Solved Yahoo email sending spam to contacts

[Resolved] Yahoo email sending spam to contacts

I received notice from some of my yahoo contacts that a spam email was sent from my yahoo email account to contacts of mine. I have changed my yahoo password and checked the email settings, everything seems to be in order.

Updated and ran full MSE scan with nothing found.
Updated and ran MBAM scan with nothing found. Will include log.

aswMBR asked me if I wanted to update to latest avast version I replied yes and will include log.

gmer log shows nothing but I will include log.

DDS and attach logs included as well.

I never open attachments or emails for that matter from unknown sources so I am perplexed as to the nature of this problem. Other than that system is functioning fine.

Am hoping you might have some insight as to the why of this issue and is this something other than viral or malware related and do I need to do something I am not currently doing security wise.

I do not know if this is an issue with my machine or if the problem lies elsewhere.
Thanking you in advance.

 

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6928

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

6/23/2011 1:04:42 PM
mbam-log-2011-06-23 (13-04-42).txt

Scan type: Quick scan
Objects scanned: 158455
Time elapsed: 6 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-06-23 14:27:26
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.11.0
Running: 9qcgxxkn.exe; Driver: C:\Users\Steven\AppData\Local\Temp\uxdiqpob.sys


---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwSaveKey + 13C1 82C81339 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82CBAD52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x91637000, 0x2D5378, 0xE8000020]

---- Devices - GMER 1.0.15 ----

Device \Driver\ACPI_HAL \Device\00000047 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

 

.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by Steven at 14:47:52 on 2011-06-23
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3070.1426 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Secunia\PSI\PSIA.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\atieclxx.exe
C:\Program Files\Secunia\PSI\sua.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Secunia\PSI\psi_tray.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Users\Steven\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Steven\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Steven\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Steven\Desktop\aswMBR.exe
C:\Users\Steven\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://my.yahoo.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Google Update] "c:\users\steven\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi_tray.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
Trusted Zone: intuit.com\ttlc
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1DF0C6CB-A936-4E9C-B16B-0E87429AF748} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{D6C25177-2BFC-4591-A9C9-436C2BCD861E} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{D6C25177-2BFC-4591-A9C9-436C2BCD861E}\46C696E6B6 : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{D6C25177-2BFC-4591-A9C9-436C2BCD861E}\A457D6073747162747D20513D2531366237353 : DhcpNameServer = 192.168.0.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\steven\appdata\roaming\mozilla\firefox\profiles\cqima2yy.default\
FF - prefs.js: browser.startup.homepage - my.yahoo.com
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\users\steven\appdata\local\google\update\1.3.21.57\npGoogleUpdate3.dll
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsla0e6507f;MpKsla0e6507f;c:\programdata\microsoft\microsoft antimalware\definition updates\{84b6f672-1213-4052-a789-8bc4c71bbb8a}\MpKsla0e6507f.sys [2011-6-23 28752]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-8-18 176128]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-12-18 189736]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-1-5 988216]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2011-1-5 399416]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2009-5-18 119256]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\drivers\KMWDFILTER.sys [2009-4-29 25088]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
R3 netr28;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\drivers\netr28.sys [2009-6-19 604672]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-6-23 275048]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-1-10 136176]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-22 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-1-10 136176]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-4-3 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-6 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-06-23 18:28:34 28752 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{84b6f672-1213-4052-a789-8bc4c71bbb8a}\MpKsla0e6507f.sys
2011-06-23 18:28:28 7074640 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{84b6f672-1213-4052-a789-8bc4c71bbb8a}\mpengine.dll
2011-06-23 15:57:39 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-06-23 15:57:38 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-23 15:57:38 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-16 15:46:33 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-16 15:46:33 141104 ----a-w- c:\program files\internet explorer\sqmapi.dll
2011-06-16 15:46:32 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-16 15:45:06 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-16 15:44:57 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2011-06-16 15:44:57 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-16 15:44:57 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-16 15:44:56 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-16 15:44:56 1290624 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-16 15:44:55 741376 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-16 15:44:54 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 15:44:54 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 15:44:54 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-14 04:06:49 0 ---ha-w- c:\users\steven\appdata\local\BITB295.tmp
2011-06-06 16:55:30 183696 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll
2011-06-06 16:55:30 183696 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll
2011-05-25 01:41:37 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys
.
==================== Find3M ====================
.
2011-06-16 15:45:52 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-29 13:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 13:11:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-04 08:52:22 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-16 19:18:03 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-04-16 19:18:03 161792 ----a-w- c:\windows\system32\msls31.dll
2011-04-16 19:18:03 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-04-16 19:18:02 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-04-16 19:18:02 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-04-16 19:18:02 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-04-16 19:18:02 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-04-16 19:18:01 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-04-16 19:18:01 367104 ----a-w- c:\windows\system32\html.iec
2011-04-16 19:18:00 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-04-16 19:18:00 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-16 19:18:00 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-16 19:17:59 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-04-16 19:17:59 152064 ----a-w- c:\windows\system32\wextract.exe
2011-04-16 19:17:59 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-04-16 19:17:59 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-04-16 19:17:58 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-04-16 19:17:58 11776 ----a-w- c:\windows\system32\mshta.exe
2011-04-16 19:17:58 101888 ----a-w- c:\windows\system32\admparse.dll
2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr
2011-04-09 06:02:25 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02:25 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56:38 123904 ----a-w- c:\windows\system32\poqexec.exe
2011-04-03 04:21:29 152576 ----a-w- c:\windows\system32\msclmd.dll
.
============= FINISH: 14:48:56.57 ===============

