Inactive Infostealer.Gampass/prast!rts

[Inactive] Infostealer.Gampass/prast!rts

GRRR. I have not had a virus in years, but I seem to have a bad one now. I can't figure out how to get rid of it after doing basic antivirus scans, and it variously seems to be called Infostealer.Gampass or prast!rts by different anti-virus programs. When I restart, it always seems to come back.

Having looked through some previous threads here, I downloaded combofix and made a log, and downloaded hijackthis and made a log. The combofix log is in red, and the hijackthis log is in blue:

ComboFix 10-03-29.04 - Local User 04/01/2010 14:13:57.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1052 [GMT -5:00]
Running from: c:\documents and settings\Local User\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-3138448158-2110211352-3632139185-1015
c:\recycler\S-1-5-21-3138448158-2110211352-3632139185-500
c:\recycler\S-1-5-21-314820980-2871605961-905288066-500
c:\recycler\S-1-5-21-329068152-287218729-725345543-500
c:\recycler\S-1-5-21-574970931-3975898945-1403130414-500
c:\windows\AegisP.inf
c:\windows\Fonts\usps4cb.ttf

.
((((((((((((((((((((((((( Files Created from 2010-03-01 to 2010-04-01 )))))))))))))))))))))))))))))))
.

2010-04-01 19:10 . 2010-04-01 19:10 46640 ----a-w- c:\windows\system32\msln.exe
2010-04-01 14:03 . 2009-03-11 03:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2010-04-01 14:03 . 2009-03-11 03:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2010-04-01 14:03 . 2010-04-01 14:03 -------- d-----w- c:\windows\system32\KB905474
2010-03-31 20:36 . 2009-05-07 07:04 157712 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-03-31 17:34 . 2010-03-31 17:35 -------- d-----w- c:\program files\CCleaner
2010-03-31 17:26 . 2010-03-31 17:26 125952 ----a-w- c:\documents and settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-03-31 17:24 . 2010-04-01 18:17 912160 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-03-31 17:24 . 2010-04-01 18:17 5938720 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-03-31 17:11 . 2010-03-31 19:31 -------- d-----w- c:\program files\Common Files\ParetoLogic
2010-03-31 17:11 . 2010-03-31 19:31 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-03-31 17:10 . 2010-03-31 17:10 -------- d-----w- c:\documents and settings\Local User\Local Settings\Application Data\Downloaded Installations
2010-03-31 06:22 . 2010-03-31 06:22 388096 ----a-r- c:\documents and settings\Local User\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-03-31 06:10 . 2010-03-31 06:13 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{7C6801DE-A66A-4DF2-A561-77A914FC1896}-keygen.exe
2010-03-31 06:10 . 2010-03-31 06:13 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{5E2064E6-D59E-4E52-A7DD-C08E187E7DC6}-keygen.exe
2010-03-31 06:10 . 2010-03-31 06:13 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{066B082D-0668-4498-A03B-19B2FEB2A4E1}-keygen.exe
2010-03-31 06:10 . 2010-03-31 06:13 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{27C38909-4A5C-4837-A07E-0976CCB6E6A7}-keygen.exe
2010-03-31 06:10 . 2010-03-31 06:10 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{873B5C8E-0C61-4B1A-B76A-D0C3DA575AF4}-keygen.exe
2010-03-31 06:09 . 2010-03-31 06:09 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{1A03E2C8-8E25-43D4-9B2A-AAA18DB4B734}-keygen.exe
2010-03-31 06:03 . 2010-03-31 06:03 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{902B39F9-30A2-434C-AF7D-6950A687ECCF}-keygen.exe
2010-03-31 06:02 . 2009-11-10 15:26 767952 ----a-w- c:\windows\BDTSupport.dll
2010-03-31 06:02 . 2009-11-10 15:28 149456 ----a-w- c:\windows\SGDetectionTool.dll
2010-03-31 06:02 . 2008-11-26 17:08 131 ----a-w- c:\windows\IDB.zip
2010-03-31 06:02 . 2009-10-28 06:36 1152444 ----a-w- c:\windows\UDB.zip
2010-03-31 06:02 . 2009-11-10 15:28 1640400 ----a-w- c:\windows\PCTBDCore.dll
