Inactive Deleted e mail (spam) keeps coming back after deletion.

DDS
-----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.7.2
Run by Joe at 14:39:46 on 2012-09-05
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3006.1215 [GMT -6:00]
.
AV: ZoneAlarm Extreme Security Antivirus *Enabled/Updated* {DE038A5B-9EDD-18A9-2361-FF7D98D43730}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: ZoneAlarm Extreme Security Anti-Spyware *Enabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
FW: ZoneAlarm Extreme Security Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\PrintCtrl.exe
C:\Windows\system32\PSIService.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Secunia\PSI\PSIA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Windows\System32\vds.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Program Files\Secunia\PSI\sua.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\kmw_run.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\PrintDisp.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\KMW_SHOW.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Joe\AppData\Local\Google\Update\1.3.21.115\GoogleCrashHandler.exe
C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\PROGRA~1\CHECKP~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Windows\System32\svchost.exe -k wdisvc
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.com/
uWindow Title = Internet Explorer, optimized for Bing and MSN
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - No File
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
BHO: eSnipsBHO Class: {b530a9a4-1722-4d16-aad6-aa85e3ad2ade} - c:\program files\logia\esnipsdownloader\eSnipsBHO.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll "
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll "
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
{ae07101b-46d4-4a98-af68-0333ea26e113}
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {A94E8DC9-07AA-45A7-8AF2-A0375473A5CD} - No File
TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe" -s
uRun: [Google Update] "c:\users\joe\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [kmw_run.exe] kmw_run.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [<NO NAME>]
mRun: [PrintDisp] c:\windows\system32\PrintDisp.exe
mRun: [ISW] c:\program files\checkpoint\zaforcefield\ForceField.exe /icon= "hidden "
mRun: [ZoneAlarm] c:\program files\checkpoint\zonealarm\zatray.exe
mRun: [QuickTime Task] "c:\program files\quicktime alternative\QTTask.exe" -atboottime
mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe" -delete
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
dRunOnce: [ZAFFRegisterTrustChecker] "c:\windows\system32\regsvr32.exe" -s "c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustChecker.dll "
dRunOnce: [ZAFFRegisterTrustCheckerIE] "c:\windows\system32\regsvr32.exe" -s "c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll "
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi_tray.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
Trusted Zone: voltigeur1.net
Trusted Zone: youtube.com
Trusted Zone: youtube.com\www
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{08B4084B-14C0-4E33-8B4B-B123F92BBF89} : DhcpNameServer = 192.168.0.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2010-10-14 11352]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 66632]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2011-8-15 27016]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2011-8-15 493184]
R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [2011-7-12 77824]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2011-11-30 69976]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2012-6-27 1326176]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2012-6-27 681056]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2012-1-22 92592]
R3 icsak;icsak;c:\program files\checkpoint\zaforcefield\ak\icsak.sys [2011-8-15 36744]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2011-12-16 15544]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2011-11-30 197224]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1c9d7efc3b91b1e;Google Update Service (gupdate1c9d7efc3b91b1e);c:\program files\google\update\GoogleUpdate.exe [2009-5-18 133104]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-5 250568]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2012-4-6 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2012-3-8 1492840]
S3 GamesAppService;GamesAppService;c:\program files\wildtangent games\app\GamesAppService.exe [2010-10-12 206072]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-5-18 133104]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== File Associations ===============
.
regfile=regedit.exe "%1" %*
.
=============== Created Last 30 ================
.