 

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-12.02)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 11/6/2009 2:51:01 PM
System Uptime: 6/19/2011 11:56:52 AM (99 hours ago)
.
Motherboard: Acer | | Aspire 4730Z
Processor: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz | uPGA-478 | 2000/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 143 GiB total, 84.654 GiB free.
D: is FIXED (NTFS) - 143 GiB total, 115.97 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsle428683a
Device ID: ROOT\LEGACY_MPKSLE428683A\0000
Manufacturer:
Name: MpKsle428683a
PNP Device ID: ROOT\LEGACY_MPKSLE428683A\0000
Service: MpKsle428683a
.
==== System Restore Points ===================
.
RP744: 6/8/2011 2:25:18 AM - Windows Update
RP745: 6/8/2011 10:01:08 AM - Installed Java(TM) 6 Update 26
RP746: 6/11/2011 4:20:35 PM - Windows Update
RP747: 6/15/2011 12:12:58 AM - Windows Update
RP748: 6/16/2011 11:45:10 AM - Windows Update
RP749: 6/19/2011 4:00:16 AM - Windows Update
RP750: 6/23/2011 1:50:42 AM - Windows Update
.
==== Installed Programs ======================
.
.
Update for Microsoft Office 2007 (KB2508958)
7-Zip 9.20
Acer Crystal Eye Webcam
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.0)
Adobe Shockwave Player 11.6
AnswerWorks 4.0 Runtime - English
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Bonjour
Canon Easy-WebPrint EX
Canon MP Navigator EX 3.0
Canon MP250 series MP Drivers
Canon MP250 series User Registration
Canon Utilities Easy-PhotoPrint EX
Canon Utilities My Printer
Canon Utilities Solution Menu
CDBurnerXP
D3DX10
ESET Online Scanner v3
FileHippo.com Update Checker
Google Chrome
Google Earth
Google Update Helper
iSEEK AnswerWorks English Runtime
Java Auto Updater
Java(TM) 6 Update 26
JMicron Flash Media Controller Driver
Junk Mail filter update
Logitech Harmony Remote Software 7
Malwarebytes' Anti-Malware version 1.51.0.1200
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 4 Client Profile
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 5.0 (x86 en-GB)
MSN Toolbar
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee Reveal Seagate Edition
OGA Notifier 2.0.0048.0
Picasa 3
PokerStars
QuickTime
Realtek High Definition Audio Driver
Remote Control USB Driver
Seagate Manager Installer
Secunia PSI (2.0.0.2001)
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft Office 2007 System (KB2541012)
Security Update for Microsoft Office Excel 2007 (KB2541007)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype Toolbars
Skypeâ„¢ 5.3
SopCast 3.2.4
TurboTax 2008
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wrapper
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wohiper
TurboTax 2009 wrapper
TurboTax 2010
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wohiper
TurboTax 2010 wrapper
TurboTax Premier 2007
TVUPlayer 2.4.9.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
WOT for Internet Explorer
.
==== Event Viewer Messages From Past Week ========
.
6/21/2011 6:02:38 AM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.100. The computer with the IP address 192.168.1.104 did not allow the name to be claimed by this computer.
6/21/2011 10:43:34 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer NANCY-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D6C25177-2BFC-4591-A9C9-436C2BCD8. The master browser is stopping or an election is being forced.
6/21/2011 1:17:06 AM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
6/19/2011 5:51:24 PM, Error: atikmdag [43029] - Display is not active
6/19/2011 4:22:40 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
6/19/2011 4:22:11 AM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter
6/16/2011 11:52:42 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
.
==== End Of File ===========================

