Am I infected?

Hi,

This is my first visit to this forum and I am just a beginner. My PC is running on Win XP SP3 and I have the following security softwares installed: Antivir Free, ZoneAlarm, Spybot, SpywareBlaster and Malwarebytes Antimalware that I always update.

I noticed that each time I open SpywareBlaster protection are all enabled except for Mozilla (my default browser). I never had that problem before. I followed all your instructions but I was unable to scan with RootRepeal. A window opened while the scan was in progress, displaying: "Exception Address 0x004eca19".

Thanks for your help


DDS (Ver_09-07-30.01) - NTFSx86
Run by Administrator at 9:45:39.92 on 2009-09-05
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.74 [GMT 0:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\S24EvMon.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\1XConfig.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.ca/
uWindow Title =
mWindow Title =
uInternet Settings,ProxyOverride = <local>
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - No File
BHO: {1FD79A59-37B1-459B-9097-09F9FAB8A523} - No File
BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [StatusClient] c:\program files\hewlett-packard\toolbox2.0\apache tomcat 4.0\webapps\toolbox\statusclient\StatusClient.exe /auto
mRun: [TomcatStartup] c:\program files\hewlett-packard\toolbox2.0\hpbpsttp.exe
mRunOnce: [ConfigBrowsers] c:\program files\hewlett-packard\toolbox2.0\ConfigBrowsers.exe
mRunOnce: [AdPass] c:\program files\hewlett-packard\toolbox2.0\adpass.exe -jar "c:\program files\hewlett-packard\toolbox2.0\AdPass.jar"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: Crawler Search
IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1247013394664
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1247014746268
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxsrvc.dll
Notify: Sebring - c:\windows\system32\LgNotify.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\sz8d2xl0.default\
FF - prefs.js: browser.startup.homepage - google.ca
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-14 11608]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-7-8 353672]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-14 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-14 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-14 55656]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-7-8 210216]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 mbr;mbr;\??\c:\docume~1\admini~1\locals~1\temp\mbr.sys --> c:\docume~1\admini~1\locals~1\temp\mbr.sys [?]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [2007-4-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [2007-4-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [2007-4-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [2007-4-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [2007-4-23 98568]