2012-09-05 18:57:27 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-05 06:12:55 -------- d-----w- c:\users\joe\appdata\local\{31740EEA-3480-4E44-8BF4-850A00085837}
2012-09-04 18:12:41 -------- d-----w- c:\users\joe\appdata\local\{A15B7A65-44C9-4A0C-B27B-33FD8CFB4334}
2012-09-04 18:12:31 -------- d-----w- c:\users\joe\appdata\roaming\Windows Live Writer
2012-09-04 18:12:31 -------- d-----w- c:\users\joe\appdata\local\Windows Live Writer
2012-09-04 14:38:15 -------- d-----w- c:\users\joe\appdata\local\{86869738-680A-4B48-BF15-2F1B447C817C}
2012-09-04 02:38:13 -------- d-----w- c:\users\joe\appdata\local\{49CE9824-DFC1-43B8-8850-067AEF5591DC}
2012-09-03 14:38:11 -------- d-----w- c:\users\joe\appdata\local\{6E687042-73FC-4A4F-96A0-13999B7BE512}
2012-09-03 02:38:10 -------- d-----w- c:\users\joe\appdata\local\{16922516-A0A1-4B2C-8366-6E20D7DC3798}
2012-09-02 14:38:08 -------- d-----w- c:\users\joe\appdata\local\{79739634-26FD-4CEC-9CFE-E83F07664C86}
2012-09-02 02:38:06 -------- d-----w- c:\users\joe\appdata\local\{72640351-A1C7-48DC-A55A-754DC7C9743B}
2012-09-01 14:37:51 -------- d-----w- c:\users\joe\appdata\local\{0A05C81D-C504-4C77-BB59-6E0DEF0D603A}
2012-09-01 02:37:50 -------- d-----w- c:\users\joe\appdata\local\{625C08A8-D9E2-4EB4-AABE-7D3C6B5EACBA}
2012-08-31 14:37:48 -------- d-----w- c:\users\joe\appdata\local\{E9F46A2F-5306-4382-B601-76435821A7B5}
2012-08-31 02:37:46 -------- d-----w- c:\users\joe\appdata\local\{BA9A1FEF-774D-4A23-9814-8EC5806C6622}
2012-08-30 14:37:45 -------- d-----w- c:\users\joe\appdata\local\{06E6418C-283B-4C68-89F4-FE93C98D4EA4}
2012-08-30 02:37:43 -------- d-----w- c:\users\joe\appdata\local\{C5088B4A-58F3-45E3-A87C-87B40F94992E}
2012-08-29 14:37:41 -------- d-----w- c:\users\joe\appdata\local\{21F6DF92-3EEE-4A5F-B5EC-2B0F921B2D3A}
2012-08-29 02:37:39 -------- d-----w- c:\users\joe\appdata\local\{2E2F0757-8C86-4D93-8C5B-3D50B32860DC}
2012-08-28 14:37:38 -------- d-----w- c:\users\joe\appdata\local\{935788CA-74B0-47E2-9F44-E8955E0AE0FB}
2012-08-28 02:37:36 -------- d-----w- c:\users\joe\appdata\local\{3DFBC23D-D6A4-49ED-99DF-5D79A1B04770}
2012-08-27 14:37:35 -------- d-----w- c:\users\joe\appdata\local\{84E061FF-9D20-4EE1-9108-EDE7710B0E22}
2012-08-25 23:22:42 -------- d-----w- c:\users\joe\appdata\local\{8EFBBCE4-4606-46AC-BB56-C1FAAEDD01C3}
2012-08-25 09:47:47 -------- d-----w- c:\users\joe\appdata\local\{6553DE42-C2FD-4B34-A99F-5AE542581473}
2012-08-24 21:47:45 -------- d-----w- c:\users\joe\appdata\local\{93845D48-C309-4D7A-A7F9-C5259B44BB0D}
2012-08-24 03:43:43 -------- d-----w- c:\users\joe\appdata\local\{F22AFA44-0C95-49EC-AE57-CF714676EB82}
2012-08-23 15:43:41 -------- d-----w- c:\users\joe\appdata\local\{158D3DF7-62CB-4B71-9B7C-02FB7AC9CB45}
2012-08-23 03:43:39 -------- d-----w- c:\users\joe\appdata\local\{9D380A99-0AD3-4E27-8678-1553D32BD755}
2012-08-22 15:43:37 -------- d-----w- c:\users\joe\appdata\local\{C5465355-6C0C-46A4-94F0-36A033DB2437}
2012-08-22 03:43:35 -------- d-----w- c:\users\joe\appdata\local\{01B45683-19C2-4B6D-8364-6A119669772F}
2012-08-21 15:43:34 -------- d-----w- c:\users\joe\appdata\local\{D52DB839-3443-4197-BA75-AA7DA08C6D0A}
