Inactive Re: Disappearing Files and Folders

[Inactive] Re: Disappearing Files and Folders

Hi,

Sorry, I didn't assume it would be virus related. Here are the files you requested though:


DDS:


DDS (Ver_09-12-01.01) - NTFSx86
Run by ******** at 1:14:42.17 on 15/02/2010
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_07
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.44.1033.18.1915.966 [GMT 0:00]

SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Toshiba Online Product Information\TOPI.exe
C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe
C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\********\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe "
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [cfFncEnabler.exe] cfFncEnabler.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRun: [topi] c:\program files\toshiba\toshiba online product information\topi.exe -startup
mRun: [Google EULA Launcher] c:\program files\google\google eula\GoogleEULALauncher.exe IE PA
mRun: [Toshiba TEMPO] c:\program files\toshiba tempro\Toshiba.Tempo.UI.TrayApplication.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Camera Assistant Software] "c:\program files\camera assistant software for toshiba\traybar.exe" /start
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun: [Toshiba Registration] c:\program files\toshiba\registration\ToshibaRegistration.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
StartupFolder: c:\users\copela~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\trdcre~1.lnk - c:\program files\toshiba\trdcreminder\TRDCReminder.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4
IE: {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redirect-home?tag=Toshibaukbholink-21&site=home
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\progra~1\java\jre16~2.0_0\bin\ssv.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-2-13 64160]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\drivers\jswpslwf.sys [2010-2-13 20352]
R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2008-4-16 40960]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 951632]
R2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\toshiba tempro\TempoSVC.exe [2008-4-24 99720]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-7-1 7168]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\toshiba\smartfacev\SmartFaceVWatchSrv.exe [2008-4-24 73728]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-2-13 55280]
S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\jumpstart\jswpsapi.exe [2010-2-13 937984]

