BleepingComputer.com: Google Redirect - Please Help

SUPERAntiSpyware
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/05/2011 at 11:35 PM

Application Version : 4.50.1002

Core Rules Database Version : 6759
Trace Rules Database Version: 4571

Scan type : Complete Scan
Total Scan Time : 01:07:34

Memory items scanned : 565
Memory threats detected : 0
Registry items scanned : 8317
Registry threats detected : 0
File items scanned : 30482
File threats detected : 53

Adware.Tracking Cookie
a.ads1.msn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
a.ads2.msads.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
adbureau.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
ads1.msn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
ads2.msads.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
b.ads2.msads.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
broadcast.piximedia.fr [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
cdn4.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
cdn5.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
convoad.technoratimedia.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
core.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
crackle.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
ds.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
googleads.g.doubleclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
ia.media-imdb.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
interclick.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
m1.2mdn.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
macromedia.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.ign.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.live.kenmore.webcollage.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.mtvnservices.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.oprah.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.overstock.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.perthnow.com.au [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.scanscout.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.tattomedia.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media.tbo.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media01.kyte.tv [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
media1.break.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
mediasuite.multicastmedia.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
msnbcmedia.msn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
msntest.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
objects.tremormedia.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
oddcast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
s0.2mdn.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
secure-us.imrworldwide.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
sftrack.searchforce.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
spe.atdmt.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
static.discoverymedia.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
udn.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
web.adknowledge.com [ C:\Documents and Settings\HP_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\NAYDTNJT ]
i.adultswim.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\GUSXBMW6 ]
media.mtvnservices.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\GUSXBMW6 ]
secure-us.imrworldwide.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\GUSXBMW6 ]
C:\Documents and Settings\LocalService\Cookies\system@eyewonder[1].txt
C:\Documents and Settings\LocalService\Cookies\system@legolas-media[2].txt
C:\Documents and Settings\LocalService\Cookies\system@adultswim[1].txt
C:\Documents and Settings\LocalService\Cookies\system@ads.adultswim[1].txt
C:\Documents and Settings\LocalService\Cookies\system@mtvn.112.2o7[1].txt
C:\Documents and Settings\LocalService\Cookies\system@ads.cnn[1].txt

Trojan.Agent/Gen-Krpytik
C:\DOCUMENTS AND SETTINGS\HP_ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY DIRECTORY 1 FOR ARCSOFT PHOTOSTUDIO 2000 4.1 (TNT)_KEYGEN.ZIP\KEYGEN.EXE
C:\DOCUMENTS AND SETTINGS\HP_ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY DIRECTORY 3 FOR ARCSOFT PHOTOSTUDIO 2000 4.1 (TNT)_KEYGEN.ZIP\KEYGEN.EXE
__________________________________
ESET

D:\I386\Apps\APP10633\src\SpyInstall_HPPre.exe probably a variant of Win32/Agent.HVEUCPZ trojan deleted - quarantined
D:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP936\A0082867.exe probably a variant of Win32/Agent.HVEUCPZ trojan deleted - quarantined
__________________________________
Here is GMER
GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-05 22:07:23
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7 Maxtor_6L200M0 rev.BANC1G10
Running: gmer.exe; Driver: C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\kwwcypod.sys


---- Kernel code sections - GMER 1.0.15 ----

? C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\MediaMall\MediaMallServer.exe[132] KERNEL32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 038F0001
.text C:\Program Files\MediaMall\MediaMallServer.exe[132] KERNEL32.dll!GetModuleFileNameW 7C80B3E5 6 Bytes JMP 71AF0F5A
.text C:\Program Files\MediaMall\MediaMallServer.exe[132] KERNEL32.dll!GetFileAttributesExW 7C811105 6 Bytes JMP 71A10F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!UnhookWindowsHookEx 7E41F21E 5 Bytes JMP 3E25467C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!CallNextHookEx 7E41F85B 5 Bytes JMP 3E2DD0ED C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!CreateWindowExW 7E41FC25 5 Bytes JMP 3E2EDB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 3E2154C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!SetWindowsHookExW 7E42DDB5 5 Bytes JMP 3E2E9AC9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 3E3E480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 3E3E4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 3E3E47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 3E3E4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 3E3E4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 3E3E4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 3E3E46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 3E2EDB78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1792] ole32.dll!OleLoadFromStream 7752A257 5 Bytes JMP 3E3E4B77 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!UnhookWindowsHookEx 7E41F21E 5 Bytes JMP 3E25467C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!CallNextHookEx 7E41F85B 5 Bytes JMP 3E2DD0ED C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!CreateWindowExW 7E41FC25 5 Bytes JMP 3E2EDB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 3E2154C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!SetWindowsHookExW 7E42DDB5 5 Bytes JMP 3E2E9AC9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 3E3E480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 3E3E4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 3E3E47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 3E3E4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 3E3E4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 3E3E4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 3E3E46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 3E2EDB78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3228] ole32.dll!OleLoadFromStream 7752A257 5 Bytes JMP 3E3E4B77 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!CreateWindowExW 7E41FC25 5 Bytes JMP 3E2EDB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 3E2154C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 3E3E480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 3E3E4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 3E3E47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 3E3E4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 3E3E4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 3E3E4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3572] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 3E3E46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs VET-REC.SYS (CA Antivirus File Protection Driver/Computer Associates International, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat VET-REC.SYS (CA Antivirus File Protection Driver/Computer Associates International, Inc.)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000