2010-03-31 06:02 . 2009-11-10 15:28 165840 ----a-w- c:\windows\PCTBDRes.dll
2010-03-31 05:57 . 2010-03-31 05:57 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{0054DFA9-519C-4E96-ADB8-903D93C2AA04}-keygen.exe
2010-03-31 05:55 . 2010-03-31 16:37 -------- d-----w- c:\program files\Common Files\PC Tools
2010-03-31 05:55 . 2010-03-31 16:37 -------- d-----w- c:\program files\Spyware Doctor
2010-03-31 05:44 . 2010-03-31 05:44 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{8AACB184-8352-463D-AAC0-408161CA6790}-keygen.exe
2010-03-31 04:12 . 2010-03-31 04:12 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{EE4404D3-A7CC-46F5-93E2-0DC53F502CC3}-keygen.exe
2010-03-31 04:01 . 2010-03-31 04:01 0 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{815810D5-B51B-4F81-9792-F1F825FEB3BC}-keygen.exe
2010-03-31 02:30 . 2010-04-01 19:05 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-31 00:26 . 2010-03-31 00:29 -------- d-----w- c:\documents and settings\Local User\Application Data\.clamwin
2010-03-31 00:25 . 2010-03-31 00:25 -------- d-----w- c:\program files\ClamWin
2010-03-31 00:25 . 2010-03-31 00:25 -------- d-----w- c:\documents and settings\All Users\.clamwin
2010-03-30 15:23 . 2010-03-30 15:23 -------- d-----w- c:\documents and settings\Local User\.spss
2010-03-10 16:53 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-10 04:33 . 2010-03-10 04:33 1025024 -c----w- c:\windows\system32\dllcache\browseui.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-01 19:07 . 2008-06-14 07:38 -------- d-----w- c:\program files\Symantec AntiVirus
2010-04-01 18:23 . 2008-07-08 04:22 90144 ----a-w- c:\documents and settings\Local User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-01 18:17 . 2010-03-31 17:24 86588 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-04-01 18:17 . 2010-03-31 17:24 80612 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-03-31 19:52 . 2008-10-25 04:55 -------- d-----w- c:\program files\tools
2010-03-31 17:41 . 2009-02-17 19:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-30 15:23 . 2009-11-21 17:46 186 ----a-w- c:\documents and settings\All Users\Application Data\SafeNet Sentinel\Sentinel RMS Development Kit\System\prsgrc.dll
2010-03-24 22:32 . 2008-06-16 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-12 17:35 . 2009-09-30 05:26 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-02-28 21:32 . 2008-06-12 13:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-28 21:29 . 2009-01-03 15:26 -------- d-----w- c:\program files\Games
2010-02-26 05:43 . 2004-08-04 12:00 667136 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 05:43 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 15:16 . 2009-09-30 05:32 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-18 03:20 . 2010-02-18 02:54 13679259 ----a-w- C:\EVAutosVID0217.zip
2010-02-17 22:20 . 2010-02-23 16:27 114360 ----a-w- c:\documents and settings\Local User\Application Data\Mozilla\Firefox\Profiles\g3jikydi.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
2010-02-14 20:42 . 2008-10-10 00:26 -------- d-----w- c:\program files\Notepad++
2010-02-06 17:16 . 2010-02-06 17:16 -------- d-----w- c:\program files\MSECache
2010-02-06 17:15 . 2010-02-06 17:15 -------- d-----w- c:\program files\Satori Software
2010-02-06 17:15 . 2010-02-06 17:15 -------- d-----w- c:\program files\Common Files\Data Dynamics
2010-02-02 18:43 . 2009-09-14 04:02 -------- d-----w- c:\documents and settings\Local User\Application Data\vlc
2008-07-08 04:18 . 2008-07-08 04:18 14290 -c--a-w- c:\program files\settings.dat
