[Resolved] Firefox or IE doesn't open when clicking icon

  1. 28-11-2009  #1
    jasonstuckey
    jasonstuckey is offline Junior Member

    [Resolved] Firefox or IE doesn't open when clicking icon

    Problems starting a web browser. Firefox or IE doesn't open when clicking icon. I have tried numerous virus, trojan, etc. scans with absolutely no luck! After numerous reboots browser may start up and will work fine, until browser is idle for a long length of time. After being idle, browser tries to connect to a link with no success.

    Any advice?

    Thanks

    Logs listed below:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:17:53 PM, on 11/28/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    C:\WINDOWS\Explorer.EXE
    c:\program files\mcafee.com\agent\mcupdate.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\DIGStream\digstream.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\Mp***ent.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
    C:\WINDOWS\system32\braviax.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\bin\HPOVDX05.EXE
    C:\WINDOWS\system32\hpoipm07.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=localhost:7171
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local;<local>
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: &ESPN - {AE6F2894-AF10-4C9C-B16E-1DFC6FF8C0C6} - C:\Program Files\ESPN\Toolbar\DIGToolBar.dll
    O3 - Toolbar: (no name) - {68FF9E0F-2E96-4467-87FA-1A8B9734C7E7} - (no file)
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: MyIdentityDefender - {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - C:\Documents and Settings\Jason\Local Settings\Application Data\CyberDefender\cdmyidd.dll
    O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
    O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [RDVCHG] "C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [mssysfs] C:\WINDOWS\system32\e.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [CyberDefender Early Detection Center] "C:\Program Files\CyberDefender\AntiSpyware\cdas4c.exe" /minimize
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
    O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
    O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    O4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) - http://zone.msn.com/binFrameWork/v10...I.cab55579.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/do...e_Inst_Win.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) - http://zone.msn.com/binframework/v10...t.cab55579.cab
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.myheritage.com/FP/ImageUp...eUploader5.cab
    O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.g...tl_0_0_0_1.ocx
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames...1.cab60096.cab
    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames...l.cab55579.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor....cab102118.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10...y.cab55579.cab
    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - SmithMicro Inc. - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

    --
    End of file - 14727 bytes



    --------------------------------------------------------------------------
    ComboFix 09-11-22.02 - Jason 11/24/2009 16:02.5.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.181 [GMT -6:00]
    Running from: c:\documents and settings\Jason\Desktop\Computer fix programs\ComboFix.exe
    AV: CyberDefender Internet Security *On-access scanning enabled* (Updated) {C07F9A1E-7510-4ABC-8361-5F82FE7130EF}
    AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\bg.jpg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\CurrentVersion.xml
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data\ProductInfo.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\ExtractZipFile.zip
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\icon.ico
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\productinfo.dll
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Setup.exe
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\stbup.exe
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\tdf.dat
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\01c9eb2893468d1fba80553d2b 75bd30.gif
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\867b44b1158783875052f103c3 a2f11a.gif
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\bc83ac54dd36e7479704363c8f bd7e43.gif
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\c14631dd1d688aa0ae8e9c9dd3 96c653.gif
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\default1.dat
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\loading.dat
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\loading.gif
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_DailyVideo.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Game.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Logo.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Option.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Search.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Smiley_Config.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Smiley_TellAFriend.m x
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Wallpaper.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Web.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\pixel.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\ProductInfo.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\profile.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\SearchEngineList.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\tbcore.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\ToolbarLayout.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\UpdateCentre.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\UpdateCentreBk.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\URLDynamic.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\URLStatic.mx
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\About.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Component_ComboBox.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_DailyVideo.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Game.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Logo.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Option.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Search.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Smiley.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Wallpaper.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Web.mg
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDefault.png
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDisplay.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDisplay.png
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDisplay18.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDisplay20.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnGlitters.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnGlitters.png
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnGlitters18.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnGlitters20.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnOption.png
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnSmiley.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnSmiley.png
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnSmiley18.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnSmiley20.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnTellFd.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnTellFd.png
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnTellFd18.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnTellFd20.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnWink.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnWink.png
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnWink18.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnWink20.bmp
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\myskin1.skf
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\myskin2.skf
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\myskin3.skf
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\myskin4.skf
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\TellafriendSkin.skf
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\TellafriendSkin_s.skf
    c:\documents and settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\ToastSkin.skf
    c:\program files\PlaySushi\PSTExt.dll
    c:\windows\isig.inf
    c:\windows\system32\cooper.mine
    c:\windows\system32\nvrtm.dll
    c:\windows\system32\wisdstr.exe

    .
    ((((((((((((((((((((((((( Files Created from 2009-10-24 to 2009-11-24 )))))))))))))))))))))))))))))))
    .