---- EOF - GMER 1.0.15 ----
_________________________
Here is DDS
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by HP_Administrator at 19:25:43.71 on Tue 04/05/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2494.1568 [GMT -4:00]
.
AV: CA Anti-Virus *Enabled/Updated* {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MediaMall\MediaMallServer.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\Philips\SPC230NC\Monitor.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\AGRSMMSG.exe
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\qoeapp.exe
C:\Documents and Settings\HP_Administrator\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.rr.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: {04680976-f3c4-422a-83db-988be04c2033} - c:\windows\system32\atiiiexx32.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\HPDTLK02.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [D-Link AirPlus G] c:\program files\d-link\airplus g\AirGCFG.exe
mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe
mRun: [SPC230NC_Monitor] c:\windows\philips\spc230nc\Monitor.exe
mRun: [SPC_Monitor] c:\windows\philips\spc230nc\Monitor.exe
mRun: [cctray] "c:\program files\ca\ca internet security suite\cctray\cctray.exe"
mRun: [QOELOADER] "c:\program files\ca\ca internet security suite\ca anti-spam\qsp-5.1.18.0\QOELoader.exe"
mRun: [CAVRID] "c:\program files\ca\ca internet security suite\ca anti-virus\CAVRID.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autost~1.lnk - c:\program files\wintv\Ir.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\interv~1.lnk - c:\program files\intervideo\common\bin\WinCinemaMgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\309731\program\Updates from HP.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
LSP: c:\windows\system32\VetRedir.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197770476921
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://westflorida.clio.medcity.net/dana-cached/setup/JuniperSetupSP1.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 VET-FILT;VET File System Filter;c:\windows\system32\drivers\vet-filt.sys [2009-12-16 26352]
R1 VET-REC;VET File System Recognizer;c:\windows\system32\drivers\vet-rec.sys [2009-12-16 21104]
R1 VETEFILE;VET File Scan Engine;c:\windows\system32\drivers\vetefile.sys [2010-6-7 746216]
R1 VETFDDNT;VET Floppy Boot Sector Monitor;c:\windows\system32\drivers\vetfddnt.sys [2009-12-16 21488]
R1 VETMONNT;VET File Monitor;c:\windows\system32\drivers\vetmonnt.sys [2009-12-16 32240]
R2 CAISafe;CAISafe;c:\program files\ca\ca internet security suite\ca anti-virus\isafe.exe [2009-12-16 144960]
R2 IOPort;IOPort;c:\windows\system32\drivers\Ioport.sys [2002-1-25 6144]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 MediaMall Server;MediaMall Server;c:\program files\mediamall\MediaMallServer.exe [2011-2-26 4051824]
R2 VETMSGNT;VET Message Service;c:\program files\ca\ca internet security suite\ca anti-virus\vetmsg.exe [2009-12-16 238928]
R3 HCWBT8XX;Hauppauge WinTV 848/9 WDM Video Driver;c:\windows\system32\drivers\HCWBT8xx.sys [2007-12-14 472644]
R3 PPCtlPriv;PPCtlPriv;c:\program files\ca\ca internet security suite\ca anti-spyware\PPCtlPriv.exe [2007-8-16 189704]
R3 VETEBOOT;VET Boot Scan Engine;c:\windows\system32\drivers\veteboot.sys [2010-6-7 130280]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-5 135664]
S3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\drivers\PAEAFLT.sys [2009-8-7 8576]
S3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\drivers\SPC230NC.SYS [2009-8-7 461056]
.
=============== Created Last 30 ================
.
2011-04-05 16:28:54 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-05 16:07:51 0 ---ha-w- c:\documents and settings\hp_administrator\oisrijtfzf.tmp
2011-04-01 19:05:41 323072 ----a-w- c:\windows\system32\atiiiexx32.dll
2011-03-08 01:41:49 -------- d-----w- c:\program files\common files\ffdshowEx
.
==================== Find3M ====================
.
2011-04-05 16:28:28 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-04 22:48:32 456192 ----a-w- c:\windows\system32\encdec.dll
2011-02-04 22:48:30 291840 ----a-w- c:\windows\system32\sbe.dll
.
============= FINISH: 19:27:29.34 ===============

Okay. Sorry. You'll have to check dates/times to see if DDS and GMER were BEFORE or AFTER the Superantispyware and ESETonline. I had read these instructions in another forum after I originally posted, and it appeared I was supposed to have done them first. I have been rerunning Malwarebytes to see if "HKEY_CLASSES_ROOT\fsharproj" Trojan.BHO was still reappearing each time I open up a Windows Internet Explorer page and it does.

I will not run it again either unless told to do so. Thanks.

