Infected with Rootkit

Working on a hp desktop that was infected with PC-antivirus. During removal of PC-Antivirus and install of ESET the trojan olmairk was found. ESET was unable to remove. Ran Combo Fix multiple times and the following was reported

ComboFix 10-04-12.03 - Owner 04/12/2010 20:54:43.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1011 [GMT -7:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\vdwmg.sys
.
---- Previous Run -------
.
C:\confin.sys
c:\program files\gamevance\gamevancelib32.dll
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTmlmu.dll
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCrctr.dll
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSg.dll
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUtlcn.dll
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\SrchAstt\1.bin\MWSSrcas.dll
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\Guest\Desktop\PCenter.lnk
c:\windows\aBoBOY.exe
c:\windows\ACwqFn.exe
c:\windows\AEIgKke.dll
c:\windows\aieWRFXiL.exe
c:\windows\aiRKAoDC.exe
c:\windows\alAyBL.dll
c:\windows\aTsVh.exe
c:\windows\AVXpd.exe
c:\windows\AWWbL.exe
c:\windows\BcEnVsO.dll
c:\windows\bctaeWOj.dll
c:\windows\bdRMi.exe
c:\windows\bFshUh.dll
c:\windows\BlkiKQxd.exe
c:\windows\BmhbjKin.dll
c:\windows\BowDaCXUj.dll
c:\windows\bPaXA.dll
c:\windows\bPRqYA.dll
c:\windows\BTNmflWF.dll
c:\windows\bUlLGP.exe
c:\windows\BvmyugmX.exe
c:\windows\BwuKKXUc.dll
c:\windows\BYUuOSm.dll
c:\windows\cEFCJEDF.exe
c:\windows\CHrEfqCMW.dll
c:\windows\cibQQMsP.exe
c:\windows\CMOBGdgb.exe
c:\windows\CNnnbk.dll
c:\windows\cOnDbIQN.exe
c:\windows\cqwaB.dll
c:\windows\CTHUuSHwa.exe
c:\windows\ctuAx.dll
c:\windows\CvtOlxa.dll
c:\windows\cwHQOxet.exe
c:\windows\CWvANj.exe
c:\windows\DaEeJn.dll
c:\windows\dcjvDKo.dll
c:\windows\DgfbB.dll
c:\windows\DGkmPt.exe
c:\windows\DLIMWkC.dll
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.0.inf
c:\windows\DOXgGkH.dll
c:\windows\DSWvfq.dll
c:\windows\DVwaTh.exe
c:\windows\DWEJNLp.exe
c:\windows\dYygcWw.exe
c:\windows\edoVtaQk.exe
c:\windows\eEWILqtN.dll
c:\windows\eJAbWCQgM.exe
c:\windows\ElFKBJpW.dll
c:\windows\ENrNEEiup.dll
c:\windows\epSwxDGeE.exe
c:\windows\ErMWn.dll
c:\windows\EWFrLn.dll
c:\windows\FfYmRcg.dll
c:\windows\fICsP.exe
c:\windows\fqAnfjpNl.exe
c:\windows\fsvWuSK.dll
c:\windows\fsYkEW.exe
c:\windows\GasrSAEAf.dll
c:\windows\GDYWYbchA.exe
c:\windows\GmAlHNpX.exe
c:\windows\GmEmbvXyV.exe
c:\windows\GMfUnKOri.dll
c:\windows\gMNtxkt.exe
c:\windows\GqOWFqO.exe
c:\windows\GVbtDnx.dll
c:\windows\GxueA.exe
c:\windows\hBthHq.exe
c:\windows\hFvggKx.dll
c:\windows\hhHmeuhv.exe
c:\windows\HKErfb.dll
c:\windows\hQBMUaAw.exe
c:\windows\HrooS.dll
c:\windows\hSRQm.dll
c:\windows\HvshS.dll
c:\windows\hYyqXW.dll
c:\windows\IEoedF.dll
c:\windows\IiBynTCs.exe
c:\windows\IJECTh.exe
c:\windows\IkxllJG.exe
c:\windows\IMqEs.dll
c:\windows\iuNpxX.dll
c:\windows\JBDdurQJ.exe
c:\windows\jdQAt.exe
c:\windows\jisfjAlIU.dll
c:\windows\jkKVk.dll
c:\windows\jLuQsaL.dll
c:\windows\JyUDOH.dll
c:\windows\kbnNrCRXd.dll
c:\windows\kExRIbilD.dll
c:\windows\kGwEn.dll
c:\windows\KIQnda.exe
c:\windows\klDhghSB.exe
c:\windows\KlNMhbFC.dll
c:\windows\KQntFGB.exe
c:\windows\LancRSJRj.dll
c:\windows\LbAngpuX.dll
c:\windows\LbckHBm.exe
c:\windows\LjLXNoE.exe
c:\windows\lkDucAV.dll
c:\windows\LmOsQ.dll
c:\windows\lPFESNW.dll
c:\windows\LuGqwuRJ.exe
c:\windows\mFDFLsXvY.exe
c:\windows\MfloBngl.exe
c:\windows\MgeNXuk.dll
c:\windows\MHCIWOl.dll
c:\windows\mjTsaubx.exe
c:\windows\mKkCDXB.exe
c:\windows\MMtqylGm.exe
c:\windows\MmxfHmRHi.dll
c:\windows\mnSuuux.dll
c:\windows\mnwpBfUK.dll
c:\windows\mspNWcBDY.dll
c:\windows\MyejgqHc.exe
c:\windows\naqmXFhrO.exe
c:\windows\NcjAH.dll
c:\windows\ncQoDjWV.dll
c:\windows\nCwvSRW.dll
c:\windows\NDiNt.dll
c:\windows\neEUETb.exe
c:\windows\nMaRi.dll
c:\windows\nrqWCrvVg.dll
c:\windows\NtaAWRdD.dll
c:\windows\ObqIi.dll
c:\windows\oDqeQcrfd.exe
c:\windows\ogPsagpeG.dll
c:\windows\OjUortcp.dll
c:\windows\oRpgGjH.dll
c:\windows\oxrNeokO.exe
c:\windows\pCKyb.dll
c:\windows\pdmyXmLy.dll
c:\windows\PeeXtxBw.dll
c:\windows\ptxKM.exe
c:\windows\PVbQGApeb.dll
c:\windows\pvilXrRJB.exe
c:\windows\qEdiYwOJq.dll
c:\windows\qIPIafWg.dll
c:\windows\qkVuQu.dll
c:\windows\QNQcNE.exe
c:\windows\qrWAKD.dll
c:\windows\QuSNcvLlT.exe
c:\windows\QvjxNdnxn.dll
c:\windows\QYGbH.exe
c:\windows\rdtRM.dll
c:\windows\RFrfb.dll
c:\windows\rGBfp.exe
c:\windows\rNXRdLwbE.dll
c:\windows\rWFNxYFMv.dll
c:\windows\rwlPnm.dll
c:\windows\rwOrDpkFf.dll
c:\windows\RxQMdVW.dll
c:\windows\rybDkM.dll
c:\windows\ryysnM.exe
c:\windows\sGnXd.dll
c:\windows\sHHEYF.exe
c:\windows\SIjBPLR.exe
c:\windows\SjmwggUPQ.exe
c:\windows\SOAodDyg.exe
c:\windows\SoJgg.dll
c:\windows\SqaDULOHG.dll
c:\windows\sQjPIL.dll
c:\windows\StjgY.exe
c:\windows\SUbhSJyPw.dll
c:\windows\system32\Alsmb.dll
c:\windows\system32\bLiRlnnSV.exe
c:\windows\system32\cEImCTJRF.dll
c:\windows\system32\cJRxQs.exe
c:\windows\system32\dbNWmOOt.exe
c:\windows\system32\DpQnIdJCC.dll
c:\windows\system32\drivers\Apkfx.exe
c:\windows\system32\drivers\axdSvKvq.exe
c:\windows\system32\drivers\bayRCK.exe
c:\windows\system32\drivers\bHGJCNH.exe
c:\windows\system32\drivers\BsfdU.exe
c:\windows\system32\drivers\CBvFdi.exe
c:\windows\system32\drivers\CGEaYniTN.exe
c:\windows\system32\drivers\cgwciqTD.dll
c:\windows\system32\drivers\DlnuO.exe
c:\windows\system32\drivers\dlPrHIJlR.dll
c:\windows\system32\drivers\DuJWe.exe
c:\windows\system32\drivers\eHElA.exe
c:\windows\system32\drivers\EOHNcCvIc.dll
c:\windows\system32\drivers\eVbUmPIB.exe
c:\windows\system32\drivers\fDAoQlMvc.exe
c:\windows\system32\drivers\FEpYPWufp.exe
c:\windows\system32\drivers\FSfvKf.exe
c:\windows\system32\drivers\gDpLpEtb.exe
c:\windows\system32\drivers\GjpWRYhSW.dll
c:\windows\system32\drivers\gnhovQTd.dll