    2009-11-24 22:01 . 2001-08-17 18:52 13952 -c--a-w- c:\windows\system32\drivers\cbidf2k.sys
    2009-11-24 22:01 . 2001-08-17 18:52 13952 ----a-w- c:\windows\system32\dllcache\cbidf2k.sys
    2009-11-24 22:01 . 2008-04-13 18:40 96512 -c--a-w- c:\windows\system32\drivers\atapi.sys
    2009-11-24 22:01 . 2008-04-13 18:40 96512 ----a-w- c:\windows\system32\dllcache\atapi.sys
    2009-11-23 22:24 . 2009-11-23 22:24 -------- d-----w- c:\documents and settings\Jason_2\Local Settings\Application Data\The Weather Channel
    2009-11-22 22:30 . 2009-11-22 22:29 389120 ----a-w- c:\windows\system32\CF26370.exe
    2009-11-22 15:27 . 2009-11-22 15:27 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\UserData
    2009-11-22 15:27 . 2009-11-22 15:27 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Shared
    2009-11-22 15:24 . 2009-11-22 15:24 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Yahoo
    2009-11-22 15:24 . 2009-11-22 15:24 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Unity
    2009-11-22 15:24 . 2009-11-22 15:24 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\The Weather Channel
    2009-11-22 15:23 . 2009-11-22 15:23 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Powercinema
    2009-11-22 15:23 . 2009-11-22 15:23 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\MTV Networks
    2009-11-22 15:22 . 2009-11-22 15:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup
    2009-11-22 15:22 . 2009-11-22 15:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\KodakGallery
    2009-11-22 15:22 . 2009-11-22 15:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer
    2009-11-22 15:22 . 2009-11-22 15:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Installer3232
    2009-11-22 15:22 . 2009-11-22 15:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Installer1396
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Identities
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Help
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Downloaded Installations
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\DoubleD
    2009-11-22 15:21 . 2008-10-10 01:05 72800 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\cdstbar
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Apple
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Incomplete
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\IECompatCache
    2009-11-22 15:21 . 2009-09-03 00:59 70984 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\g2mdlhlpx.exe
    2009-11-22 15:19 . 2009-11-22 15:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Yahoo!
    2009-11-22 15:19 . 2009-11-22 15:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\WeatherBug
    2009-11-22 15:19 . 2009-11-22 15:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Talkback
    2009-11-22 15:19 . 2009-11-06 02:03 152576 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
    2009-11-22 15:19 . 2009-08-21 18:41 152576 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
    2009-11-22 15:19 . 2009-07-09 18:55 152576 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
    2009-11-22 15:19 . 2007-10-23 15:27 110592 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\U3\temp\cleanup.exe
    2009-11-22 15:19 . 2009-03-18 19:47 152576 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sun\Java\jre1.6.0_11\lzma.dll
    2009-11-22 15:18 . 2009-03-18 19:54 503808 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-3c7d0873-n\msvcp71.dll
    2009-11-22 15:18 . 2009-03-18 19:54 348160 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-3c7d0873-n\msvcr71.dll
    2009-11-22 15:18 . 2009-03-18 19:54 499712 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-3c7d0873-n\jmc.dll
    2009-11-22 15:18 . 2009-11-23 22:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\SlimBrowser
    2009-11-22 15:18 . 2009-11-22 15:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sierra Wireless
    2009-11-22 15:15 . 2009-11-22 15:15 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Netscape
    2009-11-22 15:15 . 2009-11-22 15:15 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\NCH Swift Sound
    2009-11-22 15:15 . 2009-08-13 20:39 340480 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Mozilla\Firefox\Profiles\bwsbtxcx.default\ext ensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
    2009-11-22 15:15 . 2009-08-13 20:39 346112 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Mozilla\Firefox\Profiles\bwsbtxcx.default\ext ensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
    2009-11-22 15:15 . 2009-08-13 20:40 43008 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Mozilla\Firefox\Profiles\bwsbtxcx.default\ext ensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
    2009-11-22 15:15 . 2009-10-07 18:27 188416 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\P laySushiFF.dll