=============== Created Last 30 ================

2010-02-14 15:36:17 2723264 ----a-w- C:\vcredist_x86.exe
2010-02-14 15:31:16 0 d-----w- c:\program files\Restorer2000 Professional
2010-02-14 14:42:43 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-14 14:34:25 71612 ----a-w- C:\registry_20100214 6.reg
2010-02-14 14:33:36 5094 ----a-w- C:\registry_20100214 5.reg
2010-02-14 14:32:57 4722 ----a-w- C:\registry_20100214 4.reg
2010-02-14 14:32:33 16838 ----a-w- C:\registry_20100214 3.reg
2010-02-14 14:31:44 1132 ----a-w- C:\registry_20100214 2.reg
2010-02-14 14:10:43 241340464 ----a-w- C:\registry_20100214.reg
2010-02-14 13:29:44 378368 ----a-w- c:\windows\system32\winhttp.dll
2010-02-14 13:21:08 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-02-14 13:21:08 270848 ----a-w- c:\windows\system32\schannel.dll
2010-02-14 13:21:08 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-02-14 13:21:08 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2010-02-14 13:21:07 9728 ----a-w- c:\windows\system32\lsass.exe
2010-02-14 13:21:07 72704 ----a-w- c:\windows\system32\secur32.dll
2010-02-14 13:21:07 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2010-02-14 02:16:35 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-02-14 02:16:34 411136 ----a-w- c:\windows\system32\drivers\http.sys
2010-02-14 02:16:34 31232 ----a-w- c:\windows\system32\httpapi.dll
2010-02-14 02:08:54 97800 ----a-w- c:\windows\system32\infocardapi.dll
2010-02-14 02:08:54 37384 ----a-w- c:\windows\system32\infocardcpl.cpl
2010-02-14 02:08:54 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-02-14 02:08:53 622080 ----a-w- c:\windows\system32\icardagt.exe
2010-02-14 02:08:53 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-02-14 02:08:53 11264 ----a-w- c:\windows\system32\icardres.dll
2010-02-14 02:08:52 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2010-02-14 02:08:50 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2010-02-14 02:03:48 96760 ----a-w- c:\windows\system32\dfshim.dll
2010-02-14 02:03:45 282112 ----a-w- c:\windows\system32\mscoree.dll
2010-02-14 02:03:44 41984 ----a-w- c:\windows\system32\netfxperf.dll
2010-02-14 02:03:39 158720 ----a-w- c:\windows\system32\mscorier.dll
2010-02-14 02:03:36 83968 ----a-w- c:\windows\system32\mscories.dll
2010-02-14 02:02:56 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-14 01:59:54 897624 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-02-14 01:58:16 615424 ----a-w- c:\windows\system32\wbem\fastprox.dll
2010-02-14 01:57:58 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2010-02-14 01:56:51 1314816 ----a-w- c:\windows\system32\quartz.dll
2010-02-14 01:56:50 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-02-14 01:56:50 82944 ----a-w- c:\windows\system32\mciavi32.dll
2010-02-14 01:56:50 65024 ----a-w- c:\windows\system32\avicap32.dll
2010-02-14 01:56:50 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-02-14 01:56:50 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-02-14 01:56:50 22528 ----a-w- c:\windows\system32\msyuv.dll
2010-02-14 01:56:50 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-02-14 01:56:50 123904 ----a-w- c:\windows\system32\msvfw32.dll
2010-02-14 01:56:50 11776 ----a-w- c:\windows\system32\tsbyuv.dll
2010-02-14 01:49:33 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2010-02-14 01:49:08 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-14 01:49:08 105472 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-14 01:11:08 0 d-----w- c:\program files\SopCast
2010-02-14 01:03:29 2421760 ----a-w- c:\windows\system32\wucltux.dll
2010-02-14 01:03:20 87552 ----a-w- c:\windows\system32\wudriver.dll
2010-02-14 01:03:13 33792 ----a-w- c:\windows\system32\wuapp.exe
2010-02-14 01:03:13 171608 ----a-w- c:\windows\system32\wuwebv.dll
2010-02-13 23:59:39 506368 ----a-w- c:\windows\system32\msxml.dll
2010-02-13 23:49:43 55280 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2010-02-13 23:48:08 0 d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-02-13 23:47:53 347648 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2010-02-13 23:47:52 712704 ----a-w- c:\windows\system32\WindowsCodecs.dll
2010-02-13 23:46:53 0 d-----w- c:\program files\Microsoft
2010-02-13 23:46:39 0 d-----w- c:\program files\Windows Live SkyDrive
2010-02-13 23:44:31 0 d-----w- c:\program files\common files\Windows Live
2010-02-13 23:44:23 0 d---a-w- c:\programdata\TEMP
2010-02-13 23:42:09 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-13 23:42:00 0 dc-h--w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2010-02-13 23:41:46 0 d-----w- c:\programdata\Lavasoft
2010-02-13 23:41:46 0 d-----w- c:\program files\Lavasoft
2010-02-13 23:40:05 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-02-13 23:40:05 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-02-13 23:39:35 0 d-----w- c:\program files\iPod
2010-02-13 23:39:32 0 d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-02-13 23:39:32 0 d-----w- c:\program files\iTunes
2010-02-13 23:39:01 0 d-----w- c:\program files\Bonjour
2010-02-13 23:38:28 0 d-----w- c:\programdata\Apple Computer
2010-02-13 23:37:09 0 d-----w- c:\programdata\Apple
2010-02-13 23:35:52 0 d-----w- c:\program files\CDex_150
2010-02-13 23:31:53 0 d-----w- c:\program files\AVG
2010-02-13 23:31:44 0 d-sh--w- c:\windows\Installer
2010-02-13 21:53:05 0 d-sh--w- C:\$RECYCLE.BIN
2010-02-13 21:52:43 20352 ----a-w- c:\windows\system32\drivers\jswpslwf.sys
2010-02-13 21:52:40 0 d-----w- c:\program files\Jumpstart
2010-02-13 21:51:36 909824 ----a-w- c:\windows\system32\drivers\athr.sys
2010-02-13 21:51:36 0 d-----w- c:\program files\Atheros
2010-02-13 21:51:35 53248 ----a-w- c:\windows\system32\athihvui.dll
2010-02-13 21:51:35 393216 ----a-w- c:\windows\system32\athihvs.dll
2010-02-13 21:51:35 376832 ----a-w- c:\windows\system32\S64CPA.exe
2010-02-13 21:51:35 0 d-----w- c:\windows\system32\nn-NO
2010-02-13 21:51:16 0 d-----w- c:\programdata\Atheros
2010-02-13 21:51:10 77824 ----a-w- c:\windows\system32\tosmreg.exe
2010-02-13 21:51:10 7671 ----a-w- c:\windows\system32\cseltbl.ini
2010-02-13 21:51:10 491520 ----a-w- c:\windows\system32\cselect.exe
2010-02-13 21:51:10 45056 ----a-w- c:\windows\system32\csellang.dll
2010-02-13 21:51:10 128113 ----a-w- c:\windows\system32\csellang.ini
2010-02-13 21:51:10 10150 ----a-w- c:\windows\system32\tosmreg.ini
2010-02-13 21:51:10 0 d-----w- c:\program files\ltmoh
2010-02-13 21:50:36 0 d-----w- c:\windows\Options
2010-02-13 21:50:14 279376 ----a-w- c:\windows\system32\drivers\tos_sps32.sys
2010-02-13 21:50:11 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2010-02-13 21:49:53 0 d-----w- c:\program files\common files\Toshiba Shared
2010-02-13 21:45:42 0 d-----w- c:\programdata\ToshibaEurope
2010-02-13 20:26:48 0 --sha-r- c:\windows\system32\drivers\TOSHIBA_Satellite Pro A300_08008-EN_PSAG9E-00W00.MRK
2010-02-13 20:22:55 0 d-----w- c:\program files\Camera Assistant Software for Toshiba
2010-02-13 20:22:05 0 d-----w- c:\program files\Realtek
2010-02-13 20:21:25 0 d-----w- c:\windows\system32\ENU
2010-02-13 20:21:24 1034776 ----a-w- c:\windows\system32\imsmudlg.exe
2010-02-13 20:21:17 312344 ----a-w- c:\windows\system32\drivers\iaStor.sys