=============== Created Last 30 ================

2009-09-04 21:47 <DIR> --d----- c:\program files\SIW
2009-09-04 20:34 45,056 a------- c:\windows\NCUNINST.EXE
2009-09-04 20:21 354 a------- C:\response.ini
2009-09-04 20:21 50 a------- C:\install.bat
2009-09-04 20:21 39 a------- C:\uninstall.bat
2009-09-04 20:21 79,660 -------- C:\cu_readme.rtf
2009-09-04 20:21 4,187 -------- C:\0x0409.ini
2009-09-04 20:21 3,584 -------- C:\1033.mst
2009-09-04 20:20 1,390 a------- C:\Setup.ini
2009-09-04 20:20 1,822,520 -------- C:\instmsiw.exe
2009-09-04 20:20 1,708,856 -------- C:\instmsia.exe
2009-09-04 20:20 1,043,550 a------- C:\setup.exe
2009-09-04 20:20 1,150,976 -------- C:\hpbtpg.exe
2009-09-04 20:20 <DIR> --d----- c:\temp\Portmon
2009-09-04 20:20 <DIR> --d----- c:\temp\help
2009-09-04 20:20 50,688 -------- c:\temp\wsnmp32.dll
2009-09-04 20:20 458,752 -------- c:\temp\tls704d.dll
2009-09-04 20:20 180,281 -------- c:\temp\sdinetware.dll
2009-09-04 20:20 94,208 -------- c:\temp\snmp_pp.dll
2009-09-04 20:20 61,440 -------- c:\temp\sdisdk.dll
2009-09-04 20:20 266,293 -------- c:\temp\msvcrt.dll
2009-09-04 20:20 151,629 -------- c:\temp\sdiingredientsagents.dll
2009-09-04 20:20 102,471 -------- c:\temp\sdicommunications.dll
2009-09-04 20:20 69,697 -------- c:\temp\sdiingredients.dll
2009-09-04 20:20 69,693 -------- c:\temp\sdidiscovery.dll
2009-09-04 20:20 28,721 -------- c:\temp\sdilog.dll
2009-09-04 20:20 70,656 -------- c:\temp\msvcirt.dll
2009-09-04 20:20 995,383 -------- c:\temp\mfc42.dll
2009-09-04 20:19 397,369 -------- c:\temp\hpzjpp01.dll
2009-09-04 20:19 254,009 -------- c:\temp\hpzjut01.dll
2009-09-04 20:19 516,096 -------- c:\temp\hpntwkwiz_pt.dll
2009-09-04 20:19 516,096 -------- c:\temp\hpntwkwiz_nl.dll
2009-09-04 20:19 516,096 -------- c:\temp\hpntwkwiz_it.dll
2009-09-04 20:19 516,096 -------- c:\temp\hpntwkwiz_fr.dll
2009-09-04 20:19 516,096 -------- c:\temp\hpntwkwiz_es.dll
2009-09-04 20:19 512,000 -------- c:\temp\hpntwkwiz_en.dll
2009-09-04 20:19 516,096 -------- c:\temp\hpntwkwiz_el.dll
2009-09-04 20:19 516,096 -------- c:\temp\hpntwkwiz_de.dll
2009-09-04 20:19 512,000 -------- c:\temp\hpntwkwiz_ar.dll
2009-09-04 20:19 155,648 -------- c:\temp\hpjpts3.dll
2009-09-04 20:19 69,632 -------- c:\temp\hpjsnm2.dll
2009-09-04 20:19 32,832 -------- c:\temp\hpjsira.exe
2009-09-04 20:19 20,546 -------- c:\temp\hpjsiadp.dll
2009-09-04 20:19 200,704 -------- c:\temp\hpjpds2.dll
2009-09-04 20:19 147,456 -------- c:\temp\hpjcrp1.dll
2009-09-04 20:19 40,960 -------- c:\temp\hpjnet3.dll
2009-09-04 20:19 200,704 -------- c:\temp\hpjcmn3.dll
2009-09-04 20:19 110,592 -------- c:\temp\cfgtoipx.exe
2009-09-04 20:19 110,592 -------- c:\temp\cfgtoip.exe
2009-09-04 20:19 <DIR> --d----- C:\Temp
2009-09-04 20:19 <DIR> --d----- C:\WU_Wizard
2009-09-04 20:19 <DIR> --d----- C:\System32
2009-09-04 20:19 <DIR> --d----- C:\Hewlett-Packard
2009-09-04 20:19 <DIR> --d----- C:\webreg
2009-09-04 20:19 <DIR> --d----- C:\English
2009-09-04 20:19 3,198,026 -------- C:\fonts.cab
2009-09-04 20:18 8,873,215 -------- C:\drv9x.cab
2009-09-04 20:18 750,805 -------- C:\all98.cab
2009-09-04 20:18 21,863,770 -------- C:\TOOLBO~1.cab
2009-09-04 20:18 9,040 -------- C:\SETCON~1.cab
2009-09-04 20:18 10,915,512 -------- C:\hp LaserJet 1010 Series.msi
2009-09-04 20:15 12,928 ac------ c:\windows\system32\dllcache\dot4prt.sys
2009-09-04 20:15 12,928 a------- c:\windows\system32\drivers\Dot4Prt.sys
2009-09-04 20:15 206,976 ac------ c:\windows\system32\dllcache\dot4.sys
2009-09-04 20:15 206,976 a------- c:\windows\system32\drivers\Dot4.sys
2009-09-04 20:15 23,808 ac------ c:\windows\system32\dllcache\dot4usb.sys
2009-09-04 20:15 23,808 a------- c:\windows\system32\drivers\Dot4usb.sys
2009-09-04 18:47 2,332,213 a------- c:\windows\hplj1010.his
2009-09-04 18:47 19,561 a------- c:\windows\hplj1010.ini
2009-09-04 18:46 <DIR> --d----- c:\program files\common files\SWF Studio
2009-08-17 23:50 <DIR> --d----- c:\program files\CDex_150
2009-08-17 22:59 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-08-16 14:12 <DIR> --d----- c:\windows\system32\XPSViewer
2009-08-16 14:10 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-16 14:10 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-16 14:10 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-16 14:10 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-08-16 14:10 117,760 -------- c:\windows\system32\prntvpt.dll
2009-08-16 14:10 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-08-16 14:10 <DIR> --d----- C:\4a62495979156612be1eb0
2009-08-16 14:10 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-08-14 20:25 55,656 a------- c:\windows\system32\drivers\avgntflt.sys
2009-08-14 20:25 <DIR> --d----- c:\program files\Avira
2009-08-14 20:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-08-14 13:28 221,184 a------- c:\windows\system32\wmpns.dll
2009-08-13 08:54 <DIR> --d----- c:\program files\Sony
2009-08-13 08:51 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
2009-08-13 08:51 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll
2009-08-11 19:12 <DIR> --d----- c:\program files\Panda Security
2009-08-11 18:01 73,728 a------- c:\windows\system32\javacpl.cpl
2009-08-11 18:01 411,368 a------- c:\windows\system32\deploytk.dll
2009-08-11 13:46 <DIR> --dsh--- c:\documents and settings\administrator\IECompatCache
2009-08-11 13:46 <DIR> --d----- C:\Banques
2009-08-11 13:41 <DIR> --dsh--- c:\documents and settings\administrator\PrivacIE
2009-08-11 13:35 <DIR> --dsh--- c:\documents and settings\administrator\IETldCache
2009-08-11 13:32 <DIR> --d----- c:\windows\ie8updates
2009-08-11 13:29 <DIR> -cd-h--- c:\windows\ie8
2009-08-11 13:27 594,432 -c------ c:\windows\system32\dllcache\msfeeds.dll
2009-08-11 13:27 55,296 -c------ c:\windows\system32\dllcache\msfeedsbs.dll
2009-08-11 13:27 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-08-11 13:27 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-08-11 13:27 1,985,536 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-08-11 13:26 101,376 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-08-11 12:39 <DIR> --d----- C:\Genproc
2009-08-11 10:15 <DIR> --d----- C:\ToolBar SD
2009-08-10 11:36 <DIR> --d----- c:\docume~1\admini~1\applic~1\Canneverbe_Limited