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

NOTE: It made me uninstall (not just disable) CA Virusscan before it would run.
__________________________________________________________________________________________________
ComboFix 11-04-06.01 - HP_Administrator 04/06/2011 17:24:21.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2494.2010 [GMT -4:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\HP_Administrator\Local Settings\Temp\IadHide5.dll
c:\documents and settings\HP_Administrator\WINDOWS
c:\windows\system32\18467.exe
c:\windows\system32\6334.exe
c:\windows\system32\ccrpTmr6.dll
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\ps2.bat
D:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2011-03-06 to 2011-04-06 )))))))))))))))))))))))))))))))
.
.
2011-04-06 11:12 . 2011-04-06 11:12 -------- d-----w- c:\program files\ESET
2011-04-06 02:19 . 2011-04-06 02:19 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com
2011-04-06 02:19 . 2011-04-06 02:19 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-04-05 16:29 . 2011-04-05 16:29 -------- d-----w- c:\program files\Common Files\Java
2011-04-05 16:28 . 2011-04-05 16:28 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-05 16:28 . 2011-04-05 16:28 -------- d-----w- c:\program files\Java
2011-04-05 16:07 . 2011-04-05 16:07 0 ---ha-w- c:\documents and settings\HP_Administrator\oisrijtfzf.tmp
2011-04-01 19:05 . 2011-04-01 19:05 323072 ----a-w- c:\windows\system32\atiiiexx32.dll
2011-03-08 01:41 . 2011-03-08 01:41 -------- d-----w- c:\program files\Common Files\ffdshowEx
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-05 16:28 . 2010-10-21 22:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-04 22:48 . 2004-08-10 04:00 456192 ----a-w- c:\windows\system32\encdec.dll
2011-02-04 22:48 . 2004-08-10 04:00 291840 ----a-w- c:\windows\system32\sbe.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04680976-F3C4-422A-83DB-988BE04C2033}]
2011-04-01 19:05 323072 ----a-w- c:\windows\system32\atiiiexx32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 68856]
"SUPERAntiSpyware"="c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SUPERAntiSpyware.exe" [2011-03-16 2423752]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 245760]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-18 339968]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"D-Link AirPlus G"="c:\program files\D-Link\AirPlus G\AirGCFG.exe" [2004-11-19 1216512]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-22 45056]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-05-25 98304]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-15 176128]
"SPC230NC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2007-12-14 102455]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-12-15 114688]
Updates from HP.lnk - c:\program files\Updates from HP\309731\Program\Updates from HP.exe [2005-5-25 45056]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\MediaMall\\MediaMallServer.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1484:UDP"= 1484:UDP:Windows Media Format SDK (iexplore.exe)
"1485:UDP"= 1485:UDP:Windows Media Format SDK (iexplore.exe)
.
R1 SASDIFSV;SASDIFSV;c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 IOPort;IOPort;c:\windows\system32\drivers\Ioport.sys [1/25/2002 2:01 PM 6144]
R3 HCWBT8XX;Hauppauge WinTV 848/9 WDM Video Driver;c:\windows\system32\drivers\HCWBT8xx.sys [12/14/2007 8:01 PM 472644]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 12:05 PM 135664]
S2 MediaMall Server;MediaMall Server;c:\program files\MediaMall\MediaMallServer.exe [2/26/2011 11:42 PM 4051824]
S3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\drivers\PAEAFLT.sys [8/7/2009 6:23 PM 8576]
S3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\drivers\SPC230NC.SYS [8/7/2009 6:23 PM 461056]
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 17:42]
.
2011-04-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 16:05]
.
2011-04-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 16:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.rr.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-06 17:33
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(756)
c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3552)
c:\windows\system32\WININET.dll
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Juniper Networks\Common Files\dsNcService.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehmsas.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2011-04-06 17:38:01 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-06 21:37
.
Pre-Run: 149,639,057,408 bytes free
Post-Run: 153,476,554,752 bytes free
.
- - End Of File - - 5B225129F3344CA1387851FB6B17FA99

Hi,

Please do the following:

• Please open your MalwareBytes AntiMalware Program
  
• Click the Update Tab and search for updates
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish, so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected. <-- very important
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.

• Note: You will need to use Internet explorer for this scan
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan
  
• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the activeX control to install
  
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  
• Click Scan
  
• Wait for the scan to finish
  
• When the scan completes, press the LIST OF THREATS FOUND button
  
• Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  
• Include the contents of this report in your next reply.
  
• Press the BACK button.
  
• Press Finish

MBAM found same file it keeps finding and deleting which reappears each time I open up Internet Explorer whether I am on line or not. I ran ESET again, and did not find anything this time (It gave a quick message, which I missed because it disappeared, something about since a scan had been run earlier or something...about the way it was going to run. The results of the ESET scan from earlier today are above.
_____________________________
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6292

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/6/2011 8:00:30 PM
mbam-log-2011-04-06 (20-00-30).txt

Scan type: Quick scan
Objects scanned: 163610
Time elapsed: 4 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hi,

Please do the following:


Download this file and save it to your desktop:

http://download.bleepingcomputer.com/grinler/rkill.scr

Double-click the file to run it. A command window will open briefly. Then run a quick scan with Malwarebytes. Post the Malwarebytes log.

Ran Rkill.scr...Ran MBAM (Rather than the recent 20+ minutes, it only ran about 5 minutes this time, but I no longer have an antivirus program on here since ComboFix told me to specifically remove it or it could not run.)
____________________________
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6292

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/7/2011 8:09:28 AM
mbam-log-2011-04-07 (08-09-28).txt

Scan type: Quick scan
Objects scanned: 163949
Time elapsed: 4 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Interesting, something is keeping that alive.

Re-run comboFix, allow it to update if it requests to do so, post the resulting log