==================== Find3M ====================

2010-02-14 15:39:40 82720 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-02-13 23:37:49 86016 ----a-w- c:\windows\inf\infstor.dat
2010-02-13 23:37:49 51200 ----a-w- c:\windows\inf\infpub.dat
2010-02-13 23:37:49 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-02-13 20:22:07 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-12-18 13:05:50 833024 ----a-w- c:\windows\system32\wininet.dll
2009-12-18 13:01:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-12-18 10:14:30 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2008-07-01 14:24:39 665600 ----a-w- c:\windows\inf\drvindex.dat
2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 1:14:53.69 ===============

Attach to follow.

 

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 13/02/2010 20:25:36
System Uptime: 15/02/2010 01:02:28 (0 hours ago)

Motherboard: TOSHIBA | | Portable PC
Processor: Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz | CPU | 1000/667mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 74 GiB total, 41.996 GiB free.
E: is FIXED (NTFS) - 73 GiB total, 35.835 GiB free.
F: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP78: 13/02/2010 20:26:56 - Installed TOSHIBA Value Added Package
RP80: 13/02/2010 21:49:21 - Installed TosDVD
RP82: 13/02/2010 21:49:57 - Installed DirectX
RP83: 13/02/2010 21:50:17 - Device Driver Package Install: TOSHIBA Corp.
RP84: 13/02/2010 21:50:47 - Device Driver Package Install: Agere Modems
RP86: 13/02/2010 21:51:19 - Installed Atheros Driver Installation Program
RP87: 13/02/2010 21:51:40 - Device Driver Package Install: Atheros Communications Inc. Network adapters
RP89: 13/02/2010 21:52:28 - Installed Atheros Wi-Fi Protected Setup Library
RP90: 13/02/2010 21:52:46 - Device Driver Package Install: Atheros Network Service
RP91: 13/02/2010 22:33:56 - Removed Google Toolbar for Internet Explorer
RP92: 13/02/2010 23:31:44 - Installed AVG Free 8.0
RP93: 13/02/2010 23:37:21 - Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers
RP94: 13/02/2010 23:37:38 - Device Driver Package Install: Apple Network adapters
RP95: 13/02/2010 23:39:03 - Installed iTunes
RP96: 13/02/2010 23:47:45 - Windows Update
RP98: 13/02/2010 23:48:12 - Installed DirectX
RP99: 14/02/2010 01:03:02 - Windows Update
RP100: 14/02/2010 01:23:45 - Installed Java(TM) 6 Update 7
RP102: 14/02/2010 01:51:09 - Avg8 Update
RP103: 14/02/2010 02:01:14 - Windows Update
RP105: 14/02/2010 13:21:04 - Removed Microsoft Office Home and Student 2007
RP106: 14/02/2010 13:21:13 - Windows Update
RP107: 14/02/2010 13:42:53 - Removed Microsoft Office Excel MUI (English) 2007
RP108: 14/02/2010 13:43:21 - Removed OGA Notifier 2.0.0048.0
RP109: 14/02/2010 13:44:09 - Removed Microsoft Office Live Add-in 1.3
RP110: 14/02/2010 13:44:36 - Removed Microsoft Office OneNote MUI (English) 2007
RP111: 14/02/2010 13:45:45 - Removed Microsoft Office PowerPoint MUI (English) 2007
RP112: 14/02/2010 13:46:21 - Removed Microsoft Office Proof (English) 2007
RP113: 14/02/2010 13:47:51 - Supprimé Microsoft Office Proof (French) 2007
RP114: 14/02/2010 13:50:37 - Quitado Microsoft Office Proof (Spanish) 2007
RP115: 14/02/2010 13:51:13 - Removed Microsoft Office Proofing (English) 2007
RP116: 14/02/2010 13:52:25 - Removed Microsoft Office Shared MUI (English) 2007
RP117: 14/02/2010 13:53:21 - Removed Microsoft Office Shared Setup Metadata MUI (English) 2007
RP118: 14/02/2010 13:54:16 - Removed Microsoft Office Word MUI (English) 2007
RP119: 14/02/2010 14:39:45 - Windows Update
RP121: 14/02/2010 15:02:24 - Installed Microsoft Office Home and Student 2007
RP123: 14/02/2010 15:09:36 - Made by Registry Mechanic
RP124: 14/02/2010 18:20:35 - Removed AVG Free 8.5
RP125: 14/02/2010 18:21:10 - Installed AVG Free 8.5

