This is my combofix log... please help me
ComboFix 09-01-21.02 - chsmanideep 2009-09-02 23:21:38.1 - NTFSx86
Microsoft® Windows Vistaâ„¢ Home Basic 6.0.6001.1.1252.1.1033.18.3035.1637 [GMT 5.5:30]
Running from: c:\users\chsmanideep\Desktop\Fix.exe
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))
.
2009-09-02 22:20 . 2004-08-04 08:00 506,368 --a------ c:\windows\System32\msxml.dll
2009-09-02 22:08 . 2009-09-02 22:08 <DIR> d-------- c:\users\chsmanideep\AppData\Roaming\Malwarebytes
2009-09-02 22:08 . 2009-09-02 22:08 <DIR> d-------- c:\users\CHSMAN~1\AppData\Roaming\Malwarebytes
2009-09-02 22:08 . 2009-08-03 13:36 38,160 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-09-02 22:07 . 2009-09-02 22:07 <DIR> d-------- c:\users\All Users\Malwarebytes
2009-09-02 22:07 . 2009-09-02 22:08 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-09-02 22:07 . 2009-09-02 22:07 <DIR> d-------- c:\progra~2\Malwarebytes
2009-09-02 22:07 . 2009-08-03 13:36 19,096 --a------ c:\windows\System32\drivers\mbam.sys
2009-09-02 20:04 . 2009-09-02 21:02 <DIR> d-------- c:\users\chsmanideep\AppData\Roaming\BitDefender Deployment Tool
2009-09-02 20:04 . 2009-09-02 21:02 <DIR> d-------- c:\users\CHSMAN~1\AppData\Roaming\BitDefender Deployment Tool
2009-09-02 19:27 . 2009-09-02 19:27 <DIR> d-------- c:\users\chsmanideep\AppData\Roaming\Simply Super Software
2009-09-02 19:27 . 2009-09-02 19:27 <DIR> d-------- c:\users\CHSMAN~1\AppData\Roaming\Simply Super Software
2009-09-02 17:55 . 2009-09-02 17:55 <DIR> d-------- c:\program files\Trend Micro
2009-09-02 14:25 . 2009-09-02 14:25 <DIR> d-------- c:\program files\Common Files\PX Storage Engine
2009-09-02 14:24 . 2009-09-02 14:24 <DIR> d----c--- c:\windows\System32\DRVSTORE
2009-09-02 14:24 . 2008-05-15 16:15 53,168 --a------ c:\windows\System32\drivers\MpFilter.sys
2009-09-02 00:49 . 2009-09-02 00:49 128 --a------ c:\windows\System32\drivers\kmxzone.u2k1
2009-09-02 00:49 . 2009-09-02 00:49 128 --a------ c:\windows\System32\drivers\kmxzone.u2k0
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k7
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k6
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k5
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k4
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k3
2009-09-02 00:49 . 2009-09-02 00:49 28 --a------ c:\windows\System32\drivers\kmxzone.u2k2
2009-09-02 00:44 . 2009-09-02 00:44 <DIR> d-------- c:\windows\rnapxs
2009-09-02 00:38 . 2009-09-02 00:38 <DIR> d-------- c:\users\All Users\Logs
2009-09-02 00:38 . 2009-09-02 00:38 <DIR> d-------- c:\progra~2\Logs
2009-09-01 13:29 . 2009-09-01 13:32 <DIR> d-------- C:\f0ba96b0d6a4d10ffd
2009-08-31 23:22 . 2009-08-31 23:22 <DIR> d-------- c:\program files\DDnsFilter
2009-08-31 23:22 . 2009-08-31 23:22 37,760 --a------ c:\windows\System32\drivers\Filter.sys
2009-08-31 23:20 . 2009-08-31 23:20 2 --a------ c:\windows\
010112010146101105.te
2009-08-31 22:52 . 2009-08-31 22:52 <DIR> d--hs---- c:\windows\System32\%APPDATA%
2009-08-31 22:30 . 2009-08-31 23:59 <DIR> d-------- c:\users\All Users\avg8
2009-08-31 22:30 . 2009-08-31 22:30 <DIR> d-------- c:\program files\AVG
2009-08-31 22:30 . 2009-08-31 23:59 <DIR> d-------- c:\progra~2\avg8
2009-08-26 19:33 . 2009-06-22 15:52 2,048 --a------ c:\windows\System32\tzres.dll
2009-08-26 19:32 . 2009-06-05 18:04 28,672 --a------ c:\windows\System32\Apphlpdm.dll
2009-08-26 19:31 . 2009-06-05 15:38 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