ComboFix 11-04-06.03 - HP_Administrator 04/07/2011 11:21:40.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2494.1974 [GMT -4:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\HP_Administrator\Local Settings\Temp\IadHide5.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-03-07 to 2011-04-07 )))))))))))))))))))))))))))))))
.
.
2011-04-06 11:12 . 2011-04-06 11:12 -------- d-----w- c:\program files\ESET
2011-04-06 02:19 . 2011-04-06 02:19 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com
2011-04-06 02:19 . 2011-04-06 02:19 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-04-05 16:29 . 2011-04-05 16:29 -------- d-----w- c:\program files\Common Files\Java
2011-04-05 16:28 . 2011-04-05 16:28 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-05 16:28 . 2011-04-05 16:28 -------- d-----w- c:\program files\Java
2011-04-05 16:07 . 2011-04-05 16:07 0 ---ha-w- c:\documents and settings\HP_Administrator\oisrijtfzf.tmp
2011-04-01 19:05 . 2011-04-01 19:05 323072 ----a-w- c:\windows\system32\atiiiexx32.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-05 16:28 . 2010-10-21 22:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-04 22:48 . 2004-08-10 04:00 456192 ----a-w- c:\windows\system32\encdec.dll
2011-02-04 22:48 . 2004-08-10 04:00 291840 ----a-w- c:\windows\system32\sbe.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04680976-F3C4-422A-83DB-988BE04C2033}]
2011-04-01 19:05 323072 ----a-w- c:\windows\system32\atiiiexx32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 68856]
"SUPERAntiSpyware"="c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SUPERAntiSpyware.exe" [2011-03-16 2423752]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 245760]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-18 339968]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"D-Link AirPlus G"="c:\program files\D-Link\AirPlus G\AirGCFG.exe" [2004-11-19 1216512]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-22 45056]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-05-25 98304]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-15 176128]
"SPC230NC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2007-12-14 102455]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-12-15 114688]
Updates from HP.lnk - c:\program files\Updates from HP\309731\Program\Updates from HP.exe [2005-5-25 45056]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\MediaMall\\MediaMallServer.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1484:UDP"= 1484:UDP:Windows Media Format SDK (iexplore.exe)
"1485:UDP"= 1485:UDP:Windows Media Format SDK (iexplore.exe)
.
R1 SASDIFSV;SASDIFSV;c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 IOPort;IOPort;c:\windows\system32\drivers\Ioport.sys [1/25/2002 2:01 PM 6144]
R2 MediaMall Server;MediaMall Server;c:\program files\MediaMall\MediaMallServer.exe [2/26/2011 11:42 PM 4051824]
R3 HCWBT8XX;Hauppauge WinTV 848/9 WDM Video Driver;c:\windows\system32\drivers\HCWBT8xx.sys [12/14/2007 8:01 PM 472644]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 12:05 PM 135664]
S3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\drivers\PAEAFLT.sys [8/7/2009 6:23 PM 8576]
S3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\drivers\SPC230NC.SYS [8/7/2009 6:23 PM 461056]
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 17:42]
.
2011-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 16:05]
.
2011-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 16:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.rr.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-07 11:28
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(756)
c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3276)
c:\windows\system32\WININET.dll
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Juniper Networks\Common Files\dsNcService.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-04-07 11:33:41 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-07 15:33
ComboFix2.txt 2011-04-06 21:38
.
Pre-Run: 153,510,526,976 bytes free
Post-Run: 153,482,113,024 bytes free
.
- - End Of File - - 8E3017E593EF00BEEDE27B45A44C7183

Hi,

Please do the following:

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  
• They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://www.bleepingcomputer.com/forums/topic389449.html/page__view__findpost__p__2198595

Collect::
c:\windows\system32\atiiiexx32.dll

File::
c:\documents and settings\HP_Administrator\oisrijtfzf.tmp

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04680976-F3C4-422A-83DB-988BE04C2033}]
[-HKEY_CLASSES_ROOT\.fsharproj]

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  
• When finished, it shall produce a log for you.
  
• Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT
Please update and re-run Malwarebytes, post the resulting log