2012-08-21 03:43:32 -------- d-----w- c:\users\joe\appdata\local\{F4A3A95A-E460-4AB5-9B57-AEE3ECC793F4}
2012-08-20 15:43:30 -------- d-----w- c:\users\joe\appdata\local\{8CE2AAEE-B6AC-4F18-9AED-DE82766A71B5}
2012-08-20 03:43:28 -------- d-----w- c:\users\joe\appdata\local\{5638D3B1-2D30-4EF7-9EB1-E76EF0715728}
2012-08-18 20:22:57 -------- d-----w- c:\users\joe\appdata\local\{F4F3A097-2AEE-45AA-B21E-E73BA91F7493}
2012-08-18 20:22:57 -------- d-----w- c:\users\joe\appdata\local\{4387B904-B6E4-429F-B2BD-D8312DB2EE90}
2012-08-18 08:22:53 -------- d-----w- c:\users\joe\appdata\local\{06F93DAC-DEAD-4BAB-838C-213F2921DFD8}
2012-08-18 08:22:52 -------- d-----w- c:\users\joe\appdata\local\{F31AA94C-9BB3-436E-A31A-5AA3355ED05D}
2012-08-17 20:22:47 -------- d-----w- c:\users\joe\appdata\local\{035D71DB-1B83-4D27-8410-6FA7D02D3C7B}
2012-08-17 20:22:46 -------- d-----w- c:\users\joe\appdata\local\{0E8A28E1-FE0E-4D37-A43B-FC49042F53BC}
2012-08-17 14:23:02 -------- d-----w- C:\TDSSKiller_Quarantine
2012-08-17 14:14:37 14080 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2012-08-17 01:55:29 -------- d-----w- c:\users\joe\appdata\local\{202354CD-1083-4FBA-AF7E-42A51A450597}
2012-08-17 01:55:27 -------- d-----w- c:\users\joe\appdata\local\{3FB00158-C714-4293-A5D2-DD571B37888B}
2012-08-16 13:55:23 -------- d-----w- c:\users\joe\appdata\local\{249EAA73-4B27-4482-A105-352D23BF6D51}
2012-08-16 13:55:22 -------- d-----w- c:\users\joe\appdata\local\{63F94B59-834A-4BC3-8302-175D7930E8DA}
2012-08-16 01:55:17 -------- d-----w- c:\users\joe\appdata\local\{68224F27-9573-4D3E-9BE7-2CD6B37C0C14}
2012-08-16 01:55:16 -------- d-----w- c:\users\joe\appdata\local\{53EED230-408A-4A02-BDC1-392ABCB2E06A}
2012-08-15 13:55:09 -------- d-----w- c:\users\joe\appdata\local\{0C53E891-A0D8-4EB2-B701-1E0A87D11A57}
2012-08-15 13:55:08 -------- d-----w- c:\users\joe\appdata\local\{B72B302D-0A4C-4939-AB1C-0A768D3D13B5}
2012-08-14 23:46:33 623616 ----a-w- c:\windows\system32\localspl.dll
2012-08-14 16:15:54 -------- d-----w- c:\users\joe\appdata\local\{7D563A44-DDC0-49FE-9312-0C1F55D96870}
2012-08-14 16:15:52 -------- d-----w- c:\users\joe\appdata\local\{79B53F70-52A3-4195-A1C4-43E7F874D7D1}
2012-08-14 04:15:42 -------- d-----w- c:\users\joe\appdata\local\{E4245D59-3694-459F-8A42-E5E824B2F83C}
2012-08-14 04:15:40 -------- d-----w- c:\users\joe\appdata\local\{40DE5487-D0D4-4787-B2AA-A7124096F038}
2012-08-13 16:15:32 -------- d-----w- c:\users\joe\appdata\local\{EF9A2670-E491-473D-9EB8-1377DAB404F6}
2012-08-13 16:15:30 -------- d-----w- c:\users\joe\appdata\local\{8CA2AB22-915A-4C1A-81CA-AF185945E2AA}
2012-08-13 04:15:19 -------- d-----w- c:\users\joe\appdata\local\{02FC1352-DE34-4D73-B567-567776862C2C}
2012-08-13 04:15:17 -------- d-----w- c:\users\joe\appdata\local\{0AB5A0C5-DF53-440B-B1FB-0269D1BBA835}
2012-08-12 16:15:10 -------- d-----w- c:\users\joe\appdata\local\{1AE59B3B-1F6D-4B3B-8204-F63BE36D026D}
2012-08-12 16:15:07 -------- d-----w- c:\users\joe\appdata\local\{B2C91100-7420-4FA0-9017-3D08CA61118A}