    2009-11-22 15:15 . 2009-10-22 01:33 126970 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Move Networks\uninstall.exe
    2009-11-22 15:14 . 2009-08-03 21:49 97144 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
    2009-11-22 15:14 . 2009-05-07 16:06 1047072 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Move Networks\MoveMediaPlayer_071303000006.exe
    2009-11-22 15:14 . 2009-11-22 15:15 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Move Networks
    2009-11-22 15:14 . 2009-11-22 15:14 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Motive
    2009-11-22 15:14 . 2006-08-30 02:04 8854 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\PDTHelpShortcut__4B691FC6F103435EA1F 6339BD6C78617_2.exe
    2009-11-22 15:14 . 2006-08-30 02:04 65536 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\PalmDesktopShortcut.exe
    2009-11-22 15:14 . 2006-08-30 02:04 40960 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\NewShortcut6_45BA714564B04B5DBDC240E 20FCDC6DC.exe
    2009-11-22 15:14 . 2006-08-30 02:04 40960 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\NewShortcut1_45BA714564B04B5DBDC240E 20FCDC6DC.exe
    2009-11-22 15:14 . 2006-08-30 02:04 65536 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\NewShortcut1_1.4DA64122_6F1D_4317_BC 6A_2B3299881D1B.exe
    2009-11-22 15:14 . 2006-08-30 02:04 65536 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\ARPPRODUCTICON.exe
    2009-11-22 15:14 . 2009-11-22 15:14 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Media Player Classic
    2009-11-22 15:13 . 2009-11-22 15:13 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Malwarebytes
    2009-11-22 15:12 . 2009-11-22 15:12 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Leadertech
    2009-11-22 15:12 . 2009-11-22 15:12 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\HotSync
    2009-11-22 15:12 . 2008-11-13 20:29 19115 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\lati.exe
    2009-11-22 15:12 . 2007-07-19 00:44 64512 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u4\HTML\ite m_templ\coach\RunGdp.exe
    2009-11-22 15:12 . 2007-04-13 01:11 64512 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u3\HTML\ite m_templ\coach\RunGdp.exe
    2009-11-22 15:12 . 2007-05-10 12:30 225280 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\HTML\Aut oMaintenance\Images.dll
    2009-11-22 15:12 . 2008-02-01 01:23 698511 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\HTML\Aut oMaintenance\AutoMaintenance.dll
    2009-11-22 15:12 . 2007-04-13 01:08 123138 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\HTML\Mak eDesktopShortcut.EXE
    2009-11-22 15:11 . 2007-04-13 01:08 68608 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\HTML\fix \DellSupportLauncher.exe
    2009-11-22 15:11 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\ESPN
    2009-11-22 15:11 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Download Manager
    2009-11-22 15:11 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\DivX
    2009-11-22 15:11 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\CyberLink
    2009-11-22 15:11 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Arcsoft
    2009-11-22 15:11 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Apple Computer
    2009-11-22 15:11 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\AdobeUM
    2009-11-22 15:10 . 2007-03-09 04:38 686080 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_en_US.ex e
    2009-11-22 15:10 . 2009-11-22 15:10 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\.Torrent Swapper
    2009-11-22 15:10 . 2009-11-22 15:10 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\.limewire
    2009-11-22 15:10 . 2009-11-22 15:10 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\.GalleryRemot e
    2009-11-22 15:10 . 2009-05-09 03:52 0 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\.exe
    2009-11-21 03:49 . 2009-11-21 03:49 77251196 ----a-w- c:\temp\JS_-_All_Or_Nothing__US_Version_.zip
    2009-11-21 03:24 . 2009-11-21 03:24 46194609 ----a-w- c:\temp\Justin Bieber - My World.zip
    2009-11-20 00:53 . 2009-11-20 00:53 -------- d-----w- c:\documents and settings\Jason\Application Data\Bytemobile
    2009-11-20 00:51 . 2009-11-20 00:51 -------- d-----w- c:\documents and settings\Jason_2\Application Data\Malwarebytes
    2009-11-20 00:44 . 2009-11-20 00:44 -------- d-----w- c:\documents and settings\Jason_2\Application Data\Apple Computer
    2009-11-20 00:43 . 2009-11-20 00:44 -------- d-----w- c:\documents and settings\Jason_2\Application Data\SlimBrowser
    2009-11-20 00:23 . 2009-11-20 00:23 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\PrivacIE
    2009-11-20 00:21 . 2009-11-20 00:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\SupportSoft