After this ran, completed, text file, reboot, etc., camera drivers kept trying to reinstall. Clicked those off. Tried to reestablish/repair internet connection but was unable to. Everytime I tried to open up Windows Explorer or "Computer", got a bunch of HPIZplus450 errors trying to install something. Lost keyboard, mouse, etc. I had to "restore" back to last restore point on here, Yesterday. So computer is back in that condition. I found the ComboFix log that just ran PRIOR to the restore. AFTER the restore, I again ran MBAM and it found more things than just the original. Log is below.
____________________________________
ComboFix 11-04-07.01 - HP_Administrator 04/07/2011 16:37:22.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2494.1958 [GMT -4:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt
.
FILE ::
"c:\documents and settings\HP_Administrator\oisrijtfzf.tmp"
.
file zipped: c:\windows\system32\atiiiexx32.dll
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
c:\documents and settings\HP_Administrator\Desktop\dds.scr
c:\documents and settings\HP_Administrator\Desktop\dotnetfx35setup.exe
c:\documents and settings\HP_Administrator\Desktop\Norton_Removal_Tool.exe
c:\documents and settings\HP_Administrator\Desktop\rkill.scr
c:\documents and settings\HP_Administrator\Desktop\SP26468.exe
c:\documents and settings\HP_Administrator\Desktop\SUPERAntiSpyware.exe
c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASDIFSV.SYS
c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASKUTIL.SYS
c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASSEH.DLL
c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SUPERAntiSpyware.exe
c:\documents and settings\HP_Administrator\Desktop\tdsskiller.exe
c:\documents and settings\HP_Administrator\Local Settings\Temp\IadHide5.dll
c:\documents and settings\HP_Administrator\oisrijtfzf.tmp
c:\progra~1\BackWeb\BACKWE~1\632~1.62\program\EN\ClientRC.dll
c:\program files\ATI Technologies\ATI Control Panel\atipdxxx.dll
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\program files\BackWeb\BackWeb Client\6.3.2.62\Program\BWfiles.dll
c:\program files\BackWeb\BackWeb Client\6.3.2.62\Program\clntutil.dll
c:\program files\BackWeb\BackWeb Client\6.3.2.62\Program\frext.dll
c:\program files\Common Files\ffdshowEx\erdmpg-5.3a.dll
c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\D-Link\AirPlus G\AirGCFG.exe
c:\program files\ESET\ESET Online Scanner\esets_apiA.dll
c:\program files\ESET\ESET Online Scanner\esets_apiW.dll
c:\program files\ESET\ESET Online Scanner\esets_apiW_a.dll
c:\program files\HP\Digital Imaging\bin\HpqUtil.dll
c:\program files\HP\Digital Imaging\Unload\hpiCamTA.dll
c:\program files\Internet Explorer\custsat.dll
c:\program files\Internet Explorer\ExtExport.exe
c:\program files\Internet Explorer\iecompat.dll
c:\program files\Internet Explorer\iedvtool.dll
c:\program files\Internet Explorer\ieproxy.dll
c:\program files\Internet Explorer\iexplore.exe.mui
c:\program files\Internet Explorer\jsdbgui.dll
c:\program files\Internet Explorer\jsdebuggeride.dll
c:\program files\Internet Explorer\JSProfilerCore.dll
c:\program files\Internet Explorer\jsprofilerui.dll
c:\program files\Internet Explorer\Plugins\NPEvery.dll
c:\program files\Internet Explorer\Plugins\nppdf32.dll
c:\program files\Internet Explorer\Plugins\npqtplugin.dll
c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
c:\program files\Internet Explorer\sqmapi.dll
c:\program files\Internet Explorer\xpshims.dll
c:\program files\iPod\bin\iPodService.exe
c:\program files\iPod\bin\iPodService.Resources\iPodService.DLL
c:\program files\iTunes\iTunesHelper.Resources\iTunesHelper.DLL
c:\program files\Java\jre6\bin\unicows.dll
c:\program files\MediaMall\PlayOn.exe
c:\program files\Messenger\custsat.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ar\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ar\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ar\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ar\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\bg\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\bg\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\bg\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\bg\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ca\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ca\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ca\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ca\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\coregen.exe
c:\program files\Microsoft Silverlight\4.0.60129.0\cs\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\cs\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\cs\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\cs\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\da\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\da\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\da\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\da\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\de\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\de\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\de\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\de\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\el\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\el\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\el\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\el\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\es\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\es\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\es\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\es\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\et\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\et\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\et\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\et\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\eu\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\eu\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\eu\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\eu\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\fi\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\fi\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\fi\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\fi\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\fr\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\fr\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\fr\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\fr\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\he\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\he\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\he\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\he\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\hr\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\hr\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\hr\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\hr\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\hu\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\hu\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\hu\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\hu\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\id\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\id\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\id\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\id\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\it\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\it\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\it\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\it\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ja\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ja\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ja\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ja\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ko\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ko\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ko\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ko\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\lt\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\lt\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\lt\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\lt\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\lv\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\lv\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\lv\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\lv\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\Microsoft.VisualBasic.