2009-08-26 19:09 . 2009-08-26 19:12 <DIR> d-------- c:\users\chsmanideep\AppData\Roaming\SSH
2009-08-26 19:09 . 2009-08-26 19:12 <DIR> d-------- c:\users\CHSMAN~1\AppData\Roaming\SSH
2009-08-26 19:07 . 2009-08-26 19:07 <DIR> d-------- c:\program files\SSH Communications Security
2009-08-19 16:22 . 2009-08-19 16:22 <DIR> d-------- c:\program files\Force 2.0
2009-08-18 11:36 . 2009-08-18 11:36 <DIR> d-------- c:\users\All Users\WindowsSearch
2009-08-18 11:36 . 2009-08-18 11:36 <DIR> d-------- c:\progra~2\WindowsSearch
2009-08-12 11:52 . 2009-06-10 17:42 160,256 --a------ c:\windows\System32\wkssvc.dll
2009-08-12 11:45 . 2009-07-17 20:05 71,680 --a------ c:\windows\System32\atl.dll
2009-08-12 11:35 . 2009-06-04 18:04 2,066,432 --a------ c:\windows\System32\mstscax.dll
2009-08-12 11:35 . 2009-06-15 20:53 1,256,448 --a------ c:\windows\System32\lsasrv.dll
2009-08-12 11:35 . 2009-06-15 20:51 499,712 --a------ c:\windows\System32\kerberos.dll
2009-08-12 11:35 . 2009-06-15 23:50 439,896 --a------ c:\windows\System32\drivers\ksecdd.sys
2009-08-12 11:35 . 2009-06-15 20:54 270,848 --a------ c:\windows\System32\schannel.dll
2009-08-12 11:35 . 2009-06-15 20:52 213,504 --a------ c:\windows\System32\msv1_0.dll
2009-08-12 11:35 . 2009-06-15 20:54 175,104 --a------ c:\windows\System32\wdigest.dll
2009-08-12 11:35 . 2009-06-10 17:37 91,136 --a------ c:\windows\System32\avifil32.dll
2009-08-12 11:35 . 2009-06-15 20:54 72,704 --a------ c:\windows\System32\secur32.dll
2009-08-12 11:35 . 2009-06-15 18:27 9,728 --a------ c:\windows\System32\lsass.exe
2009-08-12 11:34 . 2009-07-14 16:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2009-08-12 11:34 . 2009-07-14 18:30 313,344 --a------ c:\windows\System32\wmpdxm.dll
2009-08-12 11:34 . 2009-07-14 14:00 43,520 --a------ c:\windows\System32\msdxm.tlb
2009-08-12 11:34 . 2009-07-14 14:00 18,432 --a------ c:\windows\System32\amcompat.tlb
2009-08-12 11:34 . 2009-07-14 18:28 7,680 --a------ c:\windows\System32\spwmp.dll
2009-08-12 11:34 . 2009-07-14 18:29 4,096 --a------ c:\windows\System32\msdxm.ocx
2009-08-12 11:34 . 2009-07-14 18:29 4,096 --a------ c:\windows\System32\dxmasf.dll
2009-08-11 17:06 . 2009-08-11 17:06 <DIR> d-------- C:\W30C6F14
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-02 16:55 --------- d---a-w c:\progra~2\Temp
2009-09-02 14:17 --------- d-----w c:\users\chsmanideep\AppData\Roaming\mjusbsp
2009-09-02 14:17 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\mjusbsp
2009-09-01 20:17 --------- d-----w c:\progra~2\Symantec
2009-08-31 16:55 --------- d-----w c:\progra~2\Norton
2009-08-26 13:37 --------- d--h--w c:\program files\InstallShield Installation Information
2009-08-26 13:36 --------- d-----w c:\program files\Common Files\InstallShield
2009-08-12 12:03 --------- d-----w c:\program files\Windows Mail
2009-08-10 15:02 --------- d-----w c:\users\chsmanideep\AppData\Roaming\Hewlett-Packard
2009-08-10 15:02 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\Hewlett-Packard
2009-08-10 15:01 --------- d-----w c:\progra~2\Hewlett-Packard
2009-07-28 21:24 --------- d-----w c:\users\chsmanideep\AppData\Roaming\GTek
2009-07-28 21:24 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\GTek
2009-07-27 13:34 --------- d-----w c:\program files\Common Files\Adobe
2009-07-21 21:52 915,456 ----a-w c:\windows\System32\wininet.dll
2009-07-21 21:47 71,680 ----a-w c:\windows\System32\iesetup.dll