==== Installed Programs ======================

Activation Assistant for the 2007 Microsoft Office suites
Ad-Aware
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Atheros Driver Installation Program
Atheros Wi-Fi Protected Setup Library
Bluetooth Stack for Windows by Toshiba
Bonjour
Camera Assistant Software for Toshiba
CD/DVD Drive Acoustic Silencer
CDex extraction audio
Choice Guard
Compatibility Pack for the 2007 Office system
DVD MovieFactory for TOSHIBA
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
iTunes
Java(TM) 6 Update 6
Java(TM) 6 Update 7
Junk Mail filter update
Microsoft .NET Framework 3.5 SP1
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Microsoft XML Parser
Mozilla Firefox (3.6)
MSVCRT
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
myphotobook 3.5
Picasa 3
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek High Definition Audio Driver
Registry Mechanic 8.0
Restorer2000 Professional
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.02
SopCast 3.2.4
Synaptics Pointing Device Driver
TOSHIBA Assist
TOSHIBA ConfigFree
TOSHIBA Disc Creator
TOSHIBA DVD PLAYER
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Face Recognition
TOSHIBA Hardware Setup
TOSHIBA Manuals
Toshiba Online Product Information
TOSHIBA Recovery Disc Creator
TOSHIBA SD Memory Utilities
TOSHIBA Software Modem
TOSHIBA Supervisor Password
Toshiba TEMPRO
TOSHIBA Value Added Package
TRDCReminder
TRORDCLauncher
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Media Encoder 9 Series

==== End Of File ===========================

 

Sorry, I had explained it in another thread.



Hi,

First, I know there are other posts about this, but I think mine is slightly different to what I've found so far. Also, thank you in advance for any help!! (Sorry it's long!)

Here is the background to the situation. You can skip this and read the actual situation if you like!:

My parent's laptop got infected with a virus, which I removed for them and everything worked absolutely fine. A few days later (and seemingly unrelated), the computer crashed and would not restart. It simply blue screened on normal start up or any of the safe modes. It wouldn't even scan the drive for errors. I know this sounds like a hardware fault, but I found a way to get to the dos prompt, which allowed me to copy their files to a memory stick. I could open files from dos, scan the directories, etc. There were no access issues with the documents. I backed up all their files and started a Toshiba recovery, which should have wiped the C drive and reinstalled Vista to the factory settings, using the recovery files from the D drive.
This seemed to work absolutely fine, but I started to notice a few files on the C drive that should have been wiped. For example, there were some Office installation files and shortcuts that prevented me from reinstalling Office. I manually removed all Office files, following instructions from the Microsoft site, and installed Office, AVG, Registry Mechanic, iTunes, CDex, Picassa, SopCast and Windows Live Messenger.
Everything went well and the laptop seemed to be getting healthy!
I moved their documents back to their laptop (very stupid of me. I should have copied the files. I don't know why I moved them). The files were things like Documents, Downloads, Favo(u)rites, Music, Pictures, etc.
I then set Windows updating.