    2009-11-20 00:20 . 2009-11-20 00:20 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Mozilla
    2009-11-20 00:19 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Google
    2009-11-20 00:19 . 2009-11-20 00:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\BVRP Software
    2009-11-20 00:19 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Apple Computer
    2009-11-20 00:19 . 2009-11-20 00:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\IETldCache
    2009-11-20 00:16 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Creative
    2009-11-20 00:16 . 2004-10-23 02:07 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Jasc Software Inc
    2009-11-19 22:17 . 2008-05-02 16:41 3493888 ---ha-w- c:\documents and settings\Jason_2\Application Data\U3\temp\Launchpad Removal.exe
    2009-11-19 22:17 . 2009-11-19 22:17 -------- d-----w- c:\documents and settings\Jason_2\Application Data\U3
    2009-11-19 20:25 . 2009-11-19 20:25 -------- d-----w- c:\documents and settings\Jason_2\Local Settings\Application Data\BVRP Software
    2009-11-19 20:19 . 2009-11-19 20:19 -------- d-sh--w- c:\documents and settings\Jason_2\PrivacIE
    2009-11-19 20:14 . 2009-11-19 20:14 -------- d-sh--w- c:\documents and settings\Jason_2\IETldCache
    2009-11-19 20:14 . 2009-11-19 20:14 -------- d-----w- c:\documents and settings\Jason_2\Application Data\Bytemobile
    2009-11-19 19:58 . 2009-11-19 19:58 -------- d-----w- c:\windows\system32\wbem\Repository
    2009-11-19 19:37 . 2009-11-19 19:56 -------- d-s---w- c:\documents and settings\HelpAssistant
    2009-11-06 15:23 . 2009-11-06 15:23 -------- d-----w- c:\documents and settings\Jason\Application Data\Media Player Classic
    2009-11-06 15:21 . 2009-08-16 15:08 178176 ----a-w- c:\windows\system32\unrar.dll
    2009-11-06 02:03 . 2009-11-06 02:03 152576 ----a-w- c:\documents and settings\Jason\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
    2009-11-06 01:10 . 2009-11-06 01:10 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
    2009-11-06 01:10 . 2009-11-06 01:10 -------- d-----w- c:\documents and settings\Jason\Application Data\NCH Swift Sound
    2009-11-06 01:10 . 2009-11-06 01:10 -------- d-----w- c:\program files\NCH Swift Sound

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2009-11-24 22:38 . 2009-10-18 16:01 -------- d-----w- c:\program files\PlaySushi
    2009-11-24 00:06 . 2007-05-13 16:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
    2009-11-23 22:33 . 2006-05-20 22:13 -------- d-----w- c:\documents and settings\All Users\Application Data\DIGStream
    2009-11-22 15:14 . 2009-11-20 00:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\McAfee.com Personal Firewall
    2009-11-21 17:32 . 2009-11-22 15:19 37642 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\wklnhst.dat
    2009-11-21 17:32 . 2005-11-01 22:26 37642 ----a-w- c:\documents and settings\Jason\Application Data\wklnhst.dat
    2009-11-20 00:18 . 2009-11-20 00:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\U3
    2009-11-20 00:18 . 2009-11-20 00:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sprint
    2009-11-20 00:18 . 2009-11-20 00:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\GTek
    2009-11-20 00:18 . 2009-11-20 00:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Bytemobile
    2009-11-19 22:06 . 2009-08-23 19:10 -------- d-----w- c:\documents and settings\Jason\Application Data\U3
    2009-11-19 20:34 . 2009-02-08 20:22 -------- d--h--w- c:\documents and settings\Jason_2\Application Data\GTek
    2009-11-19 19:53 . 2009-11-23 22:43 234312 ----a-w- c:\windows\PCHEALTH\HELPCTR\Config\Cache\Professio nal_32_1033.dat
    2009-11-16 20:42 . 2006-02-07 20:08 -------- d-----w- c:\documents and settings\Jason\Application Data\WeatherBug
    2009-11-06 16:31 . 2009-02-01 22:41 -------- d-----w- c:\documents and settings\Jason\Application Data\SlimBrowser
    2009-11-06 02:05 . 2004-10-23 01:58 -------- d-----w- c:\program files\Java
    2009-10-22 02:35 . 2007-02-27 23:37 -------- d--h--w- c:\documents and settings\Jason\Application Data\Move Networks
    2009-10-22 01:33 . 2009-10-22 01:33 126970 ----a-w- c:\documents and settings\Jason\Application Data\Move Networks\uninstall.exe
    2009-10-22 01:33 . 2009-08-03 21:48 4187512 ----a-w- c:\documents and settings\Jason\Application Data\Move Networks\plugins\npqmp071505000010.dll
    2009-10-22 01:32 . 2009-10-22 01:32 1407680 ----a-w- c:\documents and settings\Jason\Application Data\Move Networks\MoveMediaPlayerWin_071505000010.exe
    2009-10-18 16:02 . 2009-10-18 16:02 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-10-11 10:17 . 2009-03-18 19:52 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-09-12 19:34 . 2009-09-12 19:34 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.0.70\SetupAdmin.exe