2009-09-25 16:41 . 2009-09-25 16:41 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2010-02-21 1093208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 23:37 34344 ----a-w- c:\program files\Lenovo\HOTKEY\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2007-12-14 23:36 28672 ----a-w- c:\program files\Lenovo\HOTKEY\tphklock.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck msln\0autocheck autochk *\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ImageMixer 3 SE Camera Monitor Ver.5.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ImageMixer 3 SE Camera Monitor Ver.5.lnk
backup=c:\windows\pss\ImageMixer 3 SE Camera Monitor Ver.5.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Local User^Start Menu^Programs^Startup^Juice.lnk]
path=c:\documents and settings\Local User\Start Menu\Programs\Startup\Juice.lnk
backup=c:\windows\pss\Juice.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Local User^Start Menu^Programs^Startup^MagicDisc.lnk]
path=c:\documents and settings\Local User\Start Menu\Programs\Startup\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 21:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-18 14:58 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AwaySch]
2006-11-08 02:51 91688 ----a-w- c:\program files\Lenovo\AwayTask\AwaySch.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
2006-07-20 02:26 52896 ----a-w- c:\program files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClamWin]
2009-11-04 02:49 86016 ----a-w- c:\program files\ClamWin\bin\ClamTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EZEJMNAP]
2007-04-27 09:33 243248 ----a-w- c:\progra~1\ThinkPad\UTILIT~1\EZEJMNAP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoToMeeting]
2010-01-15 15:41 31552 ----a-w- c:\program files\Citrix\GoToMeeting\320\g2mstart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-03-05 21:48 166424 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-03-05 21:48 141848 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-04-02 21:11 342312 ----a-w- c:\program files\tools\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPMailChecker]
2008-01-11 09:21 124248 ----a-w- c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]
2008-01-11 09:21 144728 ----a-w- c:\progra~1\THINKV~1\PrdCtr\LPMGR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-03-05 21:48 137752 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient]
2002-12-16 22:51 36864 ----a-w- c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-11-29 02:58 1217808 ----a-w- c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-12-06 00:45 136600 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPHOTKEY]
2008-02-14 01:28 66928 ----a-w- c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPKMAPHELPER]
2007-01-09 23:28 868352 ----a-w- c:\program files\ThinkPad\Utilities\TpKmapAp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TpShocks]
2007-11-22 22:09 181536 ----a-w- c:\windows\system32\TpShocks.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrackPointSrv]
2008-03-04 22:28 92960 ----a-w- c:\program files\Lenovo\TrackPoint\tp4serv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy]
2008-03-04 15:34 487424 ----a-w- c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2009-08-02 10:19 288048 ----a-w- c:\program files\tools\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
2006-09-28 03:33 125168 ----a-w- c:\progra~1\SYMANT~1\VPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-04 00:20 866584 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVpnClient.exe "=
"c:\\Program Files\\Windows Defender\\MSASCui.exe "=
"c:\\Program Files\\Trillian\\trillian.exe "=
"c:\\Documents and Settings\\Local User\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe "=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=
"c:\\Program Files\\tools\\iTunes\\iTunes.exe "=
"c:\\Program Files\\tools\\SopCast\\adv\\SopAdver.exe "=
"c:\\Program Files\\tools\\SopCast\\SopCast.exe "=
"c:\\Program Files\\tools\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6273:TCP "= 6273:TCP:TCP 6273
"62825:UDP "= 62825:UDP:UDP 62825