2012-08-12 04:14:58 -------- d-----w- c:\users\joe\appdata\local\{316A08CD-44B5-4B1F-BAAE-A7B5DC41C738}
2012-08-12 04:14:56 -------- d-----w- c:\users\joe\appdata\local\{8711D81C-939D-409F-89DF-9A30E695BCB9}
2012-08-11 16:14:47 -------- d-----w- c:\users\joe\appdata\local\{84F0C098-70AA-454A-9419-0D36B5A35975}
2012-08-11 16:14:45 -------- d-----w- c:\users\joe\appdata\local\{D34A039C-F345-4739-A950-39FFFAA8BEE7}
2012-08-11 04:14:37 -------- d-----w- c:\users\joe\appdata\local\{4F162E1C-E97A-4824-A783-340BCC9AFA1C}
2012-08-11 04:14:36 -------- d-----w- c:\users\joe\appdata\local\{2030BF32-758D-4CDC-87B2-ED774F162992}
2012-08-10 16:14:28 -------- d-----w- c:\users\joe\appdata\local\{2AA948E1-3156-4227-8F87-01D5060113AA}
2012-08-10 16:14:26 -------- d-----w- c:\users\joe\appdata\local\{632255A9-9C6C-4150-92C2-55FFF5AB547D}
2012-08-10 04:14:18 -------- d-----w- c:\users\joe\appdata\local\{BE8B2F6D-3614-4248-89CA-E9A61A45B272}
2012-08-10 04:14:15 -------- d-----w- c:\users\joe\appdata\local\{C2EB7D58-7048-41D9-8C19-67E98EFAC325}
2012-08-09 16:14:07 -------- d-----w- c:\users\joe\appdata\local\{35219CD0-556F-4D1E-906D-6CD53446CFDA}
2012-08-09 16:14:05 -------- d-----w- c:\users\joe\appdata\local\{647D7E32-4130-4FB3-9040-51AA27F89C55}
2012-08-09 04:13:57 -------- d-----w- c:\users\joe\appdata\local\{4D52E676-A7C5-4B8F-AD51-EDD337C29293}
2012-08-09 04:13:56 -------- d-----w- c:\users\joe\appdata\local\{F64F38F9-78B6-4897-8CBD-1BCFED8D91C7}
2012-08-08 16:13:48 -------- d-----w- c:\users\joe\appdata\local\{37D4F633-0E68-4A44-8914-C45D66AAD035}
2012-08-08 16:13:46 -------- d-----w- c:\users\joe\appdata\local\{9ECC519A-D039-4292-A3DA-C9AA6F5AE463}
2012-08-08 04:13:39 -------- d-----w- c:\users\joe\appdata\local\{ECF857D4-35C6-4EEC-8E4C-1BF921E40B56}
2012-08-08 04:13:37 -------- d-----w- c:\users\joe\appdata\local\{D0E6F02E-737A-4E66-A7B5-C9F8480D042F}
2012-08-07 16:13:30 -------- d-----w- c:\users\joe\appdata\local\{15F0EA58-D44B-422D-929E-AE59B0DFF47E}
2012-08-07 16:13:28 -------- d-----w- c:\users\joe\appdata\local\{F7D5B5D2-1B30-4CAD-950A-298ADE237C23}
2012-08-07 04:13:18 -------- d-----w- c:\users\joe\appdata\local\{FECCA96D-BB52-40F7-8B74-AAB7891A173E}
2012-08-07 04:13:16 -------- d-----w- c:\users\joe\appdata\local\{591A57AB-AE60-4BEF-9ED6-E399384991E9}
.
==================== Find3M ====================
.
2012-09-05 18:57:07 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-05 18:57:07 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-09-04 17:57:47 7304 ----a-w- c:\windows\TMP0001.TMP
2012-08-23 17:26:58 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-23 17:26:58 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-04 14:02:46 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-07-01 19:32:33 848 --sha-w- c:\programdata\KGyGaAvL.sys
2012-06-29 00:16:58 1800704 ----a-w- c:\windows\system32\jscript9.dll
2012-06-29 00:09:01 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-06-29 00:08:59 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-06-29 00:04:43 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-06-29 00:00:45 2382848 ----a-w- c:\windows\system32\mshtml.tlb
.