 

aswMBR version 0.9.7.675 Copyright(c) 2011 AVAST Software
Run date: 2011-06-23 14:31:03
-----------------------------
14:31:03.840 OS Version: Windows 6.1.7601 Service Pack 1
14:31:03.840 Number of processors: 2 586 0x170A
14:31:03.841 ComputerName: STEVEN-PC UserName: Steven
14:31:05.108 Initialize success
14:31:53.230 AVAST engine defs: 11062300
14:32:00.472 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:32:00.476 Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
14:32:00.734 Disk 0 MBR read successfully
14:32:00.737 Disk 0 MBR scan
14:32:00.740 Disk 0 Windows 7 default MBR code
14:32:00.821 Disk 0 scanning sectors +625139712
14:32:00.913 Disk 0 scanning C:\Windows\system32\drivers
14:33:29.929 Service scanning
14:33:30.844 Disk 0 trace - called modules:
14:33:30.940 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll
14:33:30.945 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86ad01c0]
14:33:30.950 3 CLASSPNP.SYS[8b65559e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86103028]
14:33:32.376 AVAST engine scan C:\Windows
15:34:02.910 AVAST engine scan C:\Users\Steven
15:45:43.985 AVAST engine scan C:\ProgramData
15:47:27.740 Scan finished successfully
15:53:13.327 Disk 0 MBR has been saved successfully to "C:\Users\Steven\Desktop\MBR.dat "
15:53:13.406 The log file has been saved successfully to "C:\Users\Steven\Desktop\aswMBR.txt "

 

A side note. Not all of the sent emails appear in my sent box?

I have windows 7 and when I go to C:/documents and settings it is locked. I have not noticed this before. Is this because it is a junction or am I really locked out? Seems all data in that area is also in USERS.

Thanks again!!!

 

