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008083120080901

\index.dat

============= FINISH: 13:03:06.40 ===============

 

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 4/29/2008 12:14:10 PM
System Uptime: 7/28/2010 12:06:56 PM (1 hours ago)

Motherboard: Dell Inc. | | 0NX907
Processor: Intel(R) Core(TM)2 Duo CPU T5270 @ 1.40GHz | Microprocessor | 1396/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 72 GiB total, 25.104 GiB free.
D: is CDROM (CDFS)

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Broadcom 440x 10/100 Integrated Controller
Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_02281028&REV_02\4&28D6DE3B&0&00F0
Manufacturer: Broadcom
Name: Broadcom 440x 10/100 Integrated Controller
PNP Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_02281028&REV_02\4&28D6DE3B&0&00F0
Service: bcm4sbxp

==== System Restore Points ===================

RP367: 4/30/2010 12:02:16 AM - System Checkpoint
RP368: 5/1/2010 12:45:48 AM - System Checkpoint
RP369: 5/2/2010 1:35:06 AM - System Checkpoint
RP370: 5/3/2010 2:02:16 AM - System Checkpoint
RP371: 5/4/2010 3:02:15 AM - System Checkpoint
RP372: 5/5/2010 4:10:16 AM - System Checkpoint
RP373: 5/6/2010 4:56:36 PM - System Checkpoint
RP374: 5/7/2010 6:39:40 PM - System Checkpoint
RP375: 5/8/2010 7:01:57 PM - System Checkpoint
RP376: 5/9/2010 11:46:56 PM - System Checkpoint
RP377: 5/11/2010 12:01:58 AM - System Checkpoint
RP378: 5/12/2010 7:11:11 AM - Installed Java(TM) 6 Update 20
RP379: 5/12/2010 7:13:13 AM - Software Distribution Service 3.0
RP380: 5/13/2010 8:01:19 AM - System Checkpoint
RP381: 5/13/2010 8:14:41 PM - Installed My Photo Books (Mpix Press Edition)
RP382: 5/14/2010 9:02:24 PM - System Checkpoint
RP383: 5/15/2010 10:55:03 PM - System Checkpoint
RP384: 5/16/2010 11:40:49 PM - System Checkpoint
RP385: 5/18/2010 12:01:21 AM - System Checkpoint
RP386: 5/19/2010 12:14:51 AM - System Checkpoint
RP387: 5/20/2010 1:01:21 AM - System Checkpoint
RP388: 5/21/2010 1:39:40 AM - System Checkpoint
RP389: 5/22/2010 3:05:37 AM - System Checkpoint
RP390: 5/23/2010 3:07:10 AM - System Checkpoint
RP391: 5/24/2010 3:26:10 AM - System Checkpoint
RP392: 5/25/2010 5:49:45 AM - System Checkpoint
RP393: 5/26/2010 6:26:09 AM - System Checkpoint
RP394: 5/27/2010 12:34:23 PM - System Checkpoint
RP395: 5/27/2010 8:50:10 PM - Software Distribution Service 3.0
RP396: 5/28/2010 1:01:24 PM - Removed BitDefender Antivirus 2009
RP397: 5/31/2010 12:02:31 AM - System Checkpoint
RP398: 6/1/2010 2:58:42 AM - System Checkpoint
RP399: 6/2/2010 10:03:11 AM - System Checkpoint
RP400: 6/3/2010 5:24:26 PM - Software Distribution Service 3.0
RP401: 6/5/2010 8:09:30 AM - System Checkpoint
RP402: 6/7/2010 9:46:51 PM - System Checkpoint
RP403: 6/9/2010 4:17:33 PM - Software Distribution Service 3.0
RP404: 6/10/2010 7:42:25 PM - System Checkpoint
RP405: 6/11/2010 9:41:36 PM - System Checkpoint
RP406: 6/13/2010 8:55:16 AM - System Checkpoint
RP407: 6/16/2010 11:11:53 PM - System Checkpoint
RP408: 6/18/2010 9:46:09 AM - Software Distribution Service 3.0
RP409: 6/19/2010 12:25:26 PM - System Checkpoint
RP410: 6/20/2010 12:57:27 PM - System Checkpoint
RP411: 6/22/2010 4:54:13 PM - System Checkpoint
RP412: 6/23/2010 7:15:17 AM - Software Distribution Service 3.0
RP413: 6/24/2010 11:46:36 AM - System Checkpoint
RP414: 6/25/2010 12:53:48 PM - System Checkpoint
RP415: 6/26/2010 1:00:33 PM - System Checkpoint
RP416: 6/26/2010 2:15:42 PM - Installed BlackBerry Device Software Updater.
RP417: 6/26/2010 2:16:16 PM - Removed BlackBerry Device Software Updater.
RP418: 6/27/2010 6:00:32 PM - System Checkpoint
RP419: 6/29/2010 3:13:25 AM - System Checkpoint
RP420: 6/30/2010 3:54:01 AM - System Checkpoint
RP421: 7/1/2010 1:06:50 PM - System Checkpoint
RP422: 7/3/2010 12:52:54 AM - System Checkpoint
RP423: 7/4/2010 12:53:45 AM - System Checkpoint
RP424: 7/6/2010 12:10:29 AM - System Checkpoint
RP425: 7/7/2010 1:10:15 PM - System Checkpoint
RP426: 7/8/2010 6:36:41 PM - System Checkpoint
RP427: 7/9/2010 7:47:49 PM - System Checkpoint
RP428: 7/10/2010 8:15:50 PM - System Checkpoint
RP429: 7/11/2010 8:41:45 PM - System Checkpoint
RP430: 7/12/2010 10:34:12 PM - System Checkpoint
RP431: 7/14/2010 6:22:47 AM - System Checkpoint
RP432: 7/16/2010 2:58:49 AM - System Checkpoint
RP433: 7/17/2010 12:38:28 PM - System Checkpoint
RP434: 7/19/2010 2:10:35 AM - System Checkpoint
RP435: 7/19/2010 6:29:36 AM - Software Distribution Service 3.0
RP436: 7/21/2010 11:47:53 AM - System Checkpoint
RP437: 7/23/2010 10:45:24 PM - System Checkpoint
RP438: 7/25/2010 12:06:55 AM - System Checkpoint
RP439: 7/26/2010 12:13:11 AM - System Checkpoint
RP440: 7/27/2010 3:29:49 AM - System Checkpoint
RP441: 7/28/2010 4:18:42 AM - System Checkpoint