The actual issue:

After updating, I clicked on the Documents Favourite Link in Explorer. No files came up, so I clicked on the user folder and I saw duplicates of every folder. I thought this might be because I copied the files and folders straight back into the user folder and for some reason, Vista didn't recognise them as the official documents, downloads, music, etc folders.
I copied (yes copied this time!) the documents from the new folders into the "official" folders (the ones that the favourite links link to) and sent the old Documents folder to the recycle bin. Everything looked OK, but when I went back to the documents a few minutes later, it was empty again.
Annoying as it was, I thought I'd restore the old folder and see what I could do. However, even though there were other files in the recycle bin, the old folder was nowhere to be found.

I used Restorer2000 Pro to scan the drive and see if it could find the files, but with no luck. They have simply disappeared.

I then noticed that my recycle bin is now completely empty, even though I had other files in there before. Where are these files going?!

Does anyone have any suggestions as to my next actions?!

The laptop is a Toshiba Satellite Pro running Windows Vista Home Premium SP1. 2GHz processor, 2GB Ram.

Once again, sorry it's long.

 

I was in between AVG Free 8.5 and 9.0 when you replied, hence no anti virus. However, I installed Avast at your request and it did not find anything.

PS I think my previous post outlining the issues is awaiting moderation!

 

Malwarebytes Log:


Malwarebytes' Anti-Malware 1.44
Database version: 3742
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

15/02/2010 20:41:00
mbam-log-2010-02-15 (20-41-00).txt

Scan type: Quick Scan
Objects scanned: 112144
Time elapsed: 4 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




Restarting computer now.

 

Ah, blue screen: Page Fault in NonPaged Area.

It appeared as the GMER scan was running. I haven't restarted the scan.
Here are the error details:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 2057

Additional information about the problem:
BCCode: 50
BCP1: AFAF7000
BCP2: 00000000
BCP3: 9B513D3D
BCP4: 00000000
OS Version: 6_0_6001
Service Pack: 1_0
Product: 768_1



Should I restart the scan? Should I let Windows "Check for solution "?

 

Hi,

Thanks for your help. Here are the Comboxfix results:


ComboFix 10-02-12.01 - user_2 16/02/2010 7:31.1.2 - x86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.44.1033.18.1915.1154 [GMT 0:00]
Running from: c:\users\user_2\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-01-16 to 2010-02-16 )))))))))))))))))))))))))))))))
.