    2009-09-03 00:59 . 2009-11-19 19:56 70984 ----a-w- c:\documents and settings\HelpAssistant\g2mdlhlpx.exe
    2009-09-03 00:59 . 2009-09-03 00:59 70984 ----a-w- c:\documents and settings\Jason\g2mdlhlpx.exe
    2009-08-29 00:42 . 2009-07-15 16:16 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-08-29 00:42 . 2009-01-25 02:33 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2006-04-29 20:12 . 2006-04-29 20:12 774144 ----a-w- c:\program files\RngInterstitial.dll
    2009-05-07 14:19 . 2009-05-06 21:01 3693344 --sha-w- c:\windows\SYSTEM32\DRIVERS\fidbox.dat
    2009-05-07 14:19 . 2009-05-06 21:01 288 --sha-w- c:\windows\SYSTEM32\DRIVERS\fidbox2.dat
    .

    ((((((((((((((((((((((((((((( SnapShot_2009-07-28_17.30.47 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-11-24 21:51 . 2009-11-24 21:51 16384 c:\windows\Temp\Perflib_Perfdata_a28.dat
    - 2004-10-23 01:50 . 2009-05-25 22:59 53436 c:\windows\SYSTEM32\PERFC009.DAT
    + 2004-10-23 01:50 . 2009-11-16 20:38 53436 c:\windows\SYSTEM32\PERFC009.DAT
    + 2006-10-17 18:33 . 2009-07-03 17:09 55296 c:\windows\SYSTEM32\msfeedsbs.dll
    - 2006-10-17 18:33 . 2009-03-08 09:31 55296 c:\windows\SYSTEM32\msfeedsbs.dll
    - 2006-11-08 00:32 . 2008-03-15 04:31 98304 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwOnce.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 98304 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwOnce.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 86016 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwMenuX.dll
    - 2008-09-27 23:03 . 2008-03-15 16:38 86016 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwMenuX.dll
    - 2006-11-08 00:32 . 2008-03-15 04:31 77824 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwInit.exe
    + 2009-07-16 11:00 . 2009-07-16 11:00 77824 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwInit.exe
    + 2009-07-16 11:00 . 2009-07-16 11:00 24576 c:\windows\SYSTEM32\Macromed\Shockwave 10\DynaPlayer.dll
    - 2006-11-08 00:32 . 2008-03-15 04:29 24576 c:\windows\SYSTEM32\Macromed\Shockwave 10\DynaPlayer.dll
    + 2009-03-29 21:09 . 2009-09-09 22:02 88589 c:\windows\SYSTEM32\Macromed\Flash\uninstall_activ eX.exe
    - 2004-10-23 02:06 . 2002-01-09 07:38 53248 c:\windows\SYSTEM32\Macromed\Common\SwSupport.dll
    + 2009-03-16 08:59 . 2009-03-16 08:59 53248 c:\windows\SYSTEM32\Macromed\Common\SwSupport.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 25600 c:\windows\SYSTEM32\jsproxy.dll
    - 2004-08-04 10:00 . 2009-04-30 21:22 25600 c:\windows\SYSTEM32\jsproxy.dll
    + 2009-09-12 19:38 . 2009-08-29 00:42 40448 c:\windows\SYSTEM32\DRVSTORE\usbaapl_6DA28B91FF48C 57089E4D2436654AFA4ECAD0622\usbaapl.sys
    + 2009-09-12 19:47 . 2009-05-18 19:17 26600 c:\windows\SYSTEM32\DRVSTORE\GEARAspiWD_3B7AACF063 6A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspiWDM.sys
    + 2008-01-29 17:01 . 2009-05-18 19:17 26600 c:\windows\SYSTEM32\DRIVERS\GEARAspiWDM.sys
    + 2009-06-16 21:16 . 2009-07-03 17:09 12800 c:\windows\SYSTEM32\DLLCACHE\xpshims.dll
    - 2009-06-16 21:16 . 2009-04-30 21:22 12800 c:\windows\SYSTEM32\DLLCACHE\xpshims.dll
    + 2007-05-09 23:33 . 2009-07-03 17:09 55296 c:\windows\SYSTEM32\DLLCACHE\msfeedsbs.dll
    - 2007-05-09 23:33 . 2009-03-08 09:31 55296 c:\windows\SYSTEM32\DLLCACHE\msfeedsbs.dll
    - 2006-05-10 05:22 . 2009-04-30 21:22 25600 c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll
    + 2006-05-10 05:22 . 2009-07-03 17:09 25600 c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll
    + 2009-07-28 17:34 . 2008-10-16 20:09 51224 c:\windows\SYSTEM32\DLLCACHE\cache\wuauclt.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 82432 c:\windows\SYSTEM32\DLLCACHE\cache\ws2_32.dll
    + 2009-07-28 17:34 . 2004-08-04 10:00 24576 c:\windows\SYSTEM32\DLLCACHE\cache\userinit.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 14336 c:\windows\SYSTEM32\DLLCACHE\cache\svchost.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 57856 c:\windows\SYSTEM32\DLLCACHE\cache\spoolsv.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 88576 c:\windows\SYSTEM32\DLLCACHE\cache\rasauto.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 17408 c:\windows\SYSTEM32\DLLCACHE\cache\powrprof.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 33792 c:\windows\SYSTEM32\DLLCACHE\cache\msgsvc.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 13312 c:\windows\SYSTEM32\DLLCACHE\cache\lsass.exe
    + 2009-07-28 17:34 . 2008-04-14 00:11 22016 c:\windows\SYSTEM32\DLLCACHE\cache\lpk.dll
    + 2009-07-28 17:34 . 2008-04-13 18:39 24576 c:\windows\SYSTEM32\DLLCACHE\cache\kbdclass.sys
    + 2009-07-28 17:34 . 2008-04-13 18:53 36608 c:\windows\SYSTEM32\DLLCACHE\cache\ip6fw.sys
    + 2009-07-28 17:34 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\DLLCACHE\cache\ctfmon.exe