==== Installed Programs ======================


Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe AIR
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe Photoshop Elements 6.0
Adobe Premiere Elements 4.0
Adobe Premiere Elements 4.0 Templates
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player
Amazon Games & Software Downloader
Amazon MP3 Downloader 1.0.5
AnswerWorks 5.0 English Runtime
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AudibleManager
BlackBerry Desktop Software 5.0.1
BlackBerry Device Software Updater
Bonjour
Broadcom Management Programs
Bulk Rename Utility 2, 7, 0, 3
Choice Guard
Compatibility Pack for the 2007 Office system
Conexant HDA D330 MDC V.92 Modem
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
Dell Support Center
Dell Touchpad
Dell Wireless WLAN Card
Digital Line Detect
eFax Messenger
ExamDiff 1.8 (Build 1.8.0.3)
Facebook Plug-In
GoToMyPC
Harman Kardon TC 30 Remote Software
High Definition Audio Driver Package - KB835221
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
hph_readme
hph_software_req
Intel(R) Graphics Media Accelerator Driver
IntelliSonic Speech Enhancement
iTunes
Java Auto Updater
Java(TM) 6 Update 20
Java(TM) 6 Update 6
Java(TM) 6 Update 7
Junk Mail filter update
KODAK EASYSHARE Gallery Upload ActiveX Control
Live Search Maps Add-In for Microsoft Office Outlook
Logitech Harmony Remote Software 7
Malwarebytes' Anti-Malware
McAfee SecurityCenter
MediaDirect
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft English TTS Engine
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Live Add-in 1.3
Microsoft Office Outlook Connector
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Professional Edition 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Streets & Trips 2007
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Modem Diagnostic Tool
Move Networks Media Player for Internet Explorer
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
My Photo Books (Mpix Press Edition)
NetWaiting
Nortel VPN Client
OutlookAddinSetup
Photo Viewer
Photodex Presenter
QuickSet
QuickTime
Remote Control USB Driver
Roxio Creator Audio
Roxio Creator BDAV Plugin
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Drag-to-Disc
Roxio Express Labeler
Roxio Media Manager
Roxio Update Manager
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Segoe UI
Skypeâ„¢ 3.8
Sonic Activation Module
Spybot - Search & Destroy
TTS Wrapper
TurboTax 2008
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wneiper
TurboTax 2008 wrapper
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wneiper
TurboTax 2009 wrapper
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
WebReg
Windows Driver Package - OEM (mr7911) Image (05/29/2008 1.4.0.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Presentation Foundation
Windows XP Service Pack 3
XML Paper Specification Shared Components Pack 1.0
XnView 1.96.5