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/25/2009 8:56 PM 64160]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [10/16/2007 8:32 PM 19504]
R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [6/16/2008 3:36 PM 101528]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 9:49 AM 1028432]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/16/2008 3:29 PM 24652]
R3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [3/4/2008 5:28 PM 22568]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [5/16/2009 11:24 PM 717296]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [3/31/2010 1:02 AM 112592]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/4/2009 1:03 PM 102448]
S3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [6/16/2008 3:35 PM 24876]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 10:33 PM 116464]

--- Other Services/Drivers In Memory ---

*Deregistered* - EraserUtilDrvI9

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-03-30 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 01:56]

2010-04-01 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-12-10 00:02]

2010-04-01 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-12-10 00:02]

2010-04-01 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]

2010-04-01 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-04-01 03:18]
.
.
------- Supplementary Scan -------
.
uStart Page = file:///C:/Documents%20and%20Settings/All%20Users/HomePageFiles/starthere.html
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: microsoft.com\*.update
Trusted Zone: windowsupdate.com\download
DPF: CabCCT - hxxps://ondemand.apptix.net/codebase/ActCtrl_Apptix.cab
FF - ProfilePath - c:\documents and settings\Local User\Application Data\Mozilla\Firefox\Profiles\g3jikydi.default\
FF - prefs.js: browser.search.selectedEngine - Google (Language: EN)
FF - prefs.js: browser.startup.homepage - hxxp://www.windowsbbs.com/malware-virus-removal/75900-resolved-pls-help-infostealer-gampass-virus.html
FF - component: c:\documents and settings\Local User\Application Data\Mozilla\Firefox\Profiles\g3jikydi.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - component: c:\documents and settings\Local User\Application Data\Mozilla\Firefox\Profiles\g3jikydi.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\tools\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: c:\program files\tools\DivX\DivX Web Player\npdivx32.dll
FF - plugin: c:\program files\tools\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: c:\program files\tools\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\tools\VLC\npvlc.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-ISTray - c:\program files\Spyware Doctor\pctsTray.exe
MSConfigStartUp-ParetoLogic Anti-Virus PLUS - c:\program files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.lnk
MSConfigStartUp-TomcatStartup - c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-01 14:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\documents and settings\Local User\Application Data\Mozilla\Firefox\Profiles\g3jikydi.default\pluginreg.dat.bak 14115 bytes
c:\documents and settings\Local User\Application Data\Mozilla\Firefox\Profiles\g3jikydi.default\prefs.js.BAK 70325 bytes
c:\documents and settings\Local User\Application Data\Mozilla\Firefox\Profiles\g3jikydi.default\user.js.BAK 0 bytes

scan completed successfully
hidden files: 3

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1732)
c:\program files\Lenovo\HOTKEY\tphklock.dll
.
Completion time: 2010-04-01 14:23:29
ComboFix-quarantined-files.txt 2010-04-01 19:23

Pre-Run: 12,977,479,680 bytes free
Post-Run: 13,297,909,760 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 479AFE7ACD6480F8BE0B46FF06958AD3




Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 2:33:58 PM, on 4/1/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\JHSecure\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\SearchIndexer.exe
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
C:\Program Files\HijackThis\TrendMicro\HiJackThis\Hjkilluh.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/All%20Users/HomePageFiles/starthere.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\tools\iMacros\imacros.dll
O9 - Extra 'Tools' menuitem: iMacros Web Automation - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\tools\iMacros\imacros.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: CabCCT - https://ondemand.apptix.net/codebase/ActCtrl_Apptix.cab
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1213276585406
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\JHSecure\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.30\bin\mysqld.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/LOCALU~1/LOCALS~1/Temp/msohtmlclip1/01/clip_image001.gif

--
End of file - 8953 bytes





Thanks for any help!

 

Sorry. I had looked up and saw the stickies, but somehow did not see the announcement above them! Sorry and thanks for your help.

Here is DDS.txt, Attach.txt is in the next post.


DDS.txt

DDS (Ver_10-03-17.01) - NTFSx86
Run by Local User at 15:07:50.56 on Thu 04/01/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.900 [GMT -5:00]

AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\JHSecure\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\SearchIndexer.exe
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\TrendMicro\HiJackThis\Hjkilluh.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Local User\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = file:///C:/Documents%20and%20Settings/All%20Users/HomePageFiles/starthere.html
uInternet Connection Wizard,ShellNext = iexplore
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
EB: iOpus iMacros: {0483894e-2422-45e0-8384-021aff1af3cd} - c:\program files\tools\imacros\imacros.dll
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0483894E-2422-45E0-8384-021AFF1AF3CD} - {0483894E-2422-45E0-8384-021AFF1AF3CD} - c:\program files\tools\imacros\imacros.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: microsoft.com\*.update
Trusted Zone: windowsupdate.com\download
DPF: CabCCT - hxxps://ondemand.apptix.net/codebase/ActCtrl_Apptix.cab
DPF: {2DAD3559-2923-4935-AD49-B673D2539944} - hxxp://www-307.ibm.com/pc/support/acpir.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1213276585406
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Notify: igfxcui - igfxdev.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
Notify: tpfnf2 - c:\program files\lenovo\hotkey\notifyf2.dll
Notify: tphotkey - c:\program files\lenovo\hotkey\tphklock.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\localu~1\applic~1\mozilla\firefox\profiles\g3jikydi.default\
FF - prefs.js: browser.search.selectedEngine - Google (Language: EN)
FF - prefs.js: browser.startup.homepage - hxxp://www.windowsbbs.com/malware-virus-removal/75900-resolved-pls-help-infostealer-gampass-virus.html
FF - component: c:\documents and settings\local user\application data\mozilla\firefox\profiles\g3jikydi.default\extensions\{81bf1d23-5f17-408d-ac6b-bd6df7caf670}\components\XpcomOpusConnector.dll
FF - component: c:\documents and settings\local user\application data\mozilla\firefox\profiles\g3jikydi.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\tools\divx\divx player\npDivxPlayerPlugin.dll
FF - plugin: c:\program files\tools\divx\divx web player\npdivx32.dll
FF - plugin: c:\program files\tools\itunes\mozilla plugins\npitunes.dll
FF - plugin: c:\program files\tools\picasa3\npPicasa3.dll
FF - plugin: c:\program files\tools\vlc\npvlc.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-9-25 64160]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2007-10-16 19504]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-18 149040]
R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [2008-6-16 101528]
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-9-27 1813232]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-6-16 24652]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100326.019\naveng.sys [2010-3-26 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100326.019\navex15.sys [2010-3-26 1324720]
R3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [2008-3-4 22568]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2010-3-31 112592]
S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-9-4 102448]
S3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [2008-6-16 24876]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-9-27 116464]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

=============== Created Last 30 ================

2010-04-01 19:10:36 46640 ----a-w- c:\windows\system32\msln.exe
2010-04-01 19:09:07 0 d-sha-r- C:\cmdcons
2010-04-01 19:06:25 77312 ----a-w- c:\windows\MBR.exe
2010-04-01 19:06:24 261632 ----a-w- c:\windows\PEV.exe
2010-04-01 19:06:24 161792 ----a-w- c:\windows\SWREG.exe
2010-04-01 19:06:23 98816 ----a-w- c:\windows\sed.exe
2010-03-31 20:36:50 157712 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-03-31 17:34:54 0 d-----w- c:\program files\CCleaner
2010-03-31 17:24:36 912160 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-03-31 17:24:36 86588 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-03-31 17:24:36 80612 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-03-31 17:24:36 5938720 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-03-31 17:24:08 3117 ----a-w- C:\rollback.ini
2010-03-31 17:11:32 0 d-----w- c:\program files\common files\ParetoLogic
2010-03-31 17:11:32 0 d-----w- c:\docume~1\alluse~1\applic~1\ParetoLogic
2010-03-31 06:02:34 767952 ----a-w- c:\windows\BDTSupport.dll
2010-03-31 06:02:26 882 ----a-w- c:\windows\RegSDImport.xml
2010-03-31 06:02:26 880 ----a-w- c:\windows\RegISSImport.xml
2010-03-31 06:02:24 149456 ----a-w- c:\windows\SGDetectionTool.dll
2010-03-31 06:02:24 131 ----a-w- c:\windows\IDB.zip
2010-03-31 06:02:23 1152444 ----a-w- c:\windows\UDB.zip
2010-03-31 06:02:21 1640400 ----a-w- c:\windows\PCTBDCore.dll
2010-03-31 06:02:20 165840 ----a-w- c:\windows\PCTBDRes.dll
2010-03-31 05:55:44 0 d-----w- c:\program files\common files\PC Tools
2010-03-31 05:55:43 0 d-----w- c:\program files\Spyware Doctor
2010-03-31 00:26:35 0 d-----w- c:\docume~1\localu~1\applic~1\.clamwin
2010-03-31 00:25:33 0 d-----w- c:\program files\ClamWin
2010-03-31 00:25:33 0 d-----w- c:\documents and settings\all users\.clamwin
2010-03-30 15:23:55 0 d-----w- c:\documents and settings\local user\.spss
2010-03-10 16:53:44 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-10 04:33:38 1025024 -c----w- c:\windows\system32\dllcache\browseui.dll