============= FINISH: 14:40:38.50 ===============

 

DDS2
-----
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 10/03/2008 3:56:13 PM
System Uptime: 04/09/2012 11:57:26 AM (27 hours ago)
.
Motherboard: ECS | | Nettle3
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5200+ | Socket AM2 | 2700/201mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 326 GiB total, 265.535 GiB free.
D: is FIXED (NTFS) - 9 GiB total, 1.285 GiB free.
E: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1910: 30/08/2012 12:00:02 AM - Scheduled Checkpoint
RP1911: 31/08/2012 12:06:32 AM - Scheduled Checkpoint
RP1912: 01/09/2012 12:23:30 AM - Scheduled Checkpoint
RP1913: 02/09/2012 12:20:13 AM - Scheduled Checkpoint
RP1914: 04/09/2012 1:15:32 PM - Scheduled Checkpoint
RP1915: 05/09/2012 12:55:50 PM - Installed Java 7 Update 7
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer
Acrobat.com
Adobe AIR
Adobe Download Manager
Adobe Flash Player 11 ActiveX
Adobe Reader 9.3
Apple Application Support
Apple Software Update
Audacity 1.3.11 (Unicode)
BIG-IP Edge Client Components (All Users)
Bing Bar
BufferChm
C309a
CCleaner
Color Efex Pro 3.0 Corel Sampler
Compatibility Pack for the 2007 Office system
Corel Paint Shop Pro Photo X2
Corel Painter Photo Essentials 4
Coupon Printer for Windows
CyberLink DVD Suite Deluxe
D110
D3DX10
Destinations
DeviceDiscovery
DivX Setup
DocProc
Enhanced Multimedia Keyboard Solution
Escape Rosecliff Island
FileZilla Client 3.5.3
GearDrvs
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
GPBaseService2
Hardware Diagnostic Tools
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Advisor
HP Customer Experience Enhancements
HP Customer Feedback
HP Customer Participation Program 14.0
HP Demo
HP Driver Diagnostics
HP Easy Setup - Frontend
HP Games
HP Imaging Device Functions 14.0
HP Photo Creations
HP Photosmart D110 All-In-One Driver Software 14.0 Rel. 7
HP Picasso Media Center Add-In
HP Print Diagnostic Utility
HP Product Detection
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
HPAppStudio
HPPhotoGadget
HPPhotoSmartDiscLabel_PaperLabel
HPPhotoSmartDiscLabel_PrintOnDisc
HPPhotoSmartDiscLabelContent1
hpphotosmartdisclabelplugin
HPProductAssistant
HPSSupply
Java 7 Update 7
Java Auto Updater
JavaFX 2.1.1
Junk Mail filter update
Kensington MouseWorks
LabelPrint
LAME v3.98.2 for Audacity
LightScribe Applications
LightScribe System Software 1.10.23.1
Malwarebytes Anti-Malware version 1.61.0.1400
MarketResearch
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Corporation
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft LifeCam
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.5
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF Add-in for 2007 Microsoft Office programs
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 6.1
NCH Toolbox
Network
NVIDIA Drivers
OCR Software by I.R.I.S. 12.0
OGA Notifier 2.0.0048.0
Paint Shop Pro 7
PC Tune-Up
PHOTORECOVERY LE
Power2Go
PowerDirector
PS_AIO_05_C309_Software_Min
PS_AIO_07_D110_SW_Min
Python 2.5
QuickTime
QuickTime Alternative 2.1.1
QuickTransfer
Readiris 7.5
Realtek High Definition Audio Driver
Revo Uninstaller 1.90
Scan
Secunia PSI (3.0.0.2004)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
Segoe UI
Shaw Internet Update 3.2.2
Shaw Support 8.1.1
Shop for HP Supplies
SmartWebPrinting
Snapfish Picture Mover
Soft Data Fax Modem with SmartCP
SolutionCenter
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
Status
SUPERAntiSpyware Free Edition
Switch Sound File Converter
TomTom HOME 2.8.3.2499
TomTom HOME Visual Studio Merge Modules
Toolbox
TrayApp
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update Installer for WildTangent Games App
VC 9.0 Runtime
VC80CRTRedist - 8.0.50727.6195
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WeatherBug Gadget
WebReg
WildTangent Games App (HP Games)
Windows Driver Package - Realtek (RSUSBSTOR) USB (10/27/2010 6.1.7600.30126)
Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (10/18/2011 6.0.1.6482)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
ZoneAlarm Antivirus
ZoneAlarm DataLock
ZoneAlarm Extreme Security
ZoneAlarm Firewall
ZoneAlarm Security
.