2010-02-16 07:37 . 2010-02-16 07:37 -------- d-----w- c:\users\user_2\AppData\Local\temp
2010-02-15 20:53 . 2010-02-15 20:53 -------- d-----w- c:\programdata\Office Genuine Advantage
2010-02-15 20:46 . 2010-02-15 20:46 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-02-15 20:36 . 2010-02-15 20:36 -------- d-----w- c:\users\user_2\AppData\Roaming\Malwarebytes
2010-02-15 20:36 . 2010-01-07 16:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-15 20:36 . 2010-02-15 20:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-15 20:36 . 2010-02-15 20:36 -------- d-----w- c:\programdata\Malwarebytes
2010-02-15 20:36 . 2010-01-07 16:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-15 02:03 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-15 02:03 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-15 02:03 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-15 02:03 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-15 02:03 . 2010-02-11 18:38 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-02-15 02:03 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-15 02:03 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-15 02:02 . 2010-02-15 02:02 -------- d-----w- c:\programdata\Alwil Software
2010-02-15 02:02 . 2010-02-15 02:02 -------- d-----w- c:\program files\Alwil Software
2010-02-14 18:26 . 2010-02-14 18:26 -------- d-----w- c:\users\user\AppData\Roaming\AVG8
2010-02-14 15:40 . 2010-02-14 15:40 -------- d-----w- c:\users\user_2\AppData\Local\Toshiba
2010-02-14 15:36 . 2010-02-14 15:36 2723264 ----a-w- C:\vcredist_x86.exe
2010-02-14 15:31 . 2010-02-14 15:31 -------- d-----w- c:\program files\Restorer2000 Professional
2010-02-14 14:42 . 2009-10-29 09:41 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-14 14:34 . 2010-02-14 14:34 71612 ----a-w- C:\registry_20100214 6.reg
2010-02-14 14:33 . 2010-02-14 14:33 5094 ----a-w- C:\registry_20100214 5.reg
2010-02-14 14:32 . 2010-02-14 14:32 4722 ----a-w- C:\registry_20100214 4.reg
2010-02-14 14:32 . 2010-02-14 14:32 16838 ----a-w- C:\registry_20100214 3.reg
2010-02-14 14:31 . 2010-02-14 14:31 1132 ----a-w- C:\registry_20100214 2.reg
2010-02-14 14:10 . 2010-02-14 14:11 241340464 ----a-w- C:\registry_20100214.reg
2010-02-14 13:29 . 2009-08-24 12:16 378368 ----a-w- c:\windows\system32\winhttp.dll
2010-02-14 13:24 . 2010-02-14 13:24 -------- d-----w- c:\users\user\AppData\Local\Microsoft Help
2010-02-14 13:21 . 2009-06-15 15:24 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-02-14 13:21 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2010-02-14 13:21 . 2009-06-15 15:23 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2010-02-14 13:21 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-02-14 13:21 . 2009-06-15 18:20 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2010-02-14 13:21 . 2009-06-15 15:24 72704 ----a-w- c:\windows\system32\secur32.dll
2010-02-14 13:21 . 2009-06-15 12:57 9728 ----a-w- c:\windows\system32\lsass.exe
2010-02-14 02:16 . 2009-11-09 13:22 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-02-14 02:16 . 2009-11-09 13:20 31232 ----a-w- c:\windows\system32\httpapi.dll
2010-02-14 02:16 . 2009-11-09 11:04 411136 ----a-w- c:\windows\system32\drivers\http.sys
2010-02-14 02:08 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-02-14 02:08 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2010-02-14 02:08 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-02-14 02:08 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2010-02-14 02:08 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2010-02-14 02:08 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2010-02-14 02:08 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2010-02-14 02:03 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2010-02-14 02:03 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2010-02-14 02:03 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2010-02-14 02:03 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2010-02-14 02:03 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2010-02-14 02:02 . 2010-01-14 11:12 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-14 01:59 . 2009-12-08 20:52 897624 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-02-14 01:58 . 2009-03-03 04:40 499200 ----a-w- c:\windows\system32\wbem\WmiPrvSD.dll
2010-02-14 01:57 . 2009-07-11 19:32 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2010-02-14 01:56 . 2009-12-28 12:35 1314816 ----a-w- c:\windows\system32\quartz.dll
2010-02-14 01:56 . 2009-12-28 12:35 11776 ----a-w- c:\windows\system32\tsbyuv.dll
2010-02-14 01:56 . 2009-12-28 12:32 22528 ----a-w- c:\windows\system32\msyuv.dll
2010-02-14 01:56 . 2009-12-28 12:32 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-02-14 01:56 . 2009-12-28 12:32 123904 ----a-w- c:\windows\system32\msvfw32.dll
2010-02-14 01:56 . 2009-12-28 12:32 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-02-14 01:56 . 2009-12-28 12:31 82944 ----a-w- c:\windows\system32\mciavi32.dll
2010-02-14 01:56 . 2009-12-28 12:31 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-02-14 01:56 . 2009-12-28 12:28 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-02-14 01:56 . 2009-12-28 12:28 65024 ----a-w- c:\windows\system32\avicap32.dll
2010-02-14 01:49 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2010-02-14 01:49 . 2009-12-04 16:12 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-14 01:49 . 2009-12-04 16:12 105472 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-14 01:20 . 2010-02-14 01:20 -------- d-----w- c:\users\user\AppData\Local\Seven Zip
2010-02-14 01:11 . 2010-02-14 01:11 -------- d-----w- c:\program files\SopCast
2010-02-14 01:10 . 2010-02-14 01:10 0 ----a-w- c:\windows\nsreg.dat
2010-02-14 01:10 . 2010-02-14 01:10 -------- d-----w- c:\users\user\AppData\Local\Mozilla
2010-02-14 01:03 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2010-02-14 01:03 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2010-02-14 01:03 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2010-02-14 01:03 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2010-02-14 01:03 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2010-02-14 01:03 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2010-02-14 01:03 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2010-02-14 01:03 . 2009-08-06 19:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2010-02-14 01:03 . 2009-08-06 18:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2010-02-13 23:59 . 2004-08-04 08:00 506368 ----a-w- c:\windows\system32\msxml.dll