==================== Find3M ====================

2010-02-26 05:43:57 667136 ------w- c:\windows\system32\wininet.dll
2010-02-26 05:43:54 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 15:16:06 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-18 03:20:24 13679259 ----a-w- C:\EVAutosVID0217.zip
2008-07-08 04:18:06 14290 -c--a-w- c:\program files\settings.dat

============= FINISH: 15:08:58.87 ===============

 

And here is Attach.txt. Note that I had to cut off some of the end because the attach.txt was over the 55000 character limit. At the end there is more of the Microsoft Anti-Malware repetitively encountering an error with Prast!rts


Attach.txt



UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 6/18/2008 11:17:54 AM
System Uptime: 4/1/2010 2:03:03 PM (1 hours ago)

Motherboard: LENOVO | | 7650DHU
Processor: Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz | None | 1862/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 68 GiB total, 12.398 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: SonicWALL VPN Adapter
Device ID: ROOT\RCVPN\0000
Manufacturer: SonicWALL, Inc.
Name: SonicWALL VPN Adapter
PNP Device ID: ROOT\RCVPN\0000
Service: rcvpn

==== System Restore Points ===================

RP460: 2/18/2010 11:35:32 AM - Software Distribution Service 3.0
RP461: 2/19/2010 12:36:47 AM - Software Distribution Service 3.0
RP462: 2/20/2010 11:47:26 AM - System Checkpoint
RP463: 2/20/2010 10:00:33 PM - Software Distribution Service 3.0
RP464: 2/21/2010 9:53:58 AM - Software Distribution Service 3.0
RP465: 2/22/2010 10:10:26 AM - Software Distribution Service 3.0
RP466: 2/23/2010 1:36:56 AM - Software Distribution Service 3.0
RP467: 2/23/2010 10:33:46 AM - Software Distribution Service 3.0
RP468: 2/25/2010 3:18:45 AM - System Checkpoint
RP469: 2/25/2010 10:08:28 AM - Software Distribution Service 3.0
RP470: 2/26/2010 5:07:24 PM - System Checkpoint
RP471: 2/26/2010 5:57:49 PM - Software Distribution Service 3.0
RP472: 2/27/2010 6:59:30 PM - System Checkpoint
RP473: 2/28/2010 12:53:39 AM - Software Distribution Service 3.0
RP474: 2/28/2010 3:29:22 PM - Removed Hearts of Iron 3 - Demo
RP475: 2/28/2010 3:30:38 PM - Removed Rome: Total War - Barbarian Invasion
RP476: 2/28/2010 3:33:29 PM - Removed Rome - Total War
RP477: 2/28/2010 4:15:41 PM - Software Distribution Service 3.0
RP478: 2/28/2010 9:42:48 PM - Software Distribution Service 3.0