    + 2009-07-28 17:34 . 2004-08-04 10:00 11648 c:\windows\SYSTEM32\DLLCACHE\cache\ACPIEC.SYS
    + 2004-10-29 21:12 . 2009-11-21 22:03 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    - 2004-10-29 21:12 . 2009-05-08 21:56 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2004-10-29 21:12 . 2009-11-21 22:03 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2004-10-29 21:12 . 2009-05-08 21:56 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2004-10-29 21:12 . 2009-11-21 22:03 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\i ndex.dat
    - 2004-10-29 21:12 . 2009-05-08 21:56 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\i ndex.dat
    + 2009-08-12 19:16 . 2009-08-12 19:16 87618 c:\windows\SYSTEM32\Adobe\Shockwave 11\uninstaller.exe
    + 2009-07-31 13:26 . 2009-07-31 13:26 94208 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwMenu.dll
    - 2008-09-27 15:45 . 2009-01-17 01:16 94208 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwMenu.dll
    + 2009-07-31 12:54 . 2009-07-31 12:54 79488 c:\windows\SYSTEM32\Adobe\Shockwave 11\gtapi.dll
    + 2009-10-18 16:02 . 2009-10-18 16:02 51712 c:\windows\Installer\31da5666.msi
    + 2009-07-30 08:01 . 2009-04-30 21:22 12800 c:\windows\ie8updates\KB972260-IE8\xpshims.dll
    + 2009-07-30 08:01 . 2009-03-08 09:31 55296 c:\windows\ie8updates\KB972260-IE8\msfeedsbs.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 25600 c:\windows\ie8updates\KB972260-IE8\jsproxy.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB972260-IE8\update\spcustom.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB972260-IE8\spmsg.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 12800 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\xpshims.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 55296 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\msfeedsbs.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 25600 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\jsproxy.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 5120 c:\windows\SYSTEM32\DLLCACHE\cache\sfc.dll
    + 2009-07-28 17:34 . 2004-08-04 10:00 2944 c:\windows\SYSTEM32\DLLCACHE\cache\NULL.SYS
    - 2008-09-27 15:45 . 2009-01-17 01:17 9216 c:\windows\SYSTEM32\Adobe\Shockwave 11\DynaPlayer.dll
    + 2009-07-31 13:28 . 2009-07-31 13:28 9216 c:\windows\SYSTEM32\Adobe\Shockwave 11\DynaPlayer.dll
    - 2004-08-04 10:00 . 2009-05-13 05:15 915456 c:\windows\SYSTEM32\wininet.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 915456 c:\windows\SYSTEM32\wininet.dll
    + 2004-08-04 10:00 . 2004-08-04 10:00 295424 c:\windows\SYSTEM32\termsrv32.dll
    - 2004-10-23 01:50 . 2009-05-25 22:59 381692 c:\windows\SYSTEM32\PERFH009.DAT
    + 2004-10-23 01:50 . 2009-11-16 20:38 381692 c:\windows\SYSTEM32\PERFH009.DAT
    + 2004-08-04 10:00 . 2009-07-03 17:09 206848 c:\windows\SYSTEM32\occache.dll
    - 2006-10-17 18:33 . 2009-03-08 09:32 594432 c:\windows\SYSTEM32\msfeeds.dll
    + 2006-10-17 18:33 . 2009-07-03 17:09 594432 c:\windows\SYSTEM32\msfeeds.dll
    - 2006-11-08 00:32 . 2008-03-15 04:21 180224 c:\windows\SYSTEM32\Macromed\Shockwave 10\Proj.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 180224 c:\windows\SYSTEM32\Macromed\Shockwave 10\Proj.dll
    - 2006-11-08 00:32 . 2008-03-15 04:28 475136 c:\windows\SYSTEM32\Macromed\Shockwave 10\PluginPing.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 475136 c:\windows\SYSTEM32\Macromed\Shockwave 10\PluginPing.dll
    - 2006-11-08 00:32 . 2008-03-15 04:28 339968 c:\windows\SYSTEM32\Macromed\Shockwave 10\Plugin.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 339968 c:\windows\SYSTEM32\Macromed\Shockwave 10\Plugin.dll
    - 2008-09-27 23:02 . 2008-03-15 04:10 606208 c:\windows\SYSTEM32\Macromed\Shockwave 10\iml32X.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 606208 c:\windows\SYSTEM32\Macromed\Shockwave 10\iml32X.dll
    - 2006-11-08 00:32 . 2008-03-15 04:29 581632 c:\windows\SYSTEM32\Macromed\Shockwave 10\Control.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 581632 c:\windows\SYSTEM32\Macromed\Shockwave 10\Control.dll
    + 2009-07-18 03:12 . 2009-07-18 03:12 257440 c:\windows\SYSTEM32\Macromed\Flash\FlashUtil10c.ex e
    + 2009-11-06 02:05 . 2009-10-11 10:17 149280 c:\windows\SYSTEM32\javaws.exe
    + 2009-11-06 02:05 . 2009-10-11 10:17 145184 c:\windows\SYSTEM32\javaw.exe
    + 2009-11-06 02:05 . 2009-10-11 10:17 145184 c:\windows\SYSTEM32\java.exe
    + 2004-08-04 10:00 . 2009-07-03 17:09 184320 c:\windows\SYSTEM32\iepeers.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 386048 c:\windows\SYSTEM32\iedkcs32.dll
    - 2004-08-04 10:00 . 2009-04-30 11:21 173056 c:\windows\SYSTEM32\ie4uinit.exe
    + 2004-08-04 10:00 . 2009-07-03 11:01 173056 c:\windows\SYSTEM32\ie4uinit.exe
    + 2008-01-29 17:02 . 2008-04-17 18:12 107368 c:\windows\SYSTEM32\GEARAspi.dll