==== Event Viewer Messages From Past Week ========

7/28/2010 11:09:10 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s)

failed to load: iaStor
7/28/2010 11:06:21 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001'

while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
7/28/2010 11:01:51 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated

unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 60000 milliseconds:

Restart the service.
7/28/2010 10:54:28 AM, error: Service Control Manager [7034] - The Nortel VPN Service service terminated

unexpectedly. It has done this 1 time(s).
7/28/2010 10:54:24 AM, error: Service Control Manager [7034] - The Pml Driver HPZ12 service terminated

unexpectedly. It has done this 1 time(s).
7/28/2010 10:54:14 AM, error: Service Control Manager [7034] - The Intuit Update Service service terminated

unexpectedly. It has done this 1 time(s).
7/28/2010 10:54:09 AM, error: Service Control Manager [7034] - The SeaPort service terminated unexpectedly. It has

done this 1 time(s).
7/28/2010 10:54:06 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated

unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds:

Restart the service.
7/28/2010 10:54:03 AM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly.

It has done this 1 time(s).
7/28/2010 10:52:23 AM, error: Service Control Manager [7034] - The Adobe Active File Monitor V6 service terminated

unexpectedly. It has done this 1 time(s).
7/28/2010 10:52:09 AM, error: Service Control Manager [7034] - The GoToMyPC service terminated unexpectedly. It

has done this 1 time(s).
7/28/2010 10:51:40 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated

unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds:

Restart the service.
7/23/2010 10:47:52 AM, error: EventLog [6004] - A driver packet received from the I/O subsystem was invalid. The

data is the packet.
7/23/2010 10:30:03 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Roxio

Hard Drive Watcher 9 service to connect.

==== End Of File ===========================

 

malwarebytes log2

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4363

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

7/28/2010 12:05:36 PM
mbam-log-2010-07-28 (12-05-36).txt

Scan type: Quick scan
Objects scanned: 220703
Time elapsed: 39 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

malwarebytes log1

I ran this twice and removed different things each time. Sorry!

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4363

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

7/28/2010 11:04:34 AM
mbam-log-2010-07-28 (11-04-34).txt

Scan type: Full scan (C:\|)
Objects scanned: 352840
Time elapsed: 2 hour(s), 12 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\WINDOWS\system32\6to4v32.dll (Trojan.Dropper) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4 (Trojan.Dropper) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\6to4v32.dll (Trojan.Dropper) -> Delete on reboot.
C:\Documents and Settings\Owner\Local Settings\Temp\CBB.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\certstore.dat (Trojan.Agent) -> Quarantined and deleted successfully.

 

gmer

I'm still trying to get it to run. Takes forever and then kills my computer. I've tried with and without marking 'devices'. I can't get a log from it. But I do have the error logs that were created by my machine on restart (created due to a critical error and then having to shut down the machine). Would those be helpful?

Thanks so much for your time!!

edited to add: I tried it in safe mode and still no dice. Same issues with the critical error.

 

combofix

I tried to run ComboFix twice and kept getting the blue screen (error with bad_pool_caller) during the AutoScan and had to reboot each time. I decided to run it in safe mode and here's what I got:


ComboFix 10-07-29.01 - Owner 07/29/2010 20:08:28.1.2 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3574.3267 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Owner\Recent\Thumbs.db
c:\windows\system32\gotomon.log

----- BITS: Possible infected sites -----

hxxp://au.download.windowsj+|Cv+@J:NGD_DQ{zGD_DQ{zGD_DQ{zGD_DQ{z+@J:Nj+|Cvsupportcenter)
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4


((((((((((((((((((((((((( Files Created from 2010-06-28 to 2010-07-30 )))))))))))))))))))))))))))))))
.