2010-02-13 23:49 . 2010-02-14 13:10 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-13 23:49 . 2009-02-06 18:08 55280 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2010-02-13 23:49 . 2010-02-13 23:49 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-02-13 23:48 . 2010-02-13 23:48 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-02-13 23:47 . 2008-06-26 03:21 347648 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2010-02-13 23:47 . 2008-06-26 03:21 712704 ----a-w- c:\windows\system32\WindowsCodecs.dll
2010-02-13 23:46 . 2010-02-14 13:44 -------- d-----w- c:\program files\Microsoft
2010-02-13 23:46 . 2010-02-13 23:46 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-02-13 23:46 . 2010-02-13 23:49 -------- d-----w- c:\program files\Windows Live
2010-02-13 23:44 . 2010-02-13 23:44 -------- d-----w- c:\program files\Common Files\Windows Live
2010-02-13 23:42 . 2009-03-09 19:06 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-13 23:42 . 2010-02-13 23:42 -------- dc-h--w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2010-02-13 23:42 . 2009-03-12 08:17 2902048 -c--a-w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2010-02-13 23:41 . 2010-02-13 23:42 -------- d-----w- c:\programdata\Lavasoft
2010-02-13 23:41 . 2010-02-13 23:41 -------- d-----w- c:\program files\Lavasoft
2010-02-13 23:40 . 2010-02-13 23:40 -------- d-----w- c:\users\user\AppData\Roaming\Apple Computer
2010-02-13 23:40 . 2010-02-13 23:40 -------- d-----w- c:\users\user\AppData\Local\Apple Computer
2010-02-13 23:40 . 2010-02-13 23:49 -------- dc----w- c:\windows\system32\DRVSTORE
2010-02-13 23:40 . 2009-05-18 14:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-02-13 23:40 . 2008-04-17 13:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-02-13 23:39 . 2010-02-13 23:39 -------- d-----w- c:\program files\iPod
2010-02-13 23:39 . 2010-02-13 23:40 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-02-13 23:39 . 2010-02-13 23:40 -------- d-----w- c:\program files\iTunes
2010-02-13 23:39 . 2010-02-13 23:39 -------- d-----w- c:\program files\Bonjour
2010-02-13 23:38 . 2010-02-13 23:38 -------- d-----w- c:\program files\QuickTime
2010-02-13 23:38 . 2010-02-13 23:39 -------- d-----w- c:\programdata\Apple Computer
2010-02-13 23:38 . 2010-02-13 23:38 -------- d-----w- c:\users\user\AppData\Local\Apple
2010-02-13 23:37 . 2010-02-13 23:37 -------- d-----w- c:\program files\Apple Software Update
2010-02-13 23:37 . 2010-02-13 23:39 -------- d-----w- c:\program files\Common Files\Apple
2010-02-13 23:37 . 2010-02-13 23:37 -------- d-----w- c:\programdata\Apple
2010-02-13 23:35 . 2010-02-13 23:35 -------- d-----w- c:\program files\CDex_150
2010-02-13 23:31 . 2010-02-14 15:32 -------- d-----w- c:\program files\AVG
2010-02-13 23:31 . 2010-02-16 03:05 -------- d-sh--w- c:\windows\Installer
2010-02-13 21:53 . 2010-02-13 23:43 -------- d-----w- c:\users\user\AppData\Local\Google
2010-02-13 21:53 . 2010-02-13 21:53 -------- d-----w- c:\users\user\AppData\Local\Toshiba
2010-02-13 21:53 . 2010-02-14 15:27 82720 ----a-w- c:\users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-13 21:52 . 2007-08-31 17:43 20352 ----a-w- c:\windows\system32\drivers\jswpslwf.sys
2010-02-13 21:52 . 2010-02-13 21:52 -------- d-----w- c:\program files\Jumpstart
2010-02-13 21:51 . 2010-02-13 21:52 -------- d-----w- c:\program files\Atheros
2010-02-13 21:51 . 2008-04-18 00:54 909824 ----a-w- c:\windows\system32\drivers\athr.sys
2010-02-13 21:51 . 2010-02-13 21:51 -------- d-----w- c:\windows\system32\nn-NO
2010-02-13 21:51 . 2008-04-14 02:30 376832 ----a-w- c:\windows\system32\S64CPA.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 05:25 . 2008-08-04 07:34 82720 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-02-16 03:04 . 2008-07-01 15:16 -------- d-----w- c:\programdata\Microsoft Help
2010-02-14 01:25 . 2008-07-01 14:28 -------- d-----w- c:\program files\Java
2010-02-14 01:20 . 2008-07-01 15:20 -------- d-----w- c:\programdata\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2010-02-13 23:43 . 2008-07-01 15:13 -------- d-----w- c:\program files\Picasa2
2010-02-13 23:28 . 2008-07-01 15:08 -------- d-----w- c:\programdata\McAfee
2010-02-13 23:21 . 2008-07-01 15:13 -------- d-----w- c:\program files\Google
2010-02-13 21:52 . 2008-07-01 14:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-13 21:49 . 2008-07-01 15:01 -------- d-----w- c:\programdata\Toshiba
2010-02-13 21:49 . 2008-07-01 14:49 -------- d-----w- c:\program files\Toshiba
2010-02-13 20:26 . 2010-02-13 20:26 0 --sha-r- c:\windows\system32\drivers\TOSHIBA_Satellite Pro A300_08008-EN_PSAG9E-00W00.MRK
2010-02-13 20:22 . 2010-02-13 20:22 -------- d-----w- c:\program files\Realtek
2010-02-13 20:22 . 2008-07-01 14:40 319456 ----a-w- c:\windows\DIFxAPI.dll
2010-02-13 20:21 . 2008-07-01 14:29 -------- d-----w- c:\program files\Intel
2009-12-18 13:05 . 2010-02-14 01:59 833024 ----a-w- c:\windows\system32\wininet.dll
2009-12-18 13:01 . 2010-02-14 01:59 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-12-18 10:14 . 2010-02-14 01:59 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-11 12:07 . 2010-02-14 01:57 301568 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-11 12:07 . 2010-02-14 01:57 98304 ----a-w- c:\windows\system32\drivers\srvnet.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"TOSCDSPD "= "c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SunJavaUpdateSched "= "c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"NDSTray.exe "= "NDSTray.exe" [BU]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"topi "= "c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"Google EULA Launcher "= "c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
"Toshiba TEMPO "= "c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2008-06-25 150040]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2008-06-25 170520]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2008-06-25 145944]
"RtHDVCpl "= "RtHDVCpl.exe" [2008-04-08 6037504]
"Camera Assistant Software "= "c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792]
"TPwrMain "= "c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"SmoothView "= "c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]
"00TCrdMain "= "c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800]
"Toshiba Registration "= "c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"Ad-Watch "= "c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]