c:\windows\system32\drivers\GouUA.dll
c:\windows\system32\drivers\grbjUlnI.dll
c:\windows\system32\drivers\HmKdBGu.dll
c:\windows\system32\drivers\hYGbkEFY.dll
c:\windows\system32\drivers\iLUwyC.dll
c:\windows\system32\drivers\iqhCKe.dll
c:\windows\system32\drivers\IqikD.dll
c:\windows\system32\drivers\IrtqxCxER.exe
c:\windows\system32\drivers\IsNJQgxN.dll
c:\windows\system32\drivers\jurYgIhyA.dll
c:\windows\system32\drivers\KBQyev.dll
c:\windows\system32\drivers\kJHtb.dll
c:\windows\system32\drivers\LssEiUU.exe
c:\windows\system32\drivers\lVYhJ.exe
c:\windows\system32\drivers\mhWGUpCtF.exe
c:\windows\system32\drivers\NLthwux.exe
c:\windows\system32\drivers\NOBpmAwC.dll
c:\windows\system32\drivers\NWLUDyJ.exe
c:\windows\system32\drivers\OBoIEXh.dll
c:\windows\system32\drivers\okFce.exe
c:\windows\system32\drivers\OwTTa.dll
c:\windows\system32\drivers\Pekfje.exe
c:\windows\system32\drivers\pxAvDtF.dll
c:\windows\system32\drivers\RCIkQUl.dll
c:\windows\system32\drivers\RPAqNk.exe
c:\windows\system32\drivers\rqfNAolQ.dll
c:\windows\system32\drivers\RrbQfW.exe
c:\windows\system32\drivers\SwqAC.exe
c:\windows\system32\drivers\ToMPW.exe
c:\windows\system32\drivers\UGhWrYV.dll
c:\windows\system32\drivers\UHFNH.exe
c:\windows\system32\drivers\urumEXI.dll
c:\windows\system32\drivers\USqYa.dll
c:\windows\system32\drivers\uWEAJ.dll
c:\windows\system32\drivers\vkjNEsil.exe
c:\windows\system32\drivers\VKrLBP.exe
c:\windows\system32\drivers\vpEswj.dll
c:\windows\system32\drivers\WIjxix.dll
c:\windows\system32\drivers\WmSSidd.dll
c:\windows\system32\drivers\wTeQfAp.exe
c:\windows\system32\drivers\XJLwjrlg.dll
c:\windows\system32\drivers\XlpRuVTAt.dll
c:\windows\system32\drivers\XMRMg.exe
c:\windows\system32\drivers\YcEwJm.dll
c:\windows\system32\drivers\yHDPIVHoK.exe
c:\windows\system32\drivers\YmMmTp.exe
c:\windows\system32\dWSfauoQR.exe
c:\windows\system32\EtcywDS.exe
c:\windows\system32\EXsbtWpIH.dll
c:\windows\system32\EYHKBEIaw.exe
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\FflyJnuqM.exe
c:\windows\system32\FSkCVDr.dll
c:\windows\system32\GNWmbLxO.dll
c:\windows\system32\GYmXpVctu.exe
c:\windows\system32\haIEDoo.exe
c:\windows\system32\Hnhynm.dll
c:\windows\system32\iIKwxNH.exe
c:\windows\system32\iMxDWqEs.exe
c:\windows\system32\JaITQOq.exe
c:\windows\system32\jeecD.dll
c:\windows\system32\jQEkBD.dll
c:\windows\system32\JsepJ.dll
c:\windows\system32\KfgUbFp.exe
c:\windows\system32\KQfmQEg.exe
c:\windows\system32\kVewPVOce.exe
c:\windows\system32\KxKFtVmey.exe
c:\windows\system32\KyEmlPssf.dll
c:\windows\system32\LdRhd.exe
c:\windows\system32\LdUlgii.exe
c:\windows\system32\mfIOYAjiu.dll
c:\windows\system32\mhIfWVE.dll
c:\windows\system32\NFVSFYYyw.dll
c:\windows\system32\nuJahaCQY.dll
c:\windows\system32\NunwKfnMj.exe
c:\windows\system32\oRuoTJ.exe
c:\windows\system32\PbXCbjtkl.exe
c:\windows\system32\pJnjJp.dll
c:\windows\system32\PLsXNMoN.exe
c:\windows\system32\POvQvfQdD.dll
c:\windows\system32\qPWHlJPK.exe
c:\windows\system32\QvBbORrs.exe
c:\windows\system32\RIEiN.exe
c:\windows\system32\rTqiQC.dll
c:\windows\system32\SAaPCvjmS.exe
c:\windows\system32\smbeMaT.dll
c:\windows\system32\spool\prtprocs\w32x86\000054d4.tmp
c:\windows\system32\spool\prtprocs\w32x86\00006090.tmp
c:\windows\system32\SRkteJW.exe
c:\windows\system32\TNEfD.exe
c:\windows\system32\uePPYo.dll
c:\windows\system32\ufmei.exe
c:\windows\system32\UUPvV.dll
c:\windows\system32\UYQpq.exe
c:\windows\system32\vhSDwTDd.exe
c:\windows\system32\VIvKoHI.exe
c:\windows\system32\vvamV.dll
c:\windows\system32\WDxYsvcw.exe
c:\windows\system32\wlhDHmqA.dll
c:\windows\system32\wrlBtWaCm.dll
c:\windows\system32\WUFHhn.dll
c:\windows\system32\WwBaKmmU.dll
c:\windows\system32\xdEJYjxfr.exe
c:\windows\system32\XmrxDEw.dll
c:\windows\system32\xmVuFFFKo.dll
c:\windows\system32\XNhHBT.dll
c:\windows\system32\xQmxoNQhx.exe
c:\windows\system32\XSqQtUM.exe
c:\windows\system32\xXYTbpHx.exe
c:\windows\system32\YGEYvFEI.dll
c:\windows\system32\yobsK.exe
c:\windows\system32\YrCbPf.exe
c:\windows\system32\yrWvB.exe
c:\windows\system32\yVklpPH.exe
c:\windows\SyVFdrY.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
c:\windows\TfLWCVfIn.exe
c:\windows\ThvWLKI.dll
c:\windows\TiNfWBk.exe
c:\windows\trqpIp.dll
c:\windows\trtii.exe
c:\windows\tuBsKtF.dll
c:\windows\tVGAWiY.exe
c:\windows\UamIQxQ.exe
c:\windows\UBhroskt.exe
c:\windows\UCHIVhf.exe
c:\windows\ueWkVGwq.exe
c:\windows\ujOUBm.exe
c:\windows\Ukmcci.exe
c:\windows\UmTKHPH.dll
c:\windows\UMYKA.dll
c:\windows\unfkWSOvv.dll
c:\windows\uNYRDw.dll
c:\windows\UROWLt.dll
c:\windows\USHKvmC.exe
c:\windows\utvNdJyG.exe
c:\windows\UTxHW.dll
c:\windows\uvJtYT.exe
c:\windows\UVqJIl.exe
c:\windows\UVrYKJu.dll
c:\windows\uyFtLrR.exe
c:\windows\uYyXRKTH.dll
c:\windows\vAItvFl.exe
c:\windows\vCJoFNrO.exe
c:\windows\VcnhIw.dll
c:\windows\vgChmSgkP.dll
c:\windows\VGjAxAB.exe
c:\windows\vHmySf.dll
c:\windows\vJDPFfKE.exe
c:\windows\VKkBGb.exe
c:\windows\vlCiuQmy.dll
c:\windows\VljOHsOw.dll
c:\windows\VPxKDOGG.dll
c:\windows\vsOsWdMoL.exe
c:\windows\vYnbVNHq.exe
c:\windows\WDvsOoApS.dll
c:\windows\wESVIwq.dll
c:\windows\wfvVhOw.dll
c:\windows\WJDNkXt.dll
c:\windows\wPnUmwAsy.exe
c:\windows\wpTmBvJC.dll
c:\windows\WqlxRXm.exe
c:\windows\wslxtILF.exe
c:\windows\WTvkfqaf.dll
c:\windows\wxnfHKQIg.dll
c:\windows\XGHkNy.dll
c:\windows\XKSuWwp.dll
c:\windows\XpSXLaHWu.dll
c:\windows\xpVkh.dll
c:\windows\xQbSXiGxa.dll
c:\windows\xvBtT.exe
c:\windows\XvTjDR.dll
c:\windows\YaKLVLdeK.exe
c:\windows\YCUFPFgGA.dll
c:\windows\YFleDIswE.dll
c:\windows\yHyHcGvsd.dll
c:\windows\ymRVhgELR.dll
c:\windows\YnCygnWt.exe
c:\windows\ynTXeMo.dll
c:\windows\YqkHDO.dll
c:\windows\ySKKstGpb.dll
c:\windows\ySLwyKf.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MyWebSearchService
-------\Service_ssko