2009-07-21 21:47 109,056 ----a-w c:\windows\System32\iesysprep.dll
2009-07-21 20:13 153,600 ----a-w c:\windows\System32\ieUnatt.exe
2009-07-20 14:20 --------- d-----w c:\progra~2\WildTangent
2009-07-16 13:10 --------- d-----w c:\users\chsmanideep\AppData\Roaming\PeerNetworking
2009-07-16 13:10 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\PeerNetworking
2009-07-14 08:55 --------- d-----w c:\program files\Microsoft SQL Server
2009-07-13 16:59 --------- d-----w c:\program files\Microsoft Small Business
2009-07-13 12:01 --------- d-----w c:\program files\Softland
2009-07-13 11:32 --------- d-----w c:\program files\gfortran
2009-07-13 11:19 --------- d-----w c:\users\chsmanideep\AppData\Roaming\vlc
2009-07-13 11:19 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\vlc
2009-07-13 11:14 --------- d-----w c:\program files\VideoLAN
2009-07-13 08:55 --------- d-----w c:\progra~2\A-PDF
2009-07-12 14:20 --------- d-----w c:\program files\Microsoft ActiveSync
2009-07-12 14:19 --------- d-----w c:\progra~2\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2009-07-12 14:16 --------- d-----w c:\progra~2\Microsoft Help
2009-07-10 18:00 --------- d-----w c:\progra~2\CyberLink
2009-07-04 06:42 --------- d-----w c:\progra~2\Yahoo! Companion
2009-07-03 19:15 --------- d-----w c:\program files\Yahoo!
2009-07-03 19:11 --------- d-----w c:\progra~2\Yahoo!
2009-07-03 17:16 --------- d-----w c:\users\chsmanideep\AppData\Roaming\CyberLink
2009-07-03 17:16 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\CyberLink
2009-07-03 12:37 --------- d-----w c:\users\chsmanideep\AppData\Roaming\PlayFirst
2009-07-03 12:37 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\PlayFirst
2009-07-03 12:37 --------- d-----w c:\progra~2\PlayFirst
2009-07-03 05:46 --------- d-----w c:\program files\MSXML 4.0
2009-07-02 18:00 --------- d-----w c:\users\chsmanideep\AppData\Roaming\funkitron
2009-07-02 18:00 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\funkitron
2009-07-02 17:59 --------- d-----w c:\users\chsmanideep\AppData\Roaming\WildTangent
2009-07-02 17:59 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\WildTangent
2009-07-02 10:40 --------- d-----w c:\users\chsmanideep\AppData\Roaming\FloodLightGames
2009-07-02 10:40 --------- d-----w c:\users\CHSMAN~1\AppData\Roaming\FloodLightGames
2009-07-02 10:40 --------- d-----w c:\progra~2\FloodLightGames
2009-06-30 09:06 18,696 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryReplaceNew.exe
2009-06-30 08:40 18,696 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryNoTravel.exe
2009-06-30 08:33 18,696 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryAccessories.exe
2009-06-30 06:14 18,184 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryWeakNew.exe
2009-06-26 12:06 18,184 ----a-w c:\windows\Help\OEM\scripts\HC_BatteryUpgrade.exe
2009-06-15 15:24 156,672 ----a-w c:\windows\System32\t2embed.dll
2009-06-15 15:20 72,704 ----a-w c:\windows\System32\fontsub.dll
2009-06-15 15:20 10,240 ----a-w c:\windows\System32\dciman32.dll
2009-06-15 12:52 289,792 ----a-w c:\windows\System32\atmfd.dll
2009-06-05 12:34 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2009-06-05 12:33 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2009-06-05 12:33 459,776 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2009-06-05 12:33 2,153,984 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-01-21 02:57 174 --sha-w c:\program files\desktop.ini
.