RP479: 3/2/2010 12:50:25 PM - Software Distribution Service 3.0
RP480: 3/2/2010 9:41:24 PM - Software Distribution Service 3.0
RP481: 3/4/2010 9:48:59 AM - Software Distribution Service 3.0
RP482: 3/5/2010 11:09:51 AM - System Checkpoint
RP483: 3/5/2010 6:20:20 PM - Software Distribution Service 3.0
RP484: 3/7/2010 10:33:34 AM - Software Distribution Service 3.0
RP485: 3/8/2010 9:06:14 PM - System Checkpoint
RP486: 3/8/2010 11:39:25 PM - Software Distribution Service 3.0
RP487: 3/10/2010 2:51:06 PM - System Checkpoint
RP488: 3/10/2010 5:07:46 PM - Software Distribution Service 3.0
RP489: 3/11/2010 6:42:00 PM - System Checkpoint
RP490: 3/11/2010 9:18:18 PM - Software Distribution Service 3.0
RP491: 3/12/2010 11:33:35 AM - Software Distribution Service 3.0
RP492: 3/12/2010 9:45:42 PM - Software Distribution Service 3.0
RP493: 3/14/2010 11:32:57 AM - Software Distribution Service 3.0
RP494: 3/15/2010 11:59:54 AM - Software Distribution Service 3.0
RP495: 3/16/2010 12:57:40 PM - Software Distribution Service 3.0
RP496: 3/17/2010 3:16:19 PM - Software Distribution Service 3.0
RP497: 3/18/2010 3:54:27 PM - System Checkpoint
RP498: 3/18/2010 10:32:12 PM - Software Distribution Service 3.0
RP499: 3/20/2010 12:30:12 AM - Software Distribution Service 3.0
RP500: 3/21/2010 11:21:22 AM - Software Distribution Service 3.0
RP501: 3/22/2010 11:53:22 AM - System Checkpoint
RP502: 3/23/2010 6:47:49 PM - System Checkpoint
RP503: 3/23/2010 8:58:15 PM - Software Distribution Service 3.0
RP504: 3/24/2010 5:26:40 PM - Software Distribution Service 3.0
RP505: 3/25/2010 11:17:52 AM - Software Distribution Service 3.0
RP506: 3/26/2010 1:07:30 PM - Software Distribution Service 3.0
RP507: 3/27/2010 2:56:21 PM - Software Distribution Service 3.0
RP508: 3/28/2010 5:23:56 PM - System Checkpoint
RP509: 3/28/2010 5:45:01 PM - Software Distribution Service 3.0
RP510: 3/29/2010 6:20:18 PM - Software Distribution Service 3.0
RP511: 3/30/2010 6:35:48 PM - Software Distribution Service 3.0
RP512: 3/31/2010 1:22:27 AM - Installed HiJackThis
RP513: 3/31/2010 12:11:19 PM - Installed ParetoLogic Anti-Virus PLUS.
RP514: 3/31/2010 2:27:35 PM - Removed ParetoLogic Anti-Virus PLUS.
RP515: 3/31/2010 2:45:37 PM - Removed SPSS 16.0 for Windows.
RP516: 4/1/2010 8:59:21 AM - Software Distribution Service 3.0
RP517: 4/1/2010 9:11:07 AM - Software Distribution Service 3.0
RP518: 4/1/2010 1:48:54 PM - Software Distribution Service 3.0