==== Event Viewer Messages From Past Week ========
.
05/09/2012 1:47:07 PM, Error: nvstor32 [5] - A parity error was detected on \Device\RaidPort0.
04/09/2012 12:02:08 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd
04/09/2012 12:02:08 PM, Error: Service Control Manager [7022] - The Diagnostic System Host service hung on starting.
04/09/2012 12:02:06 PM, Error: Service Control Manager [7022] - The Diagnostic Service Host service hung on starting.
04/09/2012 12:02:04 PM, Error: Service Control Manager [7022] - The MSCamSvc service hung on starting.
.
==== End Of File ===========================

 

C:\ComboFix.txt

Thanks Broni
------------
ComboFix 12-09-07.03 - Joe 07/09/2012 21:25:49.1.2 - x86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.2.1033.18.3006.1624 [GMT -6:00]
Running from: c:\users\Joe\Desktop\ComboFix.exe
FW: ZoneAlarm Extreme Security Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: ZoneAlarm Extreme Security Anti-Spyware *Disabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Joe\Documents\Asklaver.scr
c:\windows\system32\~GLH0023.TMP
c:\windows\system32\~GLH0024.TMP
c:\windows\system32\~GLH0025.TMP
c:\windows\system32\drivers\~GLH0014.TMP
.
.
((((((((((((((((((((((((( Files Created from 2012-08-08 to 2012-09-08 )))))))))))))))))))))))))))))))
.
.
2012-09-08 03:34 . 2012-09-08 03:34 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2012-09-08 03:34 . 2012-09-08 03:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-05 18:58 . 2012-09-05 18:58 -------- d-----w- c:\program files\Common Files\Java
2012-09-05 18:57 . 2012-09-05 18:57 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-05 18:57 . 2012-09-05 18:57 -------- d-----w- c:\program files\Java
2012-09-04 18:12 . 2012-09-04 18:12 -------- d-----w- c:\users\Joe\AppData\Local\Windows Live Writer
2012-09-04 18:12 . 2012-09-04 18:12 -------- d-----w- c:\users\Joe\AppData\Roaming\Windows Live Writer
2012-08-17 14:23 . 2012-08-17 14:23 -------- d-----w- C:\TDSSKiller_Quarantine
2012-08-17 14:14 . 2012-08-17 14:14 14080 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2012-08-14 23:46 . 2012-05-11 15:57 623616 ----a-w- c:\windows\system32\localspl.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-07 13:41 . 2008-05-22 20:56 7304 ----a-w- c:\windows\TMP0001.TMP
2012-09-05 18:57 . 2012-05-27 19:10 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-05 18:57 . 2010-04-17 03:49 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-23 17:26 . 2012-04-05 21:32 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-23 17:26 . 2011-08-16 15:01 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-01 19:32 . 2009-07-02 16:27 848 --sha-w- c:\programdata\KGyGaAvL.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"TomTomHOME.exe "= "c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2012-01-23 247728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kmw_run.exe "= "kmw_run.exe" [2002-12-23 102400]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"PrintDisp "= "c:\windows\system32\PrintDisp.exe" [2009-08-21 878080]
"ZoneAlarm "= "c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2011-09-13 72848]
"QuickTime Task "= "c:\program files\QuickTime Alternative\QTTask.exe" [2012-04-19 421888]
"SunJavaUpdateReg "= "c:\windows\system32\jureg.exe" [2007-04-07 54936]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ZAFFRegisterTrustChecker "= "-s" [X]
"ZAFFRegisterTrustCheckerIE "= "-s" [X]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2012-6-27 572000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 21:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
backup=c:\windows\pss\hp psc 2000 Series.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^officejet 6100.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\officejet 6100.lnk
backup=c:\windows\pss\officejet 6100.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Joe^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 07:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-02-21 03:28 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel File Shell Monitor]
2008-08-09 00:30 16712 ----a-r- c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
2008-08-09 00:30 532808 ----a-r- c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eSnips_Downloader]
2010-03-08 15:41 1233408 ----a-w- c:\program files\Logia\eSnipsDownloader\eSnips_Downloader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-10-14 05:04 136176 ----atw- c:\users\Joe\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 08:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
2008-08-20 17:54 150016 ----a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 15:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2009-07-24 22:05 118640 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2012-04-04 21:56 981680 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2012-04-04 21:56 981680 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2012-03-09 00:50 4280184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrintUtil]
2009-05-07 23:08 727552 ----a-w- c:\program files\HP\HP Print Utility\PrintUtil.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-07-03 17:27 6266880 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\shawnotify]
2009-05-11 14:47 378152 ----a-w- c:\progra~1\shaw\Update\siuloader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 22:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-09-22 02:24 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2012-01-23 04:43 247728 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2009-06-27 00:21 757248 ----a-w- c:\windows\vVX3000.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
getPlusHelper REG_MULTI_SZ getPlusHelper
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 17:26]
.