((((((((((((((((((((((((( Files Created from 2010-03-13 to 2010-04-13 )))))))))))))))))))))))))))))))
.

2010-04-13 04:04 . 2010-04-13 04:04 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-04-13 04:04 . 2010-04-13 04:04 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-04-13 04:04 . 2010-04-13 04:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-03-30 07:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:30 . 2010-03-30 07:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
2010-04-10 18:48 . 2010-04-10 18:50 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:47 . 2010-04-10 18:48 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-06 03:38 . 2010-04-06 03:43 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus
2010-03-31 04:50 . 2010-03-31 04:50 -------- d-----w- c:\program files\AV7
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:29 . 2010-03-24 10:54 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:42 . 2010-03-16 03:43 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:27 . 2010-03-16 03:28 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-12 04:06 . 2008-12-18 00:03 -------- d-----w- c:\programdata\Google Updater
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-23 08:24 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-03-23 08:24 . 2010-03-02 07:13 -------- d-----w- c:\program files\Shutter Island
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2006-12-06 21:34 -------- d-----w- c:\program files\Symantec
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-23 08:24 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-16 08:13 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-03-10 07:27 . 2009-11-26 03:28 -------- d-----w- c:\program files\Escape the Museum 2
2010-03-02 08:00 . 2010-03-02 08:00 -------- d-----w- c:\users\Owner\AppData\Roaming\Merscom
2010-03-02 08:00 . 2010-03-02 08:00 -------- d-----w- c:\programdata\Merscom
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-26 05:20 . 2010-02-25 00:49 -------- d-----w- c:\programdata\STOPzilla!
2010-02-26 04:38 . 2010-02-26 01:00 9128 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-02-25 00:50 . 2010-02-25 00:50 -------- d-----w- c:\programdata\SITEguard
2010-02-25 00:49 . 2010-02-25 00:49 -------- d-----w- c:\program files\Common Files\iS3
2010-02-23 22:23 . 2009-12-19 21:32 680 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-02-20 07:03 . 2007-03-11 23:40 -------- d-----w- c:\users\Owner\AppData\Roaming\Apple Computer
2010-02-20 06:58 . 2007-07-10 02:09 -------- d-----w- c:\programdata\Apple
2010-02-20 06:58 . 2010-02-20 06:58 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-02-18 07:49 . 2008-03-14 07:04 -------- d-----w- c:\programdata\JollyBear
2010-02-18 07:49 . 2010-02-18 07:49 -------- d-----w- c:\program files\Big City Adventure - Vancouver
2010-02-18 06:40 . 2010-02-18 06:40 -------- d-----w- c:\users\Owner\AppData\Roaming\Gestalt Games
2010-02-17 09:16 . 2010-02-16 08:37 -------- d-----w- c:\program files\Oberon Media
2010-02-17 08:13 . 2010-02-17 08:13 -------- d-----w- c:\programdata\GamersDigital
2010-02-17 08:13 . 2010-02-17 08:13 -------- d-----w- c:\users\Owner\AppData\Roaming\GamersDigital
2010-02-17 05:54 . 2010-02-17 05:54 -------- d-----w- c:\users\Owner\AppData\Roaming\Oberonv1001
2010-02-16 09:47 . 2010-02-16 09:47 -------- d-----w- c:\users\Owner\AppData\Roaming\Oberonv1002
2010-02-16 09:47 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-02-16 09:47 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Oberon Media
2010-02-16 08:38 . 2010-02-16 08:38 -------- d-----w- c:\users\Owner\AppData\Roaming\Pogo Games
2010-01-19 08:04 . 2010-01-19 08:04 64 ----a-w- c:\windows\GPlrLanc.dat
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-18 39408]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*LogMeInRescue_1246134705"="c:\windows\LMIFA26.tmp\lmi_rescue.exe" [2010-04-13 1874808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-25 44136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2009-12-01 1751552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 22:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Exetender]
2009-12-01 03:51 1751552 ------w- c:\program files\Free Ride Games\GPlayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-23 03:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:80,a9,f0,44,49,27,ca,01

R2 gupdate1c960a746915933;Google Update Service (gupdate1c960a746915933);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S2 X4HS32Ex;X4HS32Ex;c:\program files\Free Ride Games\X4HS32Ex.Sys [2009-04-07 53280]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]
S3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-04-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-18 04:59]

2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-18 08:23]

2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-18 08:23]

2010-03-18 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]

2010-04-13 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-01-21 04:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-12 21:16
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x909938C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x82fb5d24
\Driver\ACPI -> acpi.sys @ 0x80610d68
\Driver\atapi -> ataport.SYS @ 0x8071fa2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(808)
c:\program files\Verizon\SmartBridge\SBHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
c:\windows\RtHDVCpl.exe
c:\program files\Verizon\SmartBridge\MotiveSB.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TVHH72XG\Support-LogMeInRescue[1].exe
.
**************************************************************************
.
Completion time: 2010-04-12 21:24:45 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-13 04:24

Pre-Run: 178,221,404,160 bytes free
Post-Run: 178,390,859,776 bytes free

- - End Of File - - 71F491EB2EC6756B1DFD2FA214BEC106
ComboFix 10-04-19.08 - Owner 04/20/2010 16:07:49.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.892 [GMT -7:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\asam.exe
c:\windows\system32\%appdata%

.
((((((((((((((((((((((((( Files Created from 2010-03-20 to 2010-04-20 )))))))))))))))))))))))))))))))
.