------- Sigcheck -------
2006-11-02 15:15 28672 b5ba0588a845043d9ef4957eb86a96f3 c:\windows\System32\ctfmon.exe
2006-11-02 15:15 28672 b5ba0588a845043d9ef4957eb86a96f3 c:\windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.0.6000.16386_none_9af9cad793a67953\ctfmon.exe
2008-01-21 08:04 45056 c6080fc83314f2b327cf7ee8d20c89e1 c:\windows\System32\userinit.exe
2008-01-21 08:04 45056 c6080fc83314f2b327cf7ee8d20c89e1 c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2383872]
"cdloader"="c:\users\chsmanideep\AppData\Roaming\mjusbsp\cdloader2.exe" [2009-08-01 50520]
"Google Update"="c:\users\chsmanideep\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-07-02 133104]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]
"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2008-07-03 812952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-09-09 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-09 178712]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-09-09 154136]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2008-01-21 237568]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-09-11 466944]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-09-26 1148200]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-09-26 1152296]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-09-26 189736]
"UCam_Menu"="c:\program files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2008-09-24 912688]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-09-26 210216]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2008-07-15 831488]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-02 202032]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-09 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-16 488752]
"TVAgent"="c:\program files\Hewlett-Packard\Media\TV\TVAgent.exe" [2009-04-22 206120]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-06-20 727592]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2D487FDB-2819-4E63-A012-C635B0F0B86B}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{67339B49-1D50-4D13-AAD9-C2BB90ECE145}"= c:\program files\Hewlett-Packard\Media\DVD\HPTouchSmartMusic.exe:HP TouchSmart Music
"{C119BAD8-B865-40E3-AB49-3A85689758CB}"= c:\program files\Hewlett-Packard\Media\DVD\HPTouchSmartPhoto.exe:HP TouchSmart Photo
"{C349F946-DB69-452F-A500-C3977A20C1E7}"= c:\program files\Hewlett-Packard\Media\DVD\HPTouchSmartVideo.exe:HP TouchSmart Video
"{CD78D919-3B27-4826-8D1A-5387A282017B}"= c:\program files\Hewlett-Packard\Media\DVD\TSMAgent.exe:HP TouchSmart Media Resident Program
"{01D454D0-DC64-40A4-B13B-89608A791B4A}"= c:\program files\Hewlett-Packard\Media\DVD\Kernel\CLML\CLMLSvc.exe:CyberLink Media Service
"{6F8BDFC3-0D62-4A8A-BA2D-1DC765274E75}"= c:\program files\Hewlett-Packard\Media\DVD\HPDVDSmart.exe:HP MediaSmart DVD
"{DE971EC6-9996-48A6-ADBA-FBD1E69E2D2E}"= c:\program files\Hewlett-Packard\TouchSmart\Media\HPTouchSmartMusic.exe:HP TouchSmart Music
"{C22C4874-9FD0-4833-95BD-00DCF8422D17}"= c:\program files\Hewlett-Packard\TouchSmart\Media\HPTouchSmartPhoto.exe:HP TouchSmart Photo
"{E84B606D-1265-42B4-BB60-8BEA0B2FCC24}"= c:\program files\Hewlett-Packard\TouchSmart\Media\HPTouchSmartVideo.exe:HP TouchSmart Video
"{A4A8B8DF-24E6-4851-9486-02700E56255A}"= c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe:HP TouchSmart Media Resident Program
"{FEB7AE59-D468-45E2-9725-1F169B7CA9C7}"= c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe:CyberLink Media Service
"{A0BC3889-625A-4445-BB57-C3F545355BD1}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{AAC57A94-C68F-4B37-AD18-55590780155F}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{CF3C3B3E-83EF-494C-9C7E-35A8F21C421C}"= c:\program files\Hewlett-Packard\Media\TV\QP.exe:Quick Play
"{C64322FD-734C-4056-B224-2202C494BCDC}"= c:\program files\Hewlett-Packard\Media\TV\QPService.exe:Quick Play Resident Program
"TCP Query User{4ADB4764-01B2-4E18-89E5-D1B685F7BE89}c:\\users\\chsmanideep\\appdata\\roaming\\mjusbsp\\magicjack.exe"= UDP:c:\users\chsmanideep\appdata\roaming\mjusbsp\magicjack.exe:magicjack.exe
"UDP Query User{4494A538-CF21-4A16-A0FC-CDF786725E37}c:\\users\\chsmanideep\\appdata\\roaming\\mjusbsp\\magicjack.exe"= TCP:c:\users\chsmanideep\appdata\roaming\mjusbsp\magicjack.exe:magicjack.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Windows\\system32\\winlogon.exe"= c:\windows\system32\winlogon.exe:*:enabled:@shell32.dll,-1
"c:\\Windows\\system32\\wininit.exe"= c:\windows\system32\wininit.exe:*:enabled:@shell32.dll,-1
"\\"= c:\windows\system\svchost.exe:*:Enabled:KL
R?4 ddnsfilter;ddnsfilter;c:\windows\sySTEM32\svchost.exe -k ddnsfilter [2008-01-21 21504]
R1 Filter;Filter;c:\windows\System32\drivers\Filter.sys [2009-08-31 37760]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-10-27 193840]