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ms\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ms\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ms\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ms\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\nl\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\nl\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\nl\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\nl\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\no\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\no\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\no\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\no\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pl\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pl\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pl\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pl\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pt-BR\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pt-BR\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pt-BR\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pt-BR\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pt\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pt\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pt\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\pt\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ro\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ro\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ro\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ro\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ru\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ru\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ru\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\ru\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sk\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sk\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sk\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sk\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sl\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sl\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sl\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sl\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sr-Cyrl-CS\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sr-Cyrl-CS\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sr-Cyrl-CS\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sr-Cyrl-CS\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sr-Latn-CS\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sr-Latn-CS\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sr-Latn-CS\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sr-Latn-CS\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sv\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sv\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sv\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\sv\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.Core.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\system.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.Net.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.Net.ni.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.ni.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.Runtime.Serialization.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.ServiceModel.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.ServiceModel.Web.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.ServiceModel.Web.ni.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.Windows.Browser.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.Windows.Browser.ni.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.Xml.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\System.Xml.ni.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\th\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\th\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\th\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\th\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\tr\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\tr\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\tr\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\tr\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\uk\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\uk\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\uk\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\uk\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\vi\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\vi\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\vi\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\vi\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\zh-Hans\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\zh-Hans\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\zh-Hans\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\zh-Hans\system.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\zh-Hant\Microsoft.VisualBasic.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\zh-Hant\mscorlib.resources.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\zh-Hant\mscorrc.dll
c:\program files\Microsoft Silverlight\4.0.60129.0\zh-Hant\system.resources.dll
c:\program files\QuickTime\qttask.exe
c:\program files\Updates from HP\309731\Program\HPClientExt.dll
c:\program files\Windows Media Player\LegitLibM.dll
c:\program files\Windows Media Player\msoobci.dll
c:\program files\Windows Media Player\wmdbexport.exe
c:\program files\Windows Media Player\wmlaunch.exe
c:\program files\Windows Media Player\wmpenc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnssci.dll
c:\program files\Windows Media Player\wmpshare.exe
c:\program files\Windows Media Player\wmsetsdk.exe
c:\program files\Windows NT\Accessories\mswrd6.wpc
c:\program files\Windows NT\Accessories\mswrd8.wpc
c:\program files\Windows NT\Accessories\write.wpc
c:\program files\Windows NT\hypertrm.exe
c:\windows\agrsmdel.exe
c:\windows\AGRSMMSG.exe
c:\windows\ALCXMNTR.EXE
c:\windows\apppatch\acadproc.dll
c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\d987cf1de4ba688da92e212a374232c2\System.Web.ni.dll
c:\windows\Downloaded Program Files\JuniperSetup.ocx
c:\windows\eHome\ehRecvr.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\kb913800.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
c:\windows\Philips\SPC230NC\Monitor.exe
c:\windows\System\hpsysdrv.exe
c:\windows\system32\3DViewer.dll
c:\windows\system32\A16_Tmrs.ocx
c:\windows\system32\acelpdec.ax
c:\windows\system32\advpack.dll.mui
c:\windows\system32\afiost.ocx
c:\windows\system32\agrscoin.dll
c:\windows\system32\agrsmsvc.exe
c:\windows\system32\AniGIF.ocx
c:\windows\system32\ANIOApi.dll
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2mdxx.exe
c:\windows\system32\ATIDEMGR.dll
c:\windows\system32\atiiiexx32.dll
c:\windows\system32\atikvmag.dll
c:\windows\system32\audiodev.dll
c:\windows\system32\bt848wst.dll
c:\windows\system32\btgpio32.dll
c:\windows\system32\chcp.com
c:\windows\system32\comct332.ocx
c:\windows\system32\CRAnalyzer.dll
c:\windows\system32\cSystemInfoAX.ocx
c:\windows\system32\CTNEDT32.OCX
c:\windows\system32\davinci.scr
c:\windows\system32\dfshim.dll
c:\windows\system32\diskcomp.com
c:\windows\system32\diskcopy.com
c:\windows\system32\DivXdec.ax
c:\windows\system32\dltwav32.acm
c:\windows\system32\Drivers\AGRSM.sys
c:\windows\system32\drivers\ALCXWDM.SYS
c:\windows\system32\DRIVERS\AmdK8.sys
c:\windows\system32\DRIVERS\dsNcAdpt.sys
c:\windows\system32\DRIVERS\fasttx2k.sys
c:\windows\system32\DRIVERS\GEARAspiWDM.sys
c:\windows\system32\Drivers\HCWBT8xx.sys
c:\windows\system32\DRIVERS\HPZid412.sys
c:\windows\system32\DRIVERS\HPZipr12.sys
c:\windows\system32\DRIVERS\HPZius12.sys
c:\windows\system32\Drivers\mbamswissarmy.sys
c:\windows\system32\Drivers\mhndrv.sys
c:\windows\system32\DRIVERS\PAEAFLT.sys
c:\windows\system32\Drivers\PcdrNdisuio.sys
c:\windows\system32\Drivers\pcdrsrvc.pkms
c:\windows\system32\drivers\povrtdev.sys
c:\windows\system32\Drivers\PRISMA02.sys
c:\windows\system32\DRIVERS\PS2.sys
c:\windows\system32\Drivers\PxHelp20.sys
c:\windows\system32\DRIVERS\Rtnicxp.sys
c:\windows\system32\DRIVERS\secdrv.sys
c:\windows\system32\DRIVERS\SPC230NC.SYS
c:\windows\system32\drivers\wisgostrm.sys
c:\windows\system32\DRIVERS\wpdusb.sys
c:\windows\system32\Drivers\WudfPf.sys
c:\windows\system32\Drivers\WudfRd.sys
c:\windows\system32\drmupgds.exe
c:\windows\system32\DWSPY36.dll
c:\windows\system32\dxva2.dll
c:\windows\system32\evr.dll
c:\windows\system32\exlate32.dll
c:\windows\system32\ExportModeller.dll
c:\windows\system32\filedialog.dll
c:\windows\system32\format.com
c:\windows\system32\fpalsu.dll
c:\windows\system32\GButton.ocx
c:\windows\system32\gdiplus.dll
c:\windows\system32\graftabl.com
c:\windows\system32\Hcwchan.dll
c:\windows\system32\hcwdlg.ocx
c:\windows\system32\hcwfread.ax
c:\windows\system32\hcwhook.dll
c:\windows\system32\HCWI2C32.DLL
c:\windows\system32\hcwpnp32.dll
c:\windows\system32\Hcwsnap.ax
c:\windows\system32\hcwsplit.ax
c:\windows\system32\Hcwtvdlg.dll
c:\windows\system32\HCWTVWND.dll
c:\windows\system32\HCWUTL32.dll
c:\windows\system32\hpreg.dll
c:\windows\system32\hptcpmib.dll
c:\windows\system32\HPTcpMon.dll
c:\windows\system32\HPTcpMUI.dll
c:\windows\system32\hpzcon10.dll
c:\windows\system32\hpzcon12.dll
c:\windows\system32\HPZinw12.exe
c:\windows\system32\HPZipt12.dll
c:\windows\system32\HPZisn12.dll
c:\windows\system32\html.iec
c:\windows\system32\icardagt.exe
c:\windows\system32\icardres.dll
c:\windows\system32\icardres.dll.mui
c:\windows\system32\ie4uinit.exe.mui
c:\windows\system32\iedkcs32.dll.mui
c:\windows\system32\ieframe.dll.mui
c:\windows\system32\igdetect.dll
c:\windows\system32\imaadp32.acm
c:\windows\system32\Implode.dll
c:\windows\system32\infocardapi.dll