2010-04-20 23:19 . 2010-04-20 23:21 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-04-20 23:19 . 2010-04-20 23:19 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-04-20 23:19 . 2010-04-20 23:19 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-04-20 23:19 . 2010-04-20 23:19 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-04-20 23:19 . 2010-04-20 23:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-20 22:59 . 2010-04-20 23:02 -------- d-----w- C:\32788R22FWJFW
2010-04-20 07:55 . 2010-04-20 07:55 60672 ----a-w- c:\users\Owner\AppData\Local\syssvc.exe
2010-04-20 07:53 . 2010-04-20 07:53 -------- d-----w- c:\users\Owner\AppData\Local\pifshtxri
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-04-14 20:37 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 20:37 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 20:36 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 20:14 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 20:13 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 20:13 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 20:13 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 20:12 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 20:12 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 20:19 . 2010-04-15 22:11 -------- d-----w- c:\programdata\Yahoo! Companion
2010-04-13 12:58 . 2010-04-13 12:58 -------- d-----w- c:\users\Owner\AppData\Local\ESET
2010-04-13 06:47 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-04-13 06:46 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-04-13 06:46 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-04-13 06:46 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-04-13 06:46 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-04-13 06:46 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-04-13 06:46 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-04-13 06:46 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-04-13 06:46 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-04-13 04:19 . 2010-04-13 04:20 -------- d-----w- c:\windows\LMIFA26.tmp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-03-30 07:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:30 . 2010-03-30 07:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
2010-04-10 18:48 . 2010-04-10 18:50 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:47 . 2010-04-10 18:48 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-06 03:38 . 2010-04-06 03:43 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus
2010-03-31 04:50 . 2010-03-31 04:50 -------- d-----w- c:\program files\AV7
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:29 . 2010-03-24 10:54 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-19 22:16 . 2008-12-18 00:03 -------- d-----w- c:\programdata\Google Updater
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-18 22:11 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-15 22:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-23 08:24 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-03-23 08:24 . 2010-03-02 07:13 -------- d-----w- c:\program files\Shutter Island
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2006-12-06 21:34 -------- d-----w- c:\program files\Symantec
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-23 08:24 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-16 08:13 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:43 . 2010-03-16 03:42 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:28 . 2010-03-16 03:27 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
2010-03-10 07:27 . 2009-11-26 03:28 -------- d-----w- c:\program files\Escape the Museum 2
2010-03-02 08:00 . 2010-03-02 08:00 -------- d-----w- c:\users\Owner\AppData\Roaming\Merscom
2010-03-02 08:00 . 2010-03-02 08:00 -------- d-----w- c:\programdata\Merscom
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-26 05:20 . 2010-02-25 00:49 -------- d-----w- c:\programdata\STOPzilla!
2010-02-26 04:38 . 2010-02-26 01:00 9128 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-02-25 00:50 . 2010-02-25 00:50 -------- d-----w- c:\programdata\SITEguard
2010-02-25 00:49 . 2010-02-25 00:49 -------- d-----w- c:\program files\Common Files\iS3
2010-02-23 22:23 . 2009-12-19 21:32 680 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-20 07:03 . 2007-03-11 23:40 -------- d-----w- c:\users\Owner\AppData\Roaming\Apple Computer
2010-02-20 06:58 . 2007-07-10 02:09 -------- d-----w- c:\programdata\Apple
2010-02-20 06:58 . 2010-02-20 06:58 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-02-02 06:11 . 2010-02-02 06:11 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-18 39408]
"pjhstuqd"="c:\users\Owner\AppData\Local\pifshtxri\msektirtssd.exe" [2010-04-20 271616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-25 44136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2009-12-01 1751552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 22:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Exetender]
2009-12-01 03:51 1751552 ------w- c:\program files\Free Ride Games\GPlayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-23 03:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:80,a9,f0,44,49,27,ca,01

R2 gupdate1c960a746915933;Google Update Service (gupdate1c960a746915933);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-03-30 38224]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S2 X4HS32Ex;X4HS32Ex;c:\program files\Free Ride Games\X4HS32Ex.Sys [2009-04-07 53280]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]
S3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-04-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-18 04:59]

2010-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-18 08:23]

2010-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-18 08:23]

2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]

2010-04-20 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-asam - c:\windows\asam.exe
HKLM-Run-asam - c:\windows\asam.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-20 16:22
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x908168C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x82fb8d24
\Driver\ACPI -> acpi.sys @ 0x80614d68
\Driver\atapi -> ataport.SYS @ 0x80723a2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3076)
c:\program files\Verizon\SmartBridge\SBHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
c:\windows\RtHDVCpl.exe
c:\program files\Verizon\SmartBridge\MotiveSB.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-04-20 16:32:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-20 23:32
ComboFix2.txt 2010-04-13 04:24

Pre-Run: 173,452,787,712 bytes free
Post-Run: 173,531,877,376 bytes free

- - End Of File - - 07EA5F5C6B359DE16969B1B331A21438
ComboFix 10-04-29.05 - Owner 05/04/2010 19:08:31.5.2 - x86
Running from: c:\users\Owner\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\%appdata%

.
((((((((((((((((((((((((( Files Created from 2010-04-05 to 2010-05-05 )))))))))))))))))))))))))))))))
.