ComboFix 11-06-23.01 - Steven 06/23/2011 18:20:37.6.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3070.2149 [GMT -4:00]
Running from: c:\users\Steven\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
.
.
((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))
.
.
2011-06-23 22:25 . 2011-06-23 22:25 -------- d-----w- c:\users\Steven\AppData\Local\temp
2011-06-23 22:25 . 2011-06-23 22:25 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-06-23 22:25 . 2011-06-23 22:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-23 22:13 . 2011-06-23 22:13 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{84B6F672-1213-4052-A789-8BC4C71BBB8A}\MpKsl17d30e67.sys
2011-06-23 18:28 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{84B6F672-1213-4052-A789-8BC4C71BBB8A}\mpengine.dll
2011-06-23 15:57 . 2011-06-16 04:32 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-06-23 15:57 . 2010-01-01 08:00 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-23 15:57 . 2010-01-01 08:00 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-16 15:46 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-16 15:46 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-16 15:46 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-16 15:45 . 2011-02-25 05:34 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-16 15:44 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2011-06-16 15:44 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-16 15:44 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-16 15:44 . 2011-04-25 04:31 1290624 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-16 15:44 . 2011-04-25 02:18 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-16 15:44 . 2011-05-03 04:30 741376 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-16 15:44 . 2011-04-27 02:17 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 15:44 . 2011-04-27 02:17 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 15:44 . 2011-04-27 02:17 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-15 14:28 . 2011-06-15 14:28 -------- d-----w- c:\program files\Common Files\Adobe
2011-06-14 04:06 . 2011-06-14 04:06 0 ---ha-w- c:\users\Steven\AppData\Local\BITB295.tmp
2011-06-08 14:17 . 2011-06-08 14:17 -------- d-----w- c:\program files\Common Files\Java
2011-06-06 16:55 . 2011-06-06 16:55 183696 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-06-06 16:55 . 2011-06-06 16:55 183696 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-05-25 01:41 . 2011-04-22 19:14 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-16 15:45 . 2011-05-16 14:19 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-07 15:55 . 2011-01-07 04:35 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-05-29 13:11 . 2009-11-07 00:55 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 13:11 . 2009-11-07 00:54 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-04 08:52 . 2010-04-20 02:43 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-16 19:18 . 2011-04-16 19:18 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-04-16 19:18 . 2011-04-16 19:18 161792 ----a-w- c:\windows\system32\msls31.dll
2011-04-16 19:18 . 2011-04-16 19:18 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-04-16 19:18 . 2011-04-16 19:18 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-04-16 19:18 . 2011-04-16 19:18 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-04-16 19:18 . 2011-04-16 19:18 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-04-16 19:18 . 2011-04-16 19:18 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-04-16 19:18 . 2011-04-16 19:18 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-04-16 19:18 . 2011-04-16 19:18 367104 ----a-w- c:\windows\system32\html.iec
2011-04-16 19:18 . 2011-04-16 19:18 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-04-16 19:18 . 2011-04-16 19:18 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-16 19:18 . 2011-04-16 19:18 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-16 19:17 . 2011-04-16 19:17 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-04-16 19:17 . 2011-04-16 19:17 152064 ----a-w- c:\windows\system32\wextract.exe
2011-04-16 19:17 . 2011-04-16 19:17 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-04-16 19:17 . 2011-04-16 19:17 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-04-16 19:17 . 2011-04-16 19:17 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-04-16 19:17 . 2011-04-16 19:17 11776 ----a-w- c:\windows\system32\mshta.exe
2011-04-16 19:17 . 2011-04-16 19:17 101888 ----a-w- c:\windows\system32\admparse.dll
2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\system32\GPhotos.scr
2011-04-09 06:02 . 2011-05-11 04:41 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 04:41 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-19 04:10 123904 ----a-w- c:\windows\system32\poqexec.exe
2011-04-03 04:21 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-03-30 02:27 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-06-16 04:32 . 2011-06-23 15:57 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Malwarebytes' Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-1-5 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PHOTOfunSTUDIO 4.0.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 4.0.lnk
backup=c:\windows\pss\PHOTOfunSTUDIO 4.0.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Steven^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Steven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 16:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-03-23 17:00 1983816 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2009-03-17 16:40 767312 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
2010-08-09 12:47 248832 ----a-w- c:\program files\FileHippo.com\UpdateChecker.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-04-29 11:26 136176 ----atw- c:\users\Steven\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxMenuMgr]
2009-12-18 16:24 197928 ----a-w- c:\program files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-11-10 07:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2009-11-06 21:20 6244896 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2010-11-20 12:17 1174016 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-05-27 01:50 15147400 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2009-11-06 21:20 1826816 ----a-w- c:\windows\SkyTel.exe
.
R1 MpKsle428683a;MpKsle428683a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BFCA595-2090-492C-95E7-35435F364A87}\MpKsle428683a.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-01-10 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-01-10 136176]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-25 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-25 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-06 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 MpKsl17d30e67;MpKsl17d30e67;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{84B6F672-1213-4052-A789-8BC4C71BBB8A}\MpKsl17d30e67.sys [2011-06-23 28752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [2009-12-18 189736]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-01-05 988216]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2011-01-05 399416]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2009-11-06 119256]
S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 netr28;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28.sys [2009-06-19 604672]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-06-23 275048]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL17D30E67
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-10 04:20]
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-10 04:20]
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-295098664-1935458247-2824167555-1001Core.job
- c:\users\Steven\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-05 11:26]
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-295098664-1935458247-2824167555-1001UA.job
- c:\users\Steven\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-05 11:26]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.yahoo.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Steven\AppData\Roaming\Mozilla\Firefox\Profiles\cqima2yy.default\
FF - prefs.js: browser.startup.homepage - my.yahoo.com
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-295098664-1935458247-2824167555-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "WindowsLiveMail.Email.1 "
.
[HKEY_USERS\S-1-5-21-295098664-1935458247-2824167555-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "WindowsLiveMail.VCard.1 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-06-23 18:27:01
ComboFix-quarantined-files.txt 2011-06-23 22:27
ComboFix2.txt 2011-02-21 04:34
ComboFix3.txt 2011-02-21 04:26
.
Pre-Run: 91,991,326,720 bytes free
Post-Run: 91,890,614,272 bytes free
.
- - End Of File - - 9DE93756F75ED81080E227AC4B0DFCD4