2010-07-28 13:08 . 2010-07-28 13:08 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-07-28 13:08 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-28 13:08 . 2010-07-28 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-28 13:08 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-28 13:08 . 2010-07-28 13:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-28 03:28 . 2010-07-28 03:30 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-07-27 16:34 . 2010-07-29 12:11 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-27 01:43 . 2010-07-27 01:43 -------- d-----w- c:\program files\iPod
2010-07-27 01:43 . 2010-07-27 01:44 -------- d-----w- c:\program files\iTunes
2010-07-27 01:43 . 2010-07-27 01:44 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-07-27 01:33 . 2010-07-27 01:33 -------- d-----w- c:\program files\Bonjour
2010-07-27 00:51 . 2010-07-27 00:55 -------- d-----w- c:\documents and settings\All Users\Application Data\xml_param
2010-07-19 02:21 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-13 18:15 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(5).sys
2010-07-13 18:15 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(4).sys
2010-07-13 18:14 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(3).sys
2010-07-13 18:14 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(2).sys
2010-07-13 18:14 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(1).sys
2010-07-13 18:14 . 2010-07-28 03:09 -------- d-----w- c:\program files\Daniusoft
2010-07-07 17:10 . 2003-11-04 20:10 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 163840 ----a-w- c:\windows\system32\ltfil13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2010-07-07 17:10 . 2004-01-12 07:09 206336 ----a-w- c:\windows\system32\ltefx13n.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-29 10:44 . 2009-01-30 16:24 -------- d-----w- c:\program files\McAfee
2010-07-28 20:42 . 2009-05-21 15:46 256 ----a-w- c:\windows\system32\pool.bin
2010-07-28 20:22 . 2009-11-25 18:07 -------- d-----w- c:\documents and settings\Owner\Application Data\XnView
2010-07-27 01:48 . 2008-06-18 02:54 -------- d-----w- c:\documents and settings\Owner\Application Data\Apple Computer
2010-07-27 01:43 . 2008-06-18 02:51 -------- d-----w- c:\program files\Common Files\Apple
2010-07-27 01:39 . 2008-06-18 02:52 -------- d-----w- c:\program files\QuickTime
2010-07-27 01:27 . 2010-07-27 01:27 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-15 20:18 . 2010-05-29 02:27 120136 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2010-06-26 19:15 . 2010-06-26 19:15 53248 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{B2F3FB19-D848-479C-818E-130ABC9366DB}\ARPPRODUCTICON.exe
2010-06-14 14:31 . 2004-08-10 18:02 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-10 01:57 . 2008-05-03 17:57 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-28 18:01 . 2008-07-04 08:23 81984 ----a-w- c:\windows\system32\bdod.bin
2010-05-28 11:17 . 2010-05-28 11:17 503808 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5b5e72e1-n\msvcp71.dll
2010-05-28 11:17 . 2010-05-28 11:17 499712 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5b5e72e1-n\jmc.dll
2010-05-28 11:17 . 2010-05-28 11:17 348160 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5b5e72e1-n\msvcr71.dll
2010-05-28 11:17 . 2010-05-28 11:17 61440 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7483e654-n\decora-sse.dll
2010-05-28 11:17 . 2010-05-28 11:17 12800 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7483e654-n\decora-d3d.dll
2010-05-18 21:35 . 2010-05-18 21:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 21:35 . 2010-05-18 21:35 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-05-18 21:35 . 2010-05-18 21:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-04 17:20 . 2004-08-10 17:51 832512 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 17:20 . 2004-08-10 17:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-05-04 17:20 . 2004-08-10 17:50 17408 ----a-w- c:\windows\system32\corpol.dll
2010-05-02 05:22 . 2004-08-10 17:51 1851264 ----a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 851968]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2007-06-06 138008]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2007-06-06 162584]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2007-06-06 138008]
"Dell QuickSet "= "c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"Broadcom Wireless Manager UI "= "c:\windows\system32\WLTRAY.exe" [2007-12-11 2183168]
"SigmatelSysTrayApp "= "stsystra.exe" [2007-06-06 405504]
"KADxMain "= "c:\windows\system32\KADxMain.exe" [2006-11-02 282624]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2008-10-24 206112]
"BlackBerryAutoUpdate "= "c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536]
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 202544]
"GoToMyPC "= "c:\program files\Citrix\GoToMyPC\g2svc.exe" [2008-09-30 258856]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"RoxWatchTray "= "c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016]
"AmazonGSDownloaderTray "= "c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]
"mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2010-02-11 1218008]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]
2008-09-30 21:04 10536 ----a-w- c:\program files\Citrix\GoToMyPC\G2WinLogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-09-11 05:43 67488 ----a-w- c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-12 03:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2008-03-11 17:44 202544 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2008-03-11 17:44 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.4]
2008-10-07 20:25 95744 ----a-w- c:\program files\eFax Messenger 4.4\J2GDllCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2008-10-24 14:14 206112 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2008-10-24 14:14 79136 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 20:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2007-12-21 15:58 184320 ------w- c:\program files\Dell\MediaDirect\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 14:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2009-07-08 18:31 236016 ----a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RoxWatch9 "=2 (0x2)
"IntuitUpdateService "=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Harman Kardon\\Remote Control\\HarmonyClient.exe "=
"c:\\Program Files\\Harman Kardon\\Remote Control\\PatchHelper.exe "=
"c:\\WINDOWS\\system32\\mmc.exe "=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP "= 5900:TCP:vnc5900
"5800:TCP "= 5800:TCP:vnc5800