2010-05-05 02:23 . 2010-05-05 02:27 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-05 02:23 . 2010-05-05 02:23 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-05-05 02:23 . 2010-05-05 02:23 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-05 02:23 . 2010-05-05 02:23 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-05-05 02:23 . 2010-05-05 02:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-05 01:57 . 2010-05-05 02:01 -------- d-----w- C:\32788R22FWJFW
2010-05-04 23:17 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-04 23:17 . 2010-05-04 23:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-04 23:17 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-03 07:43 . 2010-05-03 07:43 -------- d-----w- c:\users\Owner\AppData\Local\kbxmiurjx
2010-04-27 01:01 . 2010-04-27 01:01 -------- d-----w- c:\program files\iPod
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\program files\iTunes
2010-04-27 00:54 . 2010-04-27 00:54 -------- d-----w- c:\program files\Bonjour
2010-04-23 07:57 . 2010-04-23 07:57 -------- d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55 . 2010-04-22 23:55 -------- d-----w- c:\users\Owner\AppData\Roaming\Arkadium
2010-04-22 06:52 . 2010-04-22 07:37 -------- d-----w- c:\users\Owner\AppData\Local\Brain Games Mahjongg Files
2010-04-22 05:31 . 2010-04-22 05:31 -------- d-----w- c:\programdata\Casual Box
2010-04-20 23:46 . 2010-04-20 23:47 -------- d-----w- c:\windows\LMICABD.tmp
2010-04-20 07:53 . 2010-04-23 20:50 -------- d-----w- c:\users\Owner\AppData\Local\pifshtxri
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-04-14 20:37 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 20:37 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 20:36 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 20:14 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 20:13 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 20:13 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 20:13 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 20:12 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 20:12 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 12:58 . 2010-04-13 12:58 -------- d-----w- c:\users\Owner\AppData\Local\ESET
2010-04-13 06:47 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-04-13 06:46 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-04-13 06:46 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-04-13 06:46 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-04-13 06:46 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-04-13 06:46 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-04-13 06:46 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-04-13 06:46 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-04-13 06:46 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-04-13 04:19 . 2010-04-13 04:20 -------- d-----w- c:\windows\LMIFA26.tmp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
2010-04-10 18:48 . 2010-04-10 18:50 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:47 . 2010-04-10 18:48 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-06 03:38 . 2010-04-06 03:43 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-04 23:08 . 2009-12-19 21:32 1356 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-03 08:53 . 2006-12-06 21:09 -------- d-----w- c:\program files\HP Games
2010-05-03 08:53 . 2006-12-06 21:12 -------- d-----w- c:\programdata\WildTangent
2010-04-27 01:01 . 2007-07-10 02:09 -------- d-----w- c:\program files\Common Files\Apple
2010-04-27 00:59 . 2008-10-18 03:47 -------- d-----w- c:\program files\QuickTime
2010-04-27 00:48 . 2010-04-27 00:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-23 07:54 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-04-22 18:34 . 2006-12-06 21:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-22 05:18 . 2009-03-22 06:23 -------- d-----w- c:\program files\bfgclient
2010-04-22 05:09 . 2006-12-06 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-21 02:07 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-21 01:55 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-04-21 01:49 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-04-21 01:45 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-15 22:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-31 04:50 . 2010-03-31 04:50 -------- d-----w- c:\program files\AV7
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:54 . 2010-03-24 10:29 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:43 . 2010-03-16 03:42 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:28 . 2010-03-16 03:27 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
2010-03-10 07:27 . 2009-11-26 03:28 -------- d-----w- c:\program files\Escape the Museum 2
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"vboabmjq"="c:\users\Owner\AppData\Local\kbxmiurjx\jhfofuatssd.exe" [2010-05-03 259328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:80,a9,f0,44,49,27,ca,01

R3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]

2010-05-05 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
MSConfigStartUp-AppleSyncNotifier - c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
MSConfigStartUp-Exetender - c:\program files\Free Ride Games\GPlayer.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-04 19:27
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x879428C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x82fb9d24
\Driver\ACPI -> acpi.sys @ 0x80614d68
\Driver\atapi -> ataport.SYS @ 0x80723a2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3532)
c:\program files\Verizon\SmartBridge\SBHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Verizon\SmartBridge\MotiveSB.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-05-04 19:37:42 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-05 02:37
ComboFix2.txt 2010-04-20 23:34
ComboFix3.txt 2010-04-13 04:24

Pre-Run: 185,969,635,328 bytes free
Post-Run: 186,005,155,840 bytes free

- - End Of File - - E44744FF8E6A15B09F6667F6D43007FE
ComboFix 10-04-29.05 - Owner 05/04/2010 22:05:50.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1344 [GMT -7:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2010-04-05 to 2010-05-05 )))))))))))))))))))))))))))))))
.

2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-05 04:46 . 2010-05-05 04:46 -------- d-----w- c:\program files\trend micro
2010-05-05 04:46 . 2010-05-05 04:46 -------- d-----w- C:\rsit
2010-05-04 23:17 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-04 23:17 . 2010-05-04 23:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-04 23:17 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 01:01 . 2010-04-27 01:01 -------- d-----w- c:\program files\iPod
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\program files\iTunes
2010-04-27 00:54 . 2010-04-27 00:54 -------- d-----w- c:\program files\Bonjour
2010-04-27 00:48 . 2010-04-27 00:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-23 07:57 . 2010-04-23 07:57 -------- d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55 . 2010-04-22 23:55 -------- d-----w- c:\users\Owner\AppData\Roaming\Arkadium
2010-04-22 06:52 . 2010-04-22 07:37 -------- d-----w- c:\users\Owner\AppData\Local\Brain Games Mahjongg Files
2010-04-22 05:31 . 2010-04-22 05:31 -------- d-----w- c:\programdata\Casual Box
2010-04-20 23:46 . 2010-04-20 23:47 -------- d-----w- c:\windows\LMICABD.tmp
2010-04-20 07:53 . 2010-04-23 20:50 -------- d-----w- c:\users\Owner\AppData\Local\pifshtxri
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-04-14 20:37 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 20:37 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 20:36 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 20:14 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 20:13 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 20:13 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 20:13 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 20:12 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 20:12 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 12:58 . 2010-04-13 12:58 -------- d-----w- c:\users\Owner\AppData\Local\ESET
2010-04-13 06:47 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-04-13 06:46 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-04-13 06:46 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-04-13 06:46 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-04-13 06:46 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-04-13 06:46 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-04-13 06:46 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-04-13 06:46 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-04-13 06:46 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-04-13 04:19 . 2010-04-13 04:20 -------- d-----w- c:\windows\LMIFA26.tmp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
2010-04-10 18:48 . 2010-04-10 18:50 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:47 . 2010-04-10 18:48 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-06 03:38 . 2010-04-06 03:43 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-05 02:50 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys.copy
2010-05-05 02:50 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys
2010-05-04 23:08 . 2009-12-19 21:32 1356 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-03 08:53 . 2006-12-06 21:09 -------- d-----w- c:\program files\HP Games
2010-05-03 08:53 . 2006-12-06 21:12 -------- d-----w- c:\programdata\WildTangent
2010-04-27 01:01 . 2007-07-10 02:09 -------- d-----w- c:\program files\Common Files\Apple
2010-04-27 00:59 . 2008-10-18 03:47 -------- d-----w- c:\program files\QuickTime
2010-04-23 07:54 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-04-22 18:34 . 2006-12-06 21:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-22 05:18 . 2009-03-22 06:23 -------- d-----w- c:\program files\bfgclient
2010-04-22 05:09 . 2006-12-06 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-21 02:07 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-21 01:55 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-04-21 01:49 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-04-21 01:45 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-15 22:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-31 04:50 . 2010-03-31 04:50 -------- d-----w- c:\program files\AV7
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:54 . 2010-03-24 10:29 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:43 . 2010-03-16 03:42 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:28 . 2010-03-16 03:27 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
2010-03-10 07:27 . 2009-11-26 03:28 -------- d-----w- c:\program files\Escape the Museum 2
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:80,a9,f0,44,49,27,ca,01

R3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]

2010-05-05 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-04 22:20
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x873BC8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x87bbad24
\Driver\ACPI -> acpi.sys @ 0x82613d68
\Driver\atapi -> ataport.SYS @ 0x82722a2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-05-04 22:23:30
ComboFix-quarantined-files.txt 2010-05-05 05:23
ComboFix2.txt 2010-05-05 02:37
ComboFix3.txt 2010-04-20 23:34
ComboFix4.txt 2010-04-13 04:24

Pre-Run: 185,900,961,792 bytes free
Post-Run: 185,872,973,824 bytes free

- - End Of File - - 74189462C5A3365339548A20C25E989E
ComboFix 10-05-10.05 - Owner 05/11/2010 20:56:19.7.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1357 [GMT -7:00]
Running from: F:\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\AV7
c:\program files\AV7\antivirus7.exe.tmp1
c:\users\Owner\GoToAssistDownloadHelper.exe

.
((((((((((((((((((((((((( Files Created from 2010-04-12 to 2010-05-12 )))))))))))))))))))))))))))))))
.