c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]

c:\users\user_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3887914332-2058462226-582979155-1000]
"EnableNotificationsRef "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3887914332-2058462226-582979155-1001]
"EnableNotificationsRef "=dword:00000001

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [13/02/2010 23:42 64160]
R1 aswSP;aswSP;c:\windows\System32\drivers\aswSP.sys [15/02/2010 02:03 162512]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [13/02/2010 21:52 20352]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [15/02/2010 02:03 19024]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [15/02/2010 02:03 51792]
R2 ConfigFree Service;ConfigFree Service;c:\program files\Toshiba\ConfigFree\CFSvcs.exe [16/04/2008 23:19 40960]
R2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [24/04/2008 09:21 99720]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\Toshiba\SMARTLogService\TosIPCSrv.exe [03/12/2007 17:03 126976]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [01/07/2008 14:58 7168]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [24/04/2008 18:35 73728]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 19:06 951632]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [13/02/2010 23:49 55280]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\Jumpstart\jswpsapi.exe [13/02/2010 21:52 937984]
.
Contents of the 'Scheduled Tasks' folder

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redirect-home?tag=Toshibaukbholink-21&site=home
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-16 07:37
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i??????33F????P???x????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
Completion time: 2010-02-16 07:39:37
ComboFix-quarantined-files.txt 2010-02-16 07:39

Pre-Run: 40,373,841,920 bytes free
Post-Run: 41,328,635,904 bytes free

- - End Of File - - 701C2DC03200C1945BB671A40CD11D68



HijackThis to follow.

 

HijackThis:

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 07:46:28, on 16/02/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Toshiba Online Product Information\TOPI.exe
C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe
C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\explorer.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA
O4 - HKLM\..\Run: [Toshiba TEMPO] C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (User 'Default user')
O4 - Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: eBay.co.uk - Buy It Sell It Love It - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4 (file missing)
O9 - Extra button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redirect-home?tag=Toshibaukbholink-21&site=home (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Jumpstart\jswpsapi.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: Notebook Performance Tuning Service (TempoMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9049 bytes