    - 2008-01-29 17:02 . 2008-04-17 17:12 107368 c:\windows\SYSTEM32\GEARAspi.dll
    + 2009-09-12 19:47 . 2008-04-17 18:12 107368 c:\windows\SYSTEM32\DRVSTORE\GEARAspiWD_3B7AACF063 6A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspi.dll
    - 2006-05-10 05:23 . 2009-05-13 05:15 915456 c:\windows\SYSTEM32\DLLCACHE\wininet.dll
    + 2006-05-10 05:23 . 2009-07-03 17:09 915456 c:\windows\SYSTEM32\DLLCACHE\wininet.dll
    + 2006-10-17 18:04 . 2009-07-03 17:09 206848 c:\windows\SYSTEM32\DLLCACHE\occache.dll
    + 2007-05-09 23:33 . 2009-07-03 17:09 594432 c:\windows\SYSTEM32\DLLCACHE\msfeeds.dll
    - 2007-05-09 23:33 . 2009-03-08 09:32 594432 c:\windows\SYSTEM32\DLLCACHE\msfeeds.dll
    + 2009-06-16 21:16 . 2009-07-03 17:09 246272 c:\windows\SYSTEM32\DLLCACHE\ieproxy.dll
    - 2009-06-16 21:16 . 2009-04-30 21:22 246272 c:\windows\SYSTEM32\DLLCACHE\ieproxy.dll
    + 2006-05-10 05:22 . 2009-07-03 17:09 184320 c:\windows\SYSTEM32\DLLCACHE\iepeers.dll
    + 2006-10-17 18:01 . 2009-07-03 17:09 386048 c:\windows\SYSTEM32\DLLCACHE\iedkcs32.dll
    + 2006-10-17 18:00 . 2009-07-03 11:01 173056 c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
    - 2006-10-17 18:00 . 2009-04-30 11:21 173056 c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 507904 c:\windows\SYSTEM32\DLLCACHE\cache\winlogon.exe
    + 2009-07-28 17:34 . 2009-05-13 05:15 915456 c:\windows\SYSTEM32\DLLCACHE\cache\wininet.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 578560 c:\windows\SYSTEM32\DLLCACHE\cache\user32.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 295424 c:\windows\SYSTEM32\DLLCACHE\cache\termsrv.dll
    + 2009-07-28 17:34 . 2008-06-20 11:51 361600 c:\windows\SYSTEM32\DLLCACHE\cache\tcpip.sys
    + 2009-07-28 17:34 . 2008-04-14 00:12 171008 c:\windows\SYSTEM32\DLLCACHE\cache\srsvc.dll
    + 2009-07-28 17:34 . 2009-02-06 11:11 110592 c:\windows\SYSTEM32\DLLCACHE\cache\services.exe
    + 2009-07-28 17:34 . 2009-02-09 12:10 401408 c:\windows\SYSTEM32\DLLCACHE\cache\rpcss.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 435200 c:\windows\SYSTEM32\DLLCACHE\cache\ntmssvc.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 407040 c:\windows\SYSTEM32\DLLCACHE\cache\netlogon.dll
    + 2009-07-28 17:34 . 2008-04-13 19:20 182656 c:\windows\SYSTEM32\DLLCACHE\cache\ndis.sys
    + 2009-07-28 17:34 . 2008-04-14 00:11 927504 c:\windows\SYSTEM32\DLLCACHE\cache\mfc40u.dll
    + 2009-07-28 17:34 . 2009-03-21 14:06 989696 c:\windows\SYSTEM32\DLLCACHE\cache\kernel32.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 110080 c:\windows\SYSTEM32\DLLCACHE\cache\imm32.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 792064 c:\windows\SYSTEM32\DLLCACHE\cache\comres.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 617472 c:\windows\SYSTEM32\DLLCACHE\cache\comctl32.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 167936 c:\windows\SYSTEM32\DLLCACHE\cache\appmgmts.dll
    + 2009-07-28 17:34 . 2008-04-13 16:39 142592 c:\windows\SYSTEM32\DLLCACHE\cache\aec.sys
    + 2009-07-28 20:36 . 2009-07-28 20:35 389120 c:\windows\SYSTEM32\CF23077.exe
    + 2009-07-31 12:54 . 2009-07-31 12:54 132472 c:\windows\SYSTEM32\Adobe\Shockwave 11\SYMCCHECKER.DLL
    - 2008-09-27 15:45 . 2009-01-17 01:16 114688 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwInit.exe
    + 2009-07-31 13:26 . 2009-07-31 13:26 114688 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwInit.exe
    + 2009-07-31 13:40 . 2009-07-31 13:40 468408 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwHelper_1151601.exe
    + 2009-07-31 13:28 . 2009-07-31 13:28 446464 c:\windows\SYSTEM32\Adobe\Shockwave 11\Proj.dll
    - 2008-09-27 15:45 . 2009-01-17 01:18 446464 c:\windows\SYSTEM32\Adobe\Shockwave 11\Proj.dll
    + 2009-07-31 13:26 . 2009-07-31 13:26 372736 c:\windows\SYSTEM32\Adobe\Shockwave 11\Plugin.dll
    + 2009-07-31 12:54 . 2009-07-31 12:54 714752 c:\windows\SYSTEM32\Adobe\Shockwave 11\gi.dll
    + 2009-07-31 13:25 . 2009-07-31 13:25 614400 c:\windows\SYSTEM32\Adobe\Shockwave 11\Control.dll
    + 2009-07-31 13:41 . 2009-07-31 13:41 206264 c:\windows\SYSTEM32\Adobe\Director\SwDir.dll
    + 2009-07-31 13:27 . 2009-07-31 13:27 131072 c:\windows\SYSTEM32\Adobe\Director\np32dsw.dll
    + 2009-09-12 19:39 . 2009-09-12 19:39 694272 c:\windows\Installer\a26fe9.msi
    + 2009-10-18 16:06 . 2009-10-18 16:06 601600 c:\windows\Installer\31da5671.msi
    + 2009-09-12 19:47 . 2009-09-12 19:47 102400 c:\windows\Installer\{EC2A8F27-4FBF-4E41-B27B-FE822511B761}\iTunesIco.exe
    + 2009-10-08 22:44 . 2009-10-08 22:44 295606 c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A81300000003}\SC_Reader.exe
    + 2007-11-15 15:23 . 2007-11-15 15:23 136744 c:\windows\Installer\$PatchCache$\Managed\55EEFB3E 2E930EB49B6698EF8583221C\2.0.7311\file_wificfg.exe