2010-05-12 04:08 . 2010-05-12 04:09 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-12 04:08 . 2010-05-12 04:08 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-05-12 04:08 . 2010-05-12 04:08 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-12 04:08 . 2010-05-12 04:08 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-05-12 04:08 . 2010-05-12 04:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-12 03:42 . 2010-05-12 03:44 -------- d-----w- C:\32788R22FWJFW
2010-05-12 03:31 . 2010-05-12 03:31 -------- d-----w- c:\program files\CCleaner
2010-05-12 02:36 . 2010-05-12 02:36 93056 ----a-w- C:\kwlcapow.sys
2010-05-05 04:46 . 2010-05-05 04:46 -------- d-----w- c:\program files\trend micro
2010-05-05 04:46 . 2010-05-05 04:46 -------- d-----w- C:\rsit
2010-05-04 23:17 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-04 23:17 . 2010-05-04 23:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-04 23:17 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 01:01 . 2010-04-27 01:01 -------- d-----w- c:\program files\iPod
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\program files\iTunes
2010-04-27 00:54 . 2010-04-27 00:54 -------- d-----w- c:\program files\Bonjour
2010-04-27 00:48 . 2010-04-27 00:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-23 07:57 . 2010-04-23 07:57 -------- d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55 . 2010-04-22 23:55 -------- d-----w- c:\users\Owner\AppData\Roaming\Arkadium
2010-04-22 06:52 . 2010-04-22 07:37 -------- d-----w- c:\users\Owner\AppData\Local\Brain Games Mahjongg Files
2010-04-22 05:31 . 2010-04-22 05:31 -------- d-----w- c:\programdata\Casual Box
2010-04-20 23:46 . 2010-04-20 23:47 -------- d-----w- c:\windows\LMICABD.tmp
2010-04-20 07:53 . 2010-04-23 20:50 -------- d-----w- c:\users\Owner\AppData\Local\pifshtxri
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-04-14 20:37 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 20:37 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 20:36 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 20:14 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 20:13 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 20:13 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 20:13 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 20:12 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 20:12 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 12:58 . 2010-04-13 12:58 -------- d-----w- c:\users\Owner\AppData\Local\ESET
2010-04-13 06:47 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-04-13 06:46 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-04-13 06:46 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-04-13 06:46 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-04-13 06:46 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-04-13 06:46 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-04-13 06:46 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-04-13 06:46 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-04-13 06:46 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-04-13 04:19 . 2010-04-13 04:20 -------- d-----w- c:\windows\LMIFA26.tmp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-12 03:26 . 2009-12-19 21:32 1356 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-05 05:30 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys
2010-05-05 02:50 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys.copy
2010-05-03 08:53 . 2006-12-06 21:09 -------- d-----w- c:\program files\HP Games
2010-05-03 08:53 . 2006-12-06 21:12 -------- d-----w- c:\programdata\WildTangent
2010-04-27 01:01 . 2007-07-10 02:09 -------- d-----w- c:\program files\Common Files\Apple
2010-04-27 00:59 . 2008-10-18 03:47 -------- d-----w- c:\program files\QuickTime
2010-04-23 07:54 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-04-22 18:34 . 2006-12-06 21:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-22 05:18 . 2009-03-22 06:23 -------- d-----w- c:\program files\bfgclient
2010-04-22 05:09 . 2006-12-06 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-21 02:07 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-21 01:55 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-04-21 01:49 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-04-21 01:45 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-15 22:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-10 18:50 . 2010-04-10 18:48 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:48 . 2010-04-10 18:47 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-06 03:43 . 2010-04-06 03:38 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:54 . 2010-03-24 10:29 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:43 . 2010-03-16 03:42 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:28 . 2010-03-16 03:27 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-05-05_05.20.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-11-02 07:28 . 2006-11-02 08:48 84480 c:\windows\winsxs\x86_microsoft-windows-mail-comm-dll_31bf3856ad364e35_6.0.6002.18197_none_7b3d56a455f59b03\INETRES.dll
+ 2006-11-02 07:28 . 2006-11-02 08:48 84480 c:\windows\winsxs\x86_microsoft-windows-mail-comm-dll_31bf3856ad364e35_6.0.6001.18416_none_79ac63d2588f4d00\INETRES.dll
+ 2006-12-06 21:46 . 2010-05-12 03:55 79922 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2010-05-12 03:55 86144 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-02-10 04:32 . 2010-05-12 03:55 23316 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3889443645-261564860-3365275697-1000_UserData.bin
- 2007-02-10 04:32 . 2010-05-05 05:05 23316 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3889443645-261564860-3365275697-1000_UserData.bin
+ 2007-02-10 03:43 . 2010-05-12 04:03 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-02-10 03:43 . 2010-05-03 19:07 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-02-10 03:43 . 2010-05-12 04:03 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-02-10 03:43 . 2010-05-03 19:07 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-02-11 06:24 . 2010-05-05 04:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-02-11 06:24 . 2010-05-12 03:27 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-02-11 06:24 . 2010-05-05 04:42 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-02-11 06:24 . 2010-05-12 03:27 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-02-11 06:24 . 2010-05-12 03:27 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-02-11 06:24 . 2010-05-05 04:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-05-05 05:03 . 2010-05-05 05:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-05-12 03:53 . 2010-05-12 03:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-05-12 03:53 . 2010-05-12 03:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-05-05 05:03 . 2010-05-05 05:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2006-11-02 10:33 . 2010-05-05 05:11 595446 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2010-05-12 04:00 595446 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-05-05 05:11 101144 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2010-05-12 04:00 101144 c:\windows\System32\perfc009.dat
- 2007-02-10 03:43 . 2010-05-03 19:07 147456 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-02-10 03:43 . 2010-05-12 04:03 147456 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2006-11-02 12:34 . 2006-11-02 12:34 2836992 c:\windows\winsxs\x86_microsoft-windows-mail-core-dll_31bf3856ad364e35_6.0.6002.18197_none_5a0aedc022b31946\MSOERES.dll
+ 2006-11-02 12:34 . 2006-11-02 12:34 2836992 c:\windows\winsxs\x86_microsoft-windows-mail-core-dll_31bf3856ad364e35_6.0.6001.18416_none_5879faee254ccb43\MSOERES.dll
+ 2006-11-02 10:22 . 2010-05-12 03:52 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
- 2006-11-02 10:22 . 2010-04-28 21:07 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2009-05-30 17:44 . 2010-05-12 03:45 118035670 c:\windows\winsxs\ManifestCache\6.0.6002.18005_001c11ba_blobs.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:80,a9,f0,44,49,27,ca,01

R3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]

2010-05-12 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-11 21:09
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x8795D8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x87bc0d24
\Driver\ACPI -> acpi.sys @ 0x8260fd68
\Driver\atapi -> ataport.SYS @ 0x8271ea2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-05-11 21:12:59
ComboFix-quarantined-files.txt 2010-05-12 04:12
ComboFix2.txt 2010-05-05 05:23
ComboFix3.txt 2010-05-05 02:37
ComboFix4.txt 2010-04-20 23:34
ComboFix5.txt 2010-05-12 03:45

Pre-Run: 231,614,238,720 bytes free
Post-Run: 231,586,725,888 bytes free

- - End Of File - - E566098520B7FC791F8CB65E658B0BE5

Combo fix failed to remove the rootkit, so I tried using Microsoft’s Malware removal and it detected and removed a 3 different infections. I was unable to save the log as the system blue-screened.

ESET is no longer reporting the presence of Olmairk Trojan, so I reran Combofix but PEV.cfxxe fails so I'm not sure if the root kit was removed.