c:\windows\system32\infocardcpl.cpl
c:\windows\system32\INKED.DLL
c:\windows\system32\ivfsrc.ax
c:\windows\system32\keycode.dll
c:\windows\system32\KeyHelp.ocx
c:\windows\system32\lex2kusb.dll
c:\windows\system32\LEXBCE.DLL
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXLMPM.DLL
c:\windows\system32\LEXP2P32.DLL
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\MDCustomPanels.ocx
c:\windows\system32\mfcuia32.dll
c:\windows\system32\MFPLAT.dll
c:\windows\system32\mhn.dll
c:\windows\system32\migpwd.exe
c:\windows\system32\mode.com
c:\windows\system32\more.com
c:\windows\system32\MP43DECD.dll
c:\windows\system32\MP4SDECD.dll
c:\windows\system32\MPG4DECD.dll
c:\windows\system32\msacm32.drv
c:\windows\system32\MSADODC.OCX
c:\windows\system32\msadp32.acm
c:\windows\system32\msaud32.acm
c:\windows\system32\MSBIND.DLL
c:\windows\system32\MSCAL.OCX
c:\windows\system32\mscomct2.ocx
c:\windows\system32\mscoree.dll
c:\windows\system32\msdelta.dll
c:\windows\system32\MsFlxGrd.ocx
c:\windows\system32\msg711.acm
c:\windows\system32\msg723.acm
c:\windows\system32\msgsm32.acm
c:\windows\system32\msh261.drv
c:\windows\system32\msh263.drv
c:\windows\system32\mshta.exe.mui
c:\windows\system32\msinet.ocx
c:\windows\system32\msrating.dll.mui
c:\windows\system32\MSRDO20.DLL
c:\windows\system32\MSSTDFMT.DLL
c:\windows\system32\mucltui.dll
c:\windows\system32\mucltui.dll.mui
c:\windows\system32\muweb.dll
c:\windows\system32\MyCommandButton.ocx
c:\windows\system32\mypixdx.scr
c:\windows\system32\nature.scr
c:\windows\system32\netfxperf.dll
c:\windows\system32\ochlp30e.dll
c:\windows\system32\omano.dll
c:\windows\system32\Popup.ocx
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\PortableDeviceClassExtension.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceWiaCompat.dll
c:\windows\system32\PortableDeviceWMDRM.dll
c:\windows\system32\prntvpt.dll
c:\windows\system32\ptpusb.dll
c:\windows\system32\ptpusd.dll
c:\windows\system32\PUBOLE32.DLL
c:\windows\system32\qd3d.dll
c:\windows\system32\QD3D_IR2.q3x
c:\windows\system32\QD3DCustomElements.q3x
c:\windows\system32\QuickTime.cpl
c:\windows\system32\QuickTime.qts
c:\windows\system32\QuickTimeCheck.ocx
c:\windows\system32\QuickTimeMusicalInstruments.qtx
c:\windows\system32\QuickTimeVR.qtx
c:\windows\system32\rave.dll
c:\windows\system32\RDOCURS.DLL
c:\windows\system32\rgb9rast_2.dll
c:\windows\system32\sacommoncontrols.dll
c:\windows\system32\SCP32.DLL
c:\windows\system32\Sdcvtx.ocx
c:\windows\system32\SftMask_IX86_U_60.ocx
c:\windows\system32\shlObj70.ocx
c:\windows\system32\space.scr
c:\windows\system32\SPC230NC.AX
c:\windows\System32\spool\PRTPROCS\W32X86\filterpipelineprintproc.dll
c:\windows\System32\spool\PRTPROCS\W32X86\LXBCPP5C.dll
c:\windows\System32\spool\PRTPROCS\W32X86\mdippr.dll
c:\windows\system32\spupdsvc.exe
c:\windows\system32\sscdlg.dll
c:\windows\system32\sscrc.dll
c:\windows\system32\sscsdk80.dll
c:\windows\system32\Ssdata32.ocx
c:\windows\system32\Ssdatb32.ocx
c:\windows\system32\stream.sys
c:\windows\system32\TABCTL32.OCX
c:\windows\system32\taskman.exe
c:\windows\system32\tegods.ocx
c:\windows\system32\tree.com
c:\windows\system32\tssoft32.acm
c:\windows\system32\TsWpfWrp.exe
c:\windows\system32\u2lfinra.dll
c:\windows\system32\ufmanager.dll
c:\windows\system32\UIAutomationCore.dll
c:\windows\system32\uwdf.exe
c:\windows\system32\VB5DB.DLL
c:\windows\system32\VBAEN32.OLB
c:\windows\system32\VBAEND32.OLB
c:\windows\system32\VBAME.DLL
c:\windows\system32\vbar332.dll
c:\windows\system32\VEN2232.OLB
c:\windows\system32\verclsid.exe
c:\windows\system32\Vox2wav.ocx
c:\windows\system32\wdfapi.dll
c:\windows\system32\wdfmgr.exe
c:\windows\system32\win.com
c:\windows\system32\WindowsAccessBridge.dll
c:\windows\system32\wisproxy.ax
c:\windows\system32\WISPTIS.EXE
c:\windows\system32\wmdrmdev.dll
c:\windows\system32\wmdrmnet.dll
c:\windows\system32\wmpeffects.dll
c:\windows\system32\wmpencen.dll
c:\windows\system32\wmpmde.dll
c:\windows\system32\wmpps.dll
c:\windows\system32\wmpsrcwp.dll
c:\windows\system32\wmserror.dll
c:\windows\system32\WMVADVD.dll
c:\windows\system32\WMVADVE.DLL
c:\windows\system32\WMVDECOD.dll
c:\windows\system32\WMVENCOD.dll
c:\windows\system32\WMVSDECD.dll
c:\windows\system32\WMVSENCD.dll
c:\windows\system32\WMVXENCD.dll
c:\windows\system32\wpd_ci.dll
c:\windows\system32\wpdconns.dll
c:\windows\system32\wpdmtp.dll
c:\windows\system32\wpdmtpdr.dll
c:\windows\system32\wpdmtpus.dll
c:\windows\system32\WpdShext.dll
c:\windows\system32\wpdshextautoplay.exe
c:\windows\system32\wpdshextres.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\wpdsp.dll
c:\windows\system32\wpdtrace.dll
c:\windows\system32\wpgldfsh.scr
c:\windows\system32\wuapi.dll.mui
c:\windows\system32\wuaucpl.cpl.mui
c:\windows\system32\wuaueng.dll.mui
c:\windows\system32\wucltui.dll.mui
c:\windows\system32\WUDFCoinstaller.dll
c:\windows\system32\WudfHost.exe
c:\windows\system32\WudfPlatform.dll
c:\windows\system32\wudfsvc.dll
c:\windows\system32\WUDFx.dll
c:\windows\system32\Wvfile.ocx
c:\windows\system32\xpsshhdr.dll
c:\windows\system32\xpssvcs.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ehRecvr
-------\Legacy_fasttx2k
-------\Legacy_SASDIFSV
-------\Legacy_SASKUTIL
-------\Legacy_UleadBurningHelper
-------\Service_dsNcAdpt
-------\Service_ehRecvr
-------\Service_fasttx2k
-------\Service_HCWBT8XX
-------\Service_MHN
-------\Service_MHNDRV
-------\Service_msvad_simple
-------\Service_PAEAFLT.sys
-------\Service_PcdrNdisuio
-------\Service_PRISM_A02
-------\Service_Ps2
-------\Service_RTL8023xp
-------\Service_SASDIFSV
-------\Service_SASKUTIL
-------\Service_SPC230NC
-------\Service_UleadBurningHelper
-------\Service_WISTechVIDCAP
-------\Service_WpdUsb
.
.
((((((((((((((((((((((((( Files Created from 2011-03-07 to 2011-04-07 )))))))))))))))))))))))))))))))
.
.
2011-04-06 11:12 . 2011-04-06 11:12 -------- d-----w- c:\program files\ESET
2011-04-06 02:19 . 2011-04-06 02:19 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com
2011-04-06 02:19 . 2011-04-06 02:19 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-04-05 16:29 . 2011-04-05 16:29 -------- d-----w- c:\program files\Common Files\Java
2011-04-05 16:28 . 2011-04-05 16:28 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-05 16:28 . 2011-04-05 16:28 -------- d-----w- c:\program files\Java
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-05 16:28 . 2010-10-21 22:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-04 22:48 . 2004-08-10 04:00 456192 ----a-w- c:\windows\system32\encdec.dll
2011-02-04 22:48 . 2004-08-10 04:00 291840 ----a-w- c:\windows\system32\sbe.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 245760]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-22 45056]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-15 176128]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2007-12-14 102455]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-12-15 114688]
Updates from HP.lnk - c:\program files\Updates from HP\309731\Program\Updates from HP.exe [2005-5-25 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\MediaMall\\MediaMallServer.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1484:UDP"= 1484:UDP:Windows Media Format SDK (iexplore.exe)
"1485:UDP"= 1485:UDP:Windows Media Format SDK (iexplore.exe)
.
R2 IOPort;IOPort;c:\windows\system32\drivers\Ioport.sys [1/25/2002 2:01 PM 6144]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 12:05 PM 135664]
S2 MediaMall Server;MediaMall Server;c:\program files\MediaMall\MediaMallServer.exe [2/26/2011 11:42 PM 4051824]
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 17:42]
.
2011-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 16:05]
.
2011-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 16:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.rr.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-SUPERAntiSpyware - c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SUPERAntiSpyware.exe
HKLM-Run-ATIPTA - c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
HKLM-Run-D-Link AirPlus G - c:\program files\D-Link\AirPlus G\AirGCFG.exe
HKLM-Run-QuickTime Task - c:\program files\QuickTime\qttask.exe
HKLM-Run-SPC230NC_Monitor - c:\windows\Philips\SPC230NC\Monitor.exe
HKLM-Run-SPC_Monitor - c:\windows\Philips\SPC230NC\Monitor.exe
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASSEH.DLL
AddRemove-Windows Media Format Runtime - c:\program files\Windows Media Player\wmsetsdk.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-07 16:44
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(476)
c:\documents and settings\HP_Administrator\Desktop\SUPERAntispyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(1148)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Juniper Networks\Common Files\dsNcService.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\MsiExec.exe
.
**************************************************************************
.
Completion time: 2011-04-07 16:48:58 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-07 20:48
ComboFix2.txt 2011-04-07 15:33
ComboFix3.txt 2011-04-06 21:38
.
Pre-Run: 153,495,420,928 bytes free
Post-Run: 153,210,834,944 bytes free
.
- - End Of File - - D9A6135B56DE9BBAE3E8C939D11C4A40
_________________________________________
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6304