R3 enecir;ENE CIR Receiver;c:\windows\System32\drivers\enecir.sys [2008-04-29 54784]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\System32\drivers\IntcHdmi.sys [2008-07-15 112128]
R3 vfs101x;vfs101x;c:\windows\System32\drivers\vfs101x.sys [2008-09-17 40752]
R4 {55662437-DA8C-40c0-AADA-2C816A897A49};{55662437-DA8C-40c0-AADA-2C816A897A49};c:\program files\Hewlett-Packard\Media\DVD\
000.fcl [2008-09-26 16:06:34 59376]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\AEstSrv.exe [2009-02-09 77824]
R4 hpsrv;HP Service;c:\windows\System32\hpservice.exe [2008-03-19 19456]
R4 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
R4 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-27 365952]
R4 TVCapSvc;TV Background Capture Service (TVBCS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [2009-04-22 296320]
R4 TVSched;TV Task Scheduler (TVTS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [2009-04-22 116104]
R4 vfsFPService;Validity Fingerprint Service;c:\windows\System32\vfsFPService.exe [2008-09-17 599344]
S3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [2008-07-21 100184]
S4 OcHealthMon;Windows Live OneCare Health Monitor; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
ddnsfilter REG_MULTI_SZ ddnsfilter
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\autorun.exe
\shell\phone\command - G:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ba209ef-671b-11de-9cbc-00235a267b7c}]
\shell\AutoRun\command - G:\autorun.exe
\shell\phone\command - G:\autorun.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &AOL Toolbar Search - c:\programdata\AOL\ieToolbar\resources\en-IN\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {D8B7E2B3-24EF-43E9-B3D9-075F7D938DD8} = 10.0.0.1
FF - ProfilePath - c:\users\CHSMAN~1\AppData\Roaming\Mozilla\Firefox\Profiles\2v2u0p6q.default\
FF - prefs.js: browser.startup.homepage - hxxp://10.0.0.1/
FF - plugin: c:\users\chsmanideep\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\chsmanideep\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "
https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-09-02 23:22:26
Windows 6.0.6001 Service Pack 1 NTFS
detected NTDLL code modification:
ZwOpenFile
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = ????????????
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(724)
c:\windows\system32\DPPWDFLT.dll
- - - - - - - > 'Explorer.exe'(4808)
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
c:\windows\system32\btmmhook.dll
c:\program files\DigitalPersona\Bin\DpoSet.dll
.
Completion time: 2009-09-02 23:27:26
ComboFix-quarantined-files.txt 2009-09-02 17:57:16
Pre-Run: 191,060,303,872 bytes free
Post-Run: 191,212,707,840 bytes free
337 --- E O F --- 2009-08-26 14:04:42
===========
Hello
While we understand your frustration at having to wait, please note that Bleeping Computer deals with several hundred requests for assistance such as yours on a daily basis. As a result, our backlog is quite large as are other comparable sites that help others with malware issues. Although our HJT Team members work on hundreds of requests each day, they are all volunteers who work logs when they can and are able to do so. No one is paid by Bleeping Computer for their assistance to our members.
Further, our malware removal staff is comprised of team members with various levels of skill and expertise to deal with thousands of malware variants, some more complex than others. Although we try to take DDS/HJT logs in order (starting with the oldest), it is often the skill level of the particular helper and sometimes the operating system that dictates which logs get selected first. Some infections are more complicated than others and require a higher skill level to remove. Without that skill level attempted removal could result in disastrous results. In other instances, the helper may not be familiar with the operating system that you are using, since they use another. In either case, neither of us want someone to assist you who is not familiar with your issue and attempt to fix it.
We ask that once you have posted your log and are waiting, please DO NOT "bump" your thread or make further replies until it has been responded to by a member of the HJT Team. The reason we ask this or do not respond to your requests is because that would remove you from the active queue that Techs and Staff have access to. The malware staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response, there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.
That is why I have made an edit to your last post, instead of a reply. Please do not multiple post here, as that only pushes you further down the queue and causes confusion to the staff.
Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible.
Thank you for understanding.
Orange Blossom ~ forum moderator
Edited by Orange Blossom, 02 September 2009 - 05:47 PM.