Here are the logs you have requested:


DDS (Ver_10-03-17.01) - NTFSx86
Run by Owner at 9:14:54.08 on Sat 05/15/2010
Internet Explorer: 8.0.6001.18904 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1187 [GMT -7:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Owner\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
mURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] "RUNDLL32.EXE" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {5E638779-1818-4754-A595-EF1C63B87A56} - c:\program files\norton systemworks basic edition\norton cleanup\WCQuick.lnk
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

============= SERVICES / DRIVERS ===============

R3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-12-6 336000]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-5-26 21504]
S3 QJFS;QJFS;c:\users\owner\appdata\local\temp\qjfs.exe --> c:\users\owner\appdata\local\temp\QJFS.exe [?]
S3 RBLVRADEV;RBLVRADEV;c:\users\owner\appdata\local\temp\rblvradev.exe --> c:\users\owner\appdata\local\temp\RBLVRADEV.exe [?]
S3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\drivers\usb8023.sys [2009-8-18 15872]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-4-16 11520]

=============== Created Last 30 ================

2010-05-13 00:35:37 0 d-sh--w- C:\$RECYCLE.BIN
2010-05-12 21:58:47 98816 ----a-w- c:\windows\sed.exe
2010-05-12 21:58:47 77312 ----a-w- c:\windows\MBR.exe
2010-05-12 21:58:47 256512 ----a-w- c:\windows\PEV.exe
2010-05-12 21:58:47 161792 ----a-w- c:\windows\SWREG.exe
2010-05-12 21:10:27 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-12 19:28:52 110112 ----a-w- c:\windows\system32\drivers\NVSTOR32.SYS
2010-05-12 14:41:44 0 d-----w- c:\windows\system32\MpEngineStore
2010-05-12 06:41:05 88495282 ----a-w- c:\windows\system32\ZTGOXH
2010-05-12 03:31:42 0 d-----w- c:\program files\CCleaner
2010-05-12 02:36:56 93056 ----a-w- C:\kwlcapow.sys
2010-05-05 04:46:03 0 d-----w- c:\program files\trend micro
2010-04-27 01:01:55 0 d-----w- c:\program files\iPod
2010-04-27 01:01:53 0 d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01:53 0 d-----w- c:\program files\iTunes
2010-04-27 00:54:28 0 d-----w- c:\program files\Bonjour
2010-04-23 07:57:20 0 d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55:53 0 d-----w- c:\users\owner\appdata\roaming\Arkadium
2010-04-22 05:31:17 0 d-----w- c:\programdata\Casual Box
2010-04-20 23:46:49 0 d-----w- c:\windows\LMICABD.tmp
2010-04-15 22:18:37 208 ----a-w- c:\windows\system32\MRT.INI
2010-04-15 22:10:07 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09:59 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09:57 30720 ----a-w- c:\windows\system32\httpapi.dll

==================== Find3M ====================

2010-05-05 05:30:35 265688 ----a-w- c:\windows\system32\drivers\acpi.sys
2010-05-05 02:50:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys.copy
2010-04-27 00:55:22 86016 ----a-w- c:\windows\inf\infstor.dat
2010-04-27 00:55:22 51200 ----a-w- c:\windows\inf\infpub.dat
2010-04-27 00:55:22 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-03-05 14:01:02 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-01 20:53:36 738 ----a-w- c:\users\owner\appdata\roaming\wklnhst.dat
2010-02-23 06:39:13 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33:45 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 06:33:45 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 04:55:36 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-18 14:07:05 3600776 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-18 14:07:05 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-18 13:30:03 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2009-11-17 22:41:45 665600 ----a-w- c:\windows\inf\drvindex.dat
2008-07-30 06:10:59 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-10-16 21:40:11 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2007-03-31 04:15:27 22 --sha-w- c:\windows\sminst\HPCD.sys
2009-03-24 21:44:32 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009032420090325\index.dat
2010-02-13 04:47:31 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 9:15:02.91 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 12/25/2006 6:07:50 AM
System Uptime: 5/15/2010 9:07:07 AM (0 hours ago)

Motherboard: ASUSTek Computer INC. | | NODUSM3
Processor: AMD Athlon™ 64 X2 Dual Core Processor 5000+ | Socket AM2 | 2600/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 366 GiB total, 211.241 GiB free.
D: is FIXED (NTFS) - 6 GiB total, 0.881 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1209: 5/11/2010 8:35:44 PM - Windows Update

==== Installed Programs ======================

ABBYY FineReader 6.0 Sprint
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AutoUpdate
Big City Adventure - San Francisco
Big City Adventure: New York
Big City Adventure: Vancouver
Big Fish Games: Game Manager
Bonjour
CCleaner
CheckIt Diagnostics
City Sights - Hello, Seattle!
DAK Wave and MP3 Editor v4.2b
DePopper 2.x
DivX
Enhanced Multimedia Keyboard Solution
Escape The Museum
Escape the Museum 2
Garmin City Navigator North America v8
Google Photos Screensaver
Google Toolbar for Internet Explorer
Google Update Helper
Hardware Diagnostic Tools
Haunted Hotel II: Believe the Lies
Hidden Expedition: Everest ™
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Advisor
HP Customer Experience Enhancements
HP Customer Feedback
HP Easy Setup - Core
HP Easy Setup - Frontend
HP Picasso Media Center Add-In
HP Update
iPhone Configuration Utility
iTunes
Jane Angel: Templar Mystery
Java™ 6 Update 17
Keys to Manhattan
LightScribe 1.4.124.1
LUXOR Adventures
Mahjong Fortuna 2
Microsoft .NET Framework 3.5 SP1
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
MobileMe Control Panel
MSN
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 5.0
My HP Games
Mystery Case Files: Madame Fate
Mystery Case Files: Ravenhearst ™
Mystery Case Files: Return to Ravenhearst ™
Mystery P.I. - The Lottery Ticket
Mystery P.I.™ Special Edition Bundle
NVIDIA Drivers
OcxSetup
Photo Viewer
Picasa 3
Python 2.4.3
QuickTime
Rangy Lil's Wild West Adventure
RealPlayer
Realtek High Definition Audio Driver
Route 66
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Safari
SCRABBLE
Scrabble 2.1
Soft Data Fax Modem with SmartCP
Sony Picture Utility
The Treasures Of Montezuma
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Virtual Earth 3D (Beta)
Weather Exchange
Windows Driver Package - Sony DPP-FP60/70/90 (02/22/2007 6.0.6000.44)
Yard Sale Hidden Treasures: Sunnyville