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [5/28/2010 9:30 PM 203280]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\drivers\eacfilt.sys [9/24/2007 3:37 PM 26137]
S3 Amazon Download Agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [4/9/2010 3:13 PM 401920]
S3 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\drivers\ipsecw2k.sys [9/24/2007 3:37 PM 157648]
S3 mr7911;Photo Viewer ;c:\windows\system32\drivers\mr7911.sys [12/30/2008 9:32 PM 39552]
S3 NVCService;Nortel VPN Service;c:\program files\Nortel\Nortel VPN Client\Extranet_serv.exe [10/15/2007 2:48 PM 798720]
S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [7/13/2010 1:14 PM 25704]
S3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [7/13/2010 1:14 PM 25704]
S3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [7/13/2010 1:14 PM 25704]
S3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [7/13/2010 1:15 PM 25704]
S3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [7/13/2010 1:15 PM 25704]
.
Contents of the 'Scheduled Tasks' folder

2010-07-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-07-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-05-29 17:22]

2010-07-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-05-29 17:22]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-29 20:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A8D4EC5]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f7fcb8
\Driver\atapi -> atapi.sys @ 0xb9f37852
\Driver\iaStor -> iaStor.sys @ 0xb9e7cc1a
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Dell Wireless 1395 WLAN Mini-Card -> SendCompleteHandler -> NDIS.sys @ 0xb9d5cbb0
PacketIndicateHandler -> NDIS.sys @ 0xb9d69a21
SendHandler -> NDIS.sys @ 0xb9d4787b
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1316)
c:\windows\system32\WININET.dll
c:\program files\Nortel\Nortel VPN Client\nngina.dll
c:\program files\Citrix\GoToMyPC\G2WinLogon.dll

- - - - - - - > 'lsass.exe'(1376)
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2388)
c:\windows\system32\WININET.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Citrix\GoToMyPC\g2comm.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Citrix\GoToMyPC\g2pre.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\Citrix\GoToMyPC\g2tray.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MPFSrv.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\stsystra.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-07-29 20:37:26 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-30 01:37

Pre-Run: 32,460,582,912 bytes free
Post-Run: 28,637,687,808 bytes free

- - End Of File - - F1513B3E65F0E0293E47075FF04DCD65

 

Well, at this exact moment I'm not getting any of the JIT debuggers popping up. I want to say it takes a bit after I've rebooted. I tried recreating the redirecting issue and that's still happening. So annoying!