==================== Find3M ====================

2009-08-05 09:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-25 08:25 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-07-17 19:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 10:08 286,720 a------- c:\windows\system32\wmpdxm.dll
2009-07-09 19:53 87,263 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-07-07 23:52 14,037 a------- c:\windows\system32\drivers\mdc8021x.sys
2009-07-07 22:12 21,640 a------- c:\windows\system32\emptyregdb.dat
2009-07-03 17:09 915,456 a------- c:\windows\system32\wininet.dll
2009-06-25 08:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 08:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 08:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 08:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-16 14:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 14:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-12 12:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-10 14:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 06:14 132,096 a------- c:\windows\system32\wkssvc.dll

============= FINISH: 9:46:32.98 ===============

Welcome to the BleepingComputer Forums.

Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again.

• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Please post the contents of log.txt.

Thank you for your patience.

Please see Preparation Guide for use before posting about your potential Malware problem.

If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped.

Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so.

While we are working on your HijackThis log, please:

• Reply to this thread; do not start another!
• Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so.
• Do not run any other tool until instructed to do so!
• Let me know if any of the links do not work or if any of the tools do not work.
• Tell me about problems or symptoms that occur during the fix.
• Do not run any other programs or open any other windows while doing a fix.
• Ask any questions that you have regarding the fix(es), the infection(s), the performance of your computer, etc.

Thanks.

This subject is now closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.