    + 2007-11-15 15:23 . 2007-11-15 15:23 185896 c:\windows\Installer\$PatchCache$\Managed\55EEFB3E 2E930EB49B6698EF8583221C\2.0.7311\file_tgshell.exe
    + 2007-11-15 15:24 . 2007-11-15 15:24 579112 c:\windows\Installer\$PatchCache$\Managed\55EEFB3E 2E930EB49B6698EF8583221C\2.0.7311\file_tgctlsr.dll
    + 2007-11-15 15:24 . 2007-11-15 15:24 370216 c:\windows\Installer\$PatchCache$\Managed\55EEFB3E 2E930EB49B6698EF8583221C\2.0.7311\file_sdcnetcheck .dll
    + 2009-07-30 08:01 . 2009-05-13 05:15 915456 c:\windows\ie8updates\KB972260-IE8\wininet.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 382840 c:\windows\ie8updates\KB972260-IE8\spuninst\updspapi.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 231288 c:\windows\ie8updates\KB972260-IE8\spuninst\spuninst.exe
    + 2009-07-30 08:01 . 2009-03-08 09:34 109568 c:\windows\ie8updates\KB972260-IE8\occache.dll
    + 2009-07-30 08:01 . 2009-03-08 09:32 594432 c:\windows\ie8updates\KB972260-IE8\msfeeds.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 246272 c:\windows\ie8updates\KB972260-IE8\ieproxy.dll
    + 2009-07-30 08:01 . 2009-03-08 09:31 183808 c:\windows\ie8updates\KB972260-IE8\iepeers.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 385536 c:\windows\ie8updates\KB972260-IE8\iedkcs32.dll
    + 2009-07-30 08:01 . 2009-04-30 11:21 173056 c:\windows\ie8updates\KB972260-IE8\ie4uinit.exe
    + 2009-07-30 08:01 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB972260-IE8\update\updspapi.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB972260-IE8\update\update.exe
    + 2009-07-30 08:01 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB972260-IE8\spuninst.exe
    + 2009-07-29 13:05 . 2009-07-03 17:06 915456 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 206848 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\occache.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 594432 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\msfeeds.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 246272 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\ieproxy.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 184320 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\iepeers.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 386048 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\iedkcs32.dll
    + 2009-07-29 13:05 . 2009-07-03 11:38 173056 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\ie4uinit.exe
    + 2004-08-04 10:00 . 2009-07-03 17:09 1208832 c:\windows\SYSTEM32\urlmon.dll
    + 2008-12-11 21:29 . 2009-11-19 20:00 1199068 c:\windows\SYSTEM32\Restore\rstrlog.dat
    + 2004-08-04 10:00 . 2009-07-19 13:18 5937152 c:\windows\SYSTEM32\mshtml.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 1490944 c:\windows\SYSTEM32\Macromed\Shockwave 10\dirapiX.dll
    - 2008-09-27 23:02 . 2008-03-15 04:12 1490944 c:\windows\SYSTEM32\Macromed\Shockwave 10\dirapiX.dll
    + 2006-10-17 17:57 . 2009-07-03 17:09 1985536 c:\windows\SYSTEM32\iertutil.dll
    + 2009-09-12 19:38 . 2009-08-29 00:42 2065696 c:\windows\SYSTEM32\DRVSTORE\usbaapl_6DA28B91FF48C 57089E4D2436654AFA4ECAD0622\usbaaplrc.dll
    + 2006-05-10 05:23 . 2009-07-03 17:09 1208832 c:\windows\SYSTEM32\DLLCACHE\urlmon.dll
    + 2006-05-19 15:08 . 2009-07-19 13:18 5937152 c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
    + 2007-05-09 23:33 . 2009-07-03 17:09 1985536 c:\windows\SYSTEM32\DLLCACHE\iertutil.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 1614848 c:\windows\SYSTEM32\DLLCACHE\cache\sfcfiles.dll
    + 2009-07-28 17:34 . 2009-02-06 11:08 2189056 c:\windows\SYSTEM32\DLLCACHE\cache\ntoskrnl.exe
    + 2009-07-28 17:34 . 2009-02-08 00:02 2066048 c:\windows\SYSTEM32\DLLCACHE\cache\ntkrnlpa.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 1033728 c:\windows\SYSTEM32\DLLCACHE\cache\explorer.exe
    + 2009-07-31 13:00 . 2009-07-31 13:00 1011712 c:\windows\SYSTEM32\Adobe\Shockwave 11\iml32.dll
    + 2009-07-31 12:54 . 2009-07-31 12:54 1886320 c:\windows\SYSTEM32\Adobe\Shockwave 11\gt.exe
    + 2009-07-31 13:04 . 2009-07-31 13:04 1798144 c:\windows\SYSTEM32\Adobe\Shockwave 11\dirapi.dll
    - 2008-09-27 15:45 . 2009-01-17 00:58 1798144 c:\windows\SYSTEM32\Adobe\Shockwave 11\dirapi.dll
    + 2009-09-12 19:47 . 2009-09-12 19:47 4597248 c:\windows\Installer\a2760b.msi
    + 2009-09-12 19:43 . 2009-09-12 19:43 1679872 c:\windows\Installer\a272c2.msi
    + 2009-09-12 19:42 . 2009-09-12 19:42 9013760 c:\windows\Installer\a27275.msi
    + 2009-09-12 19:38 . 2009-09-12 19:38 3310592 c:\windows\Installer\a26fe1.msi
    + 2009-10-08 22:44 . 2009-10-08 22:44 4192256 c:\windows\Installer\7263563f.msi
    + 2008-10-05 09:12 . 2008-10-05 09:12 4784128 c:\windows\Installer\31da566c.msp
    + 2009-10-22 02:00 . 2009-10-22 02:00 4733440 c:\windows\Installer\211ba5.msp
    + 2009-05-26 15:10 . 2009-05-26 15:