2012-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-18 19:34]
.
2012-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-18 19:34]
.
2012-09-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3713060884-1631031299-1821023285-1000Core.job
- c:\users\Joe\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-09 05:04]
.
2012-09-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3713060884-1631031299-1821023285-1000UA.job
- c:\users\Joe\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-09 05:04]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
Trusted Zone: voltigeur1.net
Trusted Zone: youtube.com
Trusted Zone: youtube.com\www
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{A94E8DC9-07AA-45A7-8AF2-A0375473A5CD} - (no file)
HKLM-Run-ISW - (no file)
SafeBoot-38309811.sys
MSConfigStartUp-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
MSConfigStartUp-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSConfigStartUp-Info Center - c:\program files\PCPitstop\Info Center\InfoCenter.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe
MSConfigStartUp-Symantec PIF AlertEng - c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
AddRemove-_{707EB912-C597-49D8-9460-46CC9AB03EBE} - c:\program files\Corel\Corel Painter Photo Essentials 4\MSILauncher {707EB912-C597-49D8-9460-46CC9AB03EBE}
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-07 21:34
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{08b4084b-14c0-4e33-8b4b-b123f92bbf89}]
@DACL=(02 0000)
"Dhcpv6Iaid "=dword:0f001e90
"Dhcpv6State "=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{37c27e9f-1111-49b2-8bc3-1bf1cd53ddff}]
@DACL=(02 0000)
"Dhcpv6Iaid "=dword:14000000
"Dhcpv6State "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{6299b6ec-1d46-4a2a-845a-2b8aa3cff631}]
@DACL=(02 0000)
"Dhcpv6Iaid "=dword:15020054
"Dhcpv6State "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9c642153-bfe0-4511-a0b6-e778ddd5ea9e}]
@DACL=(02 0000)
"Dhcpv6Iaid "=dword:07001422
"Dhcpv6State "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{ba32a50a-3d27-4fae-8591-5916311409be}]
@DACL=(02 0000)
"Dhcpv6Iaid "=dword:0c001422
"Dhcpv6State "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f50c0996-5b4a-4c6a-a322-6e991d4caa0e}]
@DACL=(02 0000)
"Dhcpv6Iaid "=dword:06001422
"Dhcpv6State "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f70a361f-6437-4fcc-91a4-cd88d468d91b}]
@DACL=(02 0000)
"Dhcpv6Iaid "=dword:0e001422
"Dhcpv6State "=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(732)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
.
- - - - - - - > 'csrss.exe'(620)
c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
.
- - - - - - - > 'csrss.exe'(684)
c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
.
Completion time: 2012-09-07 21:37:43
ComboFix-quarantined-files.txt 2012-09-08 03:37
.
Pre-Run: 284,281,679,872 bytes free
Post-Run: 284,245,258,240 bytes free
.
- - End Of File - - 4F03103283114B90913026B99C046AC1

 

Thanks a lot, would you know how I can remove those annoying three e mails that keep coming in my e mail in-box each time I start Windows Mail?

 

I did start in the Microsoft Mail (Outlook / Outlook Express / Windows (Live) Mail) section, but I was advised to go to the malware section.
I shall close this topic as closed and respost the original topic.
Thanks again for checking my pc. At least I know for sure that it is free of malware.