Here is the log from MBRCheck:

MBRCheck, version 1.1.1

(c) 2010, AD



\\.\C: --> \\.\PhysicalDrive0



Size Device Name MBR Status

--------------------------------------------

74 GB \\.\PhysicalDrive0 Windows XP MBR code detected





Done! Press ENTER to exit...

 

McAfee just said it found the Artemis trojan in ComboFix. WTH? It won't let me download it.....

 

I had to run ComboFix in safe mode again, couldn't get it to run in regular mode. But it didn't make me reboot this time. Is that better? I hope.


Here's the new log:
ComboFix 10-07-29.01 - Owner 07/29/2010 21:44:13.2.2 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3574.3266 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\gotomon.log

.
((((((((((((((((((((((((( Files Created from 2010-06-28 to 2010-07-30 )))))))))))))))))))))))))))))))
.

2010-07-28 13:08 . 2010-07-28 13:08 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-07-28 13:08 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-28 13:08 . 2010-07-28 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-28 13:08 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-28 13:08 . 2010-07-28 13:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-28 03:28 . 2010-07-28 03:30 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-07-27 16:34 . 2010-07-30 02:10 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-27 01:43 . 2010-07-27 01:43 -------- d-----w- c:\program files\iPod
2010-07-27 01:43 . 2010-07-27 01:44 -------- d-----w- c:\program files\iTunes
2010-07-27 01:43 . 2010-07-27 01:44 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-07-27 01:33 . 2010-07-27 01:33 -------- d-----w- c:\program files\Bonjour
2010-07-27 01:27 . 2010-07-27 01:27 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-27 00:51 . 2010-07-27 00:55 -------- d-----w- c:\documents and settings\All Users\Application Data\xml_param
2010-07-19 02:21 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-13 18:15 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(5).sys
2010-07-13 18:15 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(4).sys
2010-07-13 18:14 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(3).sys
2010-07-13 18:14 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(2).sys
2010-07-13 18:14 . 2010-02-23 15:51 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(1).sys
2010-07-13 18:14 . 2010-07-28 03:09 -------- d-----w- c:\program files\Daniusoft
2010-07-07 17:10 . 2003-11-04 20:10 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 163840 ----a-w- c:\windows\system32\ltfil13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2010-07-07 17:10 . 2004-05-14 21:53 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2010-07-07 17:10 . 2004-01-12 07:09 206336 ----a-w- c:\windows\system32\ltefx13n.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-29 10:44 . 2009-01-30 16:24 -------- d-----w- c:\program files\McAfee
2010-07-28 20:42 . 2009-05-21 15:46 256 ----a-w- c:\windows\system32\pool.bin
2010-07-28 20:22 . 2009-11-25 18:07 -------- d-----w- c:\documents and settings\Owner\Application Data\XnView
2010-07-27 01:48 . 2008-06-18 02:54 -------- d-----w- c:\documents and settings\Owner\Application Data\Apple Computer
2010-07-27 01:43 . 2008-06-18 02:51 -------- d-----w- c:\program files\Common Files\Apple
2010-07-27 01:39 . 2008-06-18 02:52 -------- d-----w- c:\program files\QuickTime
2010-07-15 20:18 . 2010-05-29 02:27 120136 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2010-06-26 19:15 . 2010-06-26 19:15 53248 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{B2F3FB19-D848-479C-818E-130ABC9366DB}\ARPPRODUCTICON.exe
2010-06-14 14:31 . 2004-08-10 18:02 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-10 01:57 . 2008-05-03 17:57 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-28 18:01 . 2008-07-04 08:23 81984 ----a-w- c:\windows\system32\bdod.bin
2010-05-28 11:17 . 2010-05-28 11:17 503808 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5b5e72e1-n\msvcp71.dll
2010-05-28 11:17 . 2010-05-28 11:17 499712 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5b5e72e1-n\jmc.dll
2010-05-28 11:17 . 2010-05-28 11:17 348160 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5b5e72e1-n\msvcr71.dll
2010-05-28 11:17 . 2010-05-28 11:17 61440 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7483e654-n\decora-sse.dll
2010-05-28 11:17 . 2010-05-28 11:17 12800 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7483e654-n\decora-d3d.dll
2010-05-18 21:35 . 2010-05-18 21:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 21:35 . 2010-05-18 21:35 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-05-18 21:35 . 2010-05-18 21:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-04 17:20 . 2004-08-10 17:51 832512 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 17:20 . 2004-08-10 17:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-05-04 17:20 . 2004-08-10 17:50 17408 ----a-w- c:\windows\system32\corpol.dll
2010-05-02 05:22 . 2004-08-10 17:51 1851264 ----a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 851968]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2007-06-06 138008]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2007-06-06 162584]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2007-06-06 138008]
"Dell QuickSet "= "c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"Broadcom Wireless Manager UI "= "c:\windows\system32\WLTRAY.exe" [2007-12-11 2183168]
"SigmatelSysTrayApp "= "stsystra.exe" [2007-06-06 405504]
"KADxMain "= "c:\windows\system32\KADxMain.exe" [2006-11-02 282624]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2008-10-24 206112]
"BlackBerryAutoUpdate "= "c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536]
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 202544]
"GoToMyPC "= "c:\program files\Citrix\GoToMyPC\g2svc.exe" [2008-09-30 258856]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"RoxWatchTray "= "c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016]
"AmazonGSDownloaderTray "= "c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]
"mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2010-02-11 1218008]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]
2008-09-30 21:04 10536 ----a-w- c:\program files\Citrix\GoToMyPC\G2WinLogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-09-11 05:43 67488 ----a-w- c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-12 03:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2008-03-11 17:44 202544 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2008-03-11 17:44 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.4]
2008-10-07 20:25 95744 ----a-w- c:\program files\eFax Messenger 4.4\J2GDllCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2008-10-24 14:14 206112 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2008-10-24 14:14 79136 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 20:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2007-12-21 15:58 184320 ------w- c:\program files\Dell\MediaDirect\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 14:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2009-07-08 18:31 236016 ----a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RoxWatch9 "=2 (0x2)
"IntuitUpdateService "=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Harman Kardon\\Remote Control\\HarmonyClient.exe "=
"c:\\Program Files\\Harman Kardon\\Remote Control\\PatchHelper.exe "=
"c:\\WINDOWS\\system32\\mmc.exe "=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP "= 5900:TCP:vnc5900
"5800:TCP "= 5800:TCP:vnc5800