 

As I said earlier, changed password for email. Any other suggestions?
Also is C:/documents and settings a junction? When I looked for a log there it is locked but the info is in "users" just wondering.

 

Should you run the java ra program when java updates or what do you advise?

THX

 

As far as I can tell this seems to be a one time shot early this A.M. Checked and I do not see anything weird sent since but some people received emails that did not show up in my sent folder. Here is the log.

SystemLook 04.09.10 by jpshortstuff
Log created at 18:45 on 23/06/2011 by Steven
Administrator - Elevation successful

========== dir ==========

C: - Parameters: "/documents and settings "

---Files---
autoexec.bat --a---- 24 bytes [02:04 14/07/2009] [21:42 10/06/2009]
bootmgr -rahs-- 383786 bytes [21:43 06/11/2009] [12:40 20/11/2010]
BOOTSECT.BAK -rahs-- 8192 bytes [21:43 06/11/2009] [21:43 06/11/2009]
ComboFix.txt --a---- 15691 bytes [22:27 23/06/2011] [22:27 23/06/2011]
config.sys --a---- 10 bytes [02:04 14/07/2009] [21:42 10/06/2009]
hiberfil.sys --ahs-- -1880608768 bytes [21:44 06/11/2009] [22:33 23/06/2011]
JavaRa.log --a---- 20497 bytes [03:44 21/02/2011] [03:44 21/02/2011]
pagefile.sys --ahs-- -1075822592 bytes [21:44 06/11/2009] [22:33 23/06/2011]

---Folders---
$RECYCLE.BIN d--hs-- [22:27 23/06/2011]
Boot d------ [21:43 06/11/2009]
Config.Msi d------ [08:01 19/06/2011]
Documents and Settings d--hs-- [04:53 14/07/2009]
MSOCache dr----- [22:12 06/11/2009]
PerfLogs d------ [02:37 14/07/2009]
Program Files dr----- [02:37 14/07/2009]
ProgramData d------ [02:37 14/07/2009]
Qoobox d------ [04:17 21/02/2011]
Recovery d------ [18:50 06/11/2009]
System Volume Information d--hs-- [21:44 06/11/2009]
Users dr----- [02:37 14/07/2009]
Windows d------ [02:37 14/07/2009]

-= EOF =-

 

Strange! When I hit OK in run with the pasted script I got a quick flash of what appeared to be a utility window (like when you open combofix) but it disappeared instantly?

 

Pasted just the command in quotations and am told access denied?

 

No. And oddly enough I looked in "users" and the default user has me locked out as well. There are locks on "all" and "steven" but those I can access! Confused