==== Event Viewer Messages From Past Week ========

5/15/2010 9:09:09 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
5/15/2010 9:09:09 AM, Error: Service Control Manager [7000] - The eamonm service failed to start due to the following error: The system cannot find the file specified.
5/15/2010 9:07:30 AM, Error: Microsoft-Windows-TerminalServices-RemoteConnectionManager [1057] - The Terminal Server has failed to create a new self signed certificate to be used for Terminal Server authentication on SSL connections. The relevant status code was Key not valid for use in specified state. .
5/12/2010 7:30:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
5/12/2010 7:28:53 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: spldr Wanarpv6
5/12/2010 7:28:53 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
5/12/2010 7:27:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
5/12/2010 7:27:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
5/12/2010 7:27:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
5/12/2010 7:27:28 PM, Error: Microsoft-Windows-TerminalServices-LocalSessionManager [1048] - Terminal Service start failed. The relevant status code was This service cannot be started in Safe Mode .
5/12/2010 7:27:28 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
5/12/2010 7:20:48 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
5/12/2010 7:15:36 AM, Error: EventLog [6008] - The previous system shutdown at 7:13:24 AM on 5/12/2010 was unexpected.
5/12/2010 6:32:12 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows Vista (KB979683).
5/12/2010 5:34:27 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
5/12/2010 5:29:51 PM, Error: Service Control Manager [7034] - The XAudioService service terminated unexpectedly. It has done this 1 time(s).
5/12/2010 4:44:33 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/12/2010 3:13:19 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ehdrv spldr Wanarpv6
5/12/2010 12:29:26 AM, Error: Service Control Manager [7034] - The QJFS service terminated unexpectedly. It has done this 1 time(s).
5/11/2010 8:45:48 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package KB978542 (Security Update) into Resolved(Resolved) state
5/11/2010 8:39:02 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
5/11/2010 11:37:45 PM, Error: Service Control Manager [7030] - The QJFS service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
5/11/2010 11:34:19 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the RBLVRADEV service to connect.
5/11/2010 11:34:19 PM, Error: Service Control Manager [7000] - The RBLVRADEV service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
5/11/2010 11:33:48 PM, Error: Service Control Manager [7030] - The RBLVRADEV service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

==== End Of File ===========================

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-15 11:43:50
Windows 6.0.6002 Service Pack 2
Running: gamer.exe; Driver: C:\Users\Owner\AppData\Local\Temp\kwlcapow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8B401340, 0x3DA8C7, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

And the most recent combofix in which PEV.cfxxe fails

ComboFix 10-05-10.05 - Owner 05/15/2010 11:57:41.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.966 [GMT -7:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2010-04-15 to 2010-05-15 )))))))))))))))))))))))))))))))
.

2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-12 21:10 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-12 19:28 . 2010-05-12 19:28 110112 ----a-w- c:\windows\system32\drivers\NVSTOR32.SYS
2010-05-12 14:41 . 2010-05-12 20:02 -------- d-----w- c:\windows\system32\MpEngineStore
2010-05-12 03:31 . 2010-05-12 03:31 -------- d-----w- c:\program files\CCleaner
2010-05-12 02:36 . 2010-05-12 02:36 93056 ----a-w- C:\kwlcapow.sys
2010-04-27 01:01 . 2010-04-27 01:01 -------- d-----w- c:\program files\iPod
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\program files\iTunes
2010-04-27 00:54 . 2010-04-27 00:54 -------- d-----w- c:\program files\Bonjour
2010-04-27 00:48 . 2010-04-27 00:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-23 07:57 . 2010-04-23 07:57 -------- d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55 . 2010-04-22 23:55 -------- d-----w- c:\users\Owner\AppData\Roaming\Arkadium
2010-04-22 06:52 . 2010-04-22 07:37 -------- d-----w- c:\users\Owner\AppData\Local\Brain Games Mahjongg Files
2010-04-22 05:31 . 2010-04-22 05:31 -------- d-----w- c:\programdata\Casual Box
2010-04-20 23:46 . 2010-04-20 23:47 -------- d-----w- c:\windows\LMICABD.tmp
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-12 23:57 . 2007-03-04 02:39 -------- d-----w- c:\program files\Verizon
2010-05-12 21:13 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-12 03:26 . 2009-12-19 21:32 1356 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-05 05:30 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys
2010-05-05 02:50 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys.copy
2010-05-03 08:53 . 2006-12-06 21:09 -------- d-----w- c:\program files\HP Games
2010-05-03 08:53 . 2006-12-06 21:12 -------- d-----w- c:\programdata\WildTangent
2010-04-27 01:01 . 2007-07-10 02:09 -------- d-----w- c:\program files\Common Files\Apple
2010-04-27 00:59 . 2008-10-18 03:47 -------- d-----w- c:\program files\QuickTime
2010-04-23 07:54 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-04-22 18:34 . 2006-12-06 21:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-22 05:18 . 2009-03-22 06:23 -------- d-----w- c:\program files\bfgclient
2010-04-22 05:09 . 2006-12-06 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-21 02:07 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-21 01:55 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-04-21 01:49 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-04-21 01:45 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-10 18:50 . 2010-04-10 18:48 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:48 . 2010-04-10 18:47 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-06 03:43 . 2010-04-06 03:38 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-24 10:54 . 2010-03-24 10:29 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-05 14:01 . 2010-04-14 20:14 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-23 11:10 . 2010-04-14 20:37 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-23 11:10 . 2010-04-14 20:37 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-02-23 11:10 . 2010-04-14 20:36 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-18 14:07 . 2010-04-14 20:13 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-02-18 14:07 . 2010-04-14 20:14 3600776 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-18 14:07 . 2010-04-14 20:14 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-18 13:30 . 2010-04-14 20:13 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-02-18 11:28 . 2010-04-14 20:13 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-03-17 04:58 47392 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 04:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:80,a9,f0,44,49,27,ca,01

R1 lhmopayo;lhmopayo;c:\windows\system32\drivers\lhmopayo.sys [x]
R1 MpKsl364f009f;MpKsl364f009f;c:\windows\system32\MpEngineStore\MpKsl364f009f.sys [x]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R3 QJFS;QJFS;c:\users\Owner\AppData\Local\Temp\QJFS.exe [x]
R3 RBLVRADEV;RBLVRADEV;c:\users\Owner\AppData\Local\Temp\RBLVRADEV.exe [x]
R3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]


--- Other Services/Drivers In Memory ---

*Deregistered* - kwlcapow

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]

2010-05-15 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-15 12:01
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

[0] 0x00020207

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-05-15 12:02:55
ComboFix-quarantined-files.txt 2010-05-15 19:02

Pre-Run: 226,935,336,960 bytes free
Post-Run: 226,926,825,472 bytes free

- - End Of File - - 48C9363CC646E4106B1AE46538D3AE3E

Hello and welcome to Bleeping Computer!

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log

Elle

THe desktop is currently disconnected and shutdown, waiting your review. I attached the DDS log from yesterday

Hello, Tim Harris
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:

• Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
• If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
• Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
• Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
• Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
• Please set your system to show all files.
  Click Start, open My Computer, select the Tools menu and click Folder Options.
  Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
  Uncheck: Hide file extensions for known file types
  Uncheck the Hide protected operating system files (recommended) option.
  Click Yes to confirm.

First, you must verify that you can access the Vista Recovery Environment.
To do so, restart your computer and begin tapping the F8 key to enable the Advanced Start menu.
If the option 'Repair your computer' is available, select it.

If not available, you will need to insert your Vista installation dvd and restart, then press any key when prompted to boot from the cd.
At the Install Windows screen, select Repair your computer. (image below)



Next, please download maxlook, saving the file to your desktop.
Double click maxlook.exe to run it. Note - you must run it only once!
As instructed when the tool runs, restart the computer and logon to the Recovery Environment.
Once you get to the System Recovery Options screen, first take note of the drive letter assigned to the operating system, then select Command Prompt.



Type the following bolded command at the x:\sources> prompt (or x:\windows\system32>) then hit Enter.

cd /d x:\windows <--- the red x represents your operating system drive letter, as shown in the image below




At the C:\Windows> prompt type the following command then hit Enter

look.bat

You will see many files copied then return to the x:\windows> prompt.
Type Exit then restart your computer and logon in normal mode.

Please go to start > run and type

maxlook -sig

and hit enter. A logfile will open, please post back with the content of the log.

Due to the lack of feedback, this topic is now closed.
If you need this topic reopened, please PM a staff member and we will reopen it for you (include the address of this thread in your request). This applies to the original topic starter only. Everyone else with similar problems, please start a new topic.