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [5/28/2010 9:30 PM 203280]
S3 Amazon Download Agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [4/9/2010 3:13 PM 401920]
S3 Eacfilt;Eacfilt Miniport;c:\windows\system32\drivers\eacfilt.sys [9/24/2007 3:37 PM 26137]
S3 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\drivers\ipsecw2k.sys [9/24/2007 3:37 PM 157648]
S3 mr7911;Photo Viewer ;c:\windows\system32\drivers\mr7911.sys [12/30/2008 9:32 PM 39552]
S3 NVCService;Nortel VPN Service;c:\program files\Nortel\Nortel VPN Client\Extranet_serv.exe [10/15/2007 2:48 PM 798720]
S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [7/13/2010 1:14 PM 25704]
S3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [7/13/2010 1:14 PM 25704]
S3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [7/13/2010 1:14 PM 25704]
S3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [7/13/2010 1:15 PM 25704]
S3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [7/13/2010 1:15 PM 25704]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MDMXSDK
.
Contents of the 'Scheduled Tasks' folder

2010-07-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-07-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-05-29 17:22]

2010-07-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-05-29 17:22]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(256)
c:\program files\Citrix\GoToMyPC\G2WinLogon.dll
.
Completion time: 2010-07-29 21:58:50
ComboFix-quarantined-files.txt 2010-07-30 02:58
ComboFix2.txt 2010-07-30 01:37

Pre-Run: 32,367,529,984 bytes free
Post-Run: 32,363,589,632 bytes free

- - End Of File - - F4911FA33030C1074A46402CCE906BD9

 

I can start it in regular mode and run everything, it's just that ComboFix won't run. Now I'm getting more errors than ever. Errors with svchost, ugh. Last night a program attempted to connect to the internet but McAfee caught it.

I'm leaving on a week long vacation tomorrow and ARGH!! I usually log into my computer remotely, but I'm afraid to now.

Any thoughts?