==== Installed Programs ======================

A-PDF Merger 3.1
AAC Decoder
AceHTML Freeware
Active@ ISO Burner
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.7
Adobe Reader 8.2.0
Adobe Shockwave Player 11.5
Apple Software Update
AutoHotkey 1.0.47.06
AutoUpdate
Bulk Mailer (United States)
CCleaner
Cisco Systems VPN Client 5.0.03.0530
ClamWin Free Antivirus 0.95.3
Conexant HD Audio
Critical Update for Windows Media Player 11 (KB959772)
CRON-O-METER 0.9.4
DataFerrett
DBF to XLS
DBFView Trial
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DNRGarmin
Europa Universalis III
ffdshow (remove only)
GMapCreator
Google Earth
GoToMeeting 4.0.0.320
GTK DBF Editor (remove only)
H.264 Decoder
HDAUDIO Soft Data Fax Modem with SmartCP
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
iMacros V6.22
ImageMixer 3 SE Ver.5 Transfer Utility
ImageMixer 3 SE Ver.5 Video Tools
In Nomine 3.1
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
iTunes
J2SE Runtime Environment 5.0 Update 16
Japanese Fonts Support For Adobe Reader 8
Java Advanced Imaging 1.1.3 for JRE
Java(TM) 6 Update 11
Korean Fonts Support For Adobe Reader 8
Lenovo Care
Lenovo Care Supplement
LiveUpdate 3.1 (Symantec Corporation)
Magic ISO Maker v5.5 (build 0276)
MagicDisc 2.7.106
Maintenance Manager
MapWindow GIS
mCore
mDriver
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access database engine 2007 (English)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Plus 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ Redist - ENU
Microsoft Windows XP Video Decoder Checkup Utility
MKV Splitter
mMHouse
Mozilla Firefox (3.6.2)
Mozilla Thunderbird (2.0.0.16)
mPfMgr
mProSafe
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser
Music Transfer Utility Ver.2
mWlsSafe
Napoleon's Ambition
NetBeans IDE 6.5.1
Notepad++
Octoshape add-in for Adobe Flash Player
OGA Notifier 2.0.0048.0
On Screen Display
Paint Shop Pro 7 Anniversary Edition
PDFCreator
Picasa 3
Productivity Center Supplement for ThinkPad
Python 2.4.1
QuickTime
R for Windows 2.10.0
RapidTyping
Redistributable_MM
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB978380)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB978382)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Shape2Earth 1.471
SonicWALL Global VPN Client
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
Stamina 2.5
Steam
Symantec AntiVirus
System Update
TBS WMP Plug-in
TextMasterSplitAndJoin
ThinkPad EasyEject Utility
ThinkPad FullScreen Magnifier
ThinkPad Hotkey Features Setup
ThinkPad Keyboard Customizer Utility
ThinkPad Power Management Driver
ThinkPad TrackPoint Driver
ThinkVantage Active Protection System
ThinkVantage Productivity Center
Trillian
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Outlook 2007 Junk Email Filter (kb979895)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
Update for Windows XP (KB980182)
VC80CRTRedist - 8.0.50727.4053
Veetle TV 0.9.15
Verbologist
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
Vocaboly 2.1
WampServer 2.0
WebFldrs XP
Windows Defender
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Media Format 11 runtime
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
Xvid 1.2.2 final uninstall

==== Event Viewer Messages From Past Week ========

4/1/2010 11:21:33 AM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80508023 Error description: The program could not find the spyware and other potentially unwanted software on this computer. Status: Signature Version: AV: 1.79.953.0, AS: 1.79.953.0 Engine Version: 1.1.5605.0
4/1/2010 1:07:22 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
3/31/2010 7:39:13 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80508023 Error description: The program could not find the spyware and other potentially unwanted software on this computer. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/31/2010 7:26:54 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80508023 Error description: The program could not find the spyware and other potentially unwanted software on this computer. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/31/2010 7:00:56 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80508023 Error description: The program could not find the spyware and other potentially unwanted software on this computer. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/31/2010 6:25:26 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80508023 Error description: The program could not find the spyware and other potentially unwanted software on this computer. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/31/2010 6:01:00 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80508023 Error description: The program could not find the spyware and other potentially unwanted software on this computer. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/31/2010 12:04:55 AM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/30/2010 9:06:53 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/30/2010 6:47:47 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl
3/30/2010 6:40:23 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: CFC-L3DA872\Local User Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/30/2010 6:39:24 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: CFC-L3DA872\Local User Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/30/2010 6:37:42 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.812.0, AS: 1.79.812.0 Engine Version: 1.1.5605.0
3/30/2010 6:27:10 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 6:00:16 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 5:50:18 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 5:39:54 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 5:30:00 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 5:20:04 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 5:10:05 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 5:00:51 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 4:50:04 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 4:39:54 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 4:30:29 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 4:20:04 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 4:09:49 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 4:00:04 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 3:50:05 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 3:40:02 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 3:29:50 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 3:20:05 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 3:10:02 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 3:00:33 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 2:49:46 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 2:39:47 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 2:29:44 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 2:19:53 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 2:09:45 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 12:49:50 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 12:39:43 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0
3/30/2010 12:29:44 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Prast!rts&threatid=2147625176 User: NT AUTHORITY\SYSTEM Name: PWS:Win32/Prast!rts ID: 2147625176 Severity: High Category: Password Stealer Path: Action: Quarantine Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Status: Signature Version: AV: 1.79.729.0, AS: 1.79.729.0 Engine Version: 1.1.5605.0


==== End Of File ===========================