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/7/2011 5:53:49 PM
mbam-log-2011-04-07 (17-53-49).txt

Scan type: Quick scan
Objects scanned: 164793
Time elapsed: 4 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{04680976-F3C4-422A-83DB-988BE04C2033} (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04680976-F3C4-422A-83DB-988BE04C2033} (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{04680976-F3C4-422A-83DB-988BE04C2033} (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{04680976-F3C4-422A-83DB-988BE04C2033} (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\atiiiexx32.dll (IPH.GenericBHO) -> Quarantined and deleted successfully.

Hi

It found the couple of things I had combofix quarantine

when was that malwarebytes ran?

Please update it and run it again, see if it picks up anything else?

Hi

It found the couple of things I had combofix quarantine



Please update it and run it again, see if it picks up anything else?

I ran it again twice, and it found nothing. Note, after the Clean when it tried to reboot, it wouldn't, so I had to boot to last known good... I'm not sure when that was, but my CA antivirus reappeared and for some reason, was trying to install stuff - which I stopped. (ComboFix made me uninstall it). It has a red X on it right now. What should I do next? Thanks.


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6305

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/7/2011 6:27:47 PM
mbam-log-2011-04-07 (18-27-47).txt

Scan type: Quick scan
Objects scanned: 164786
Time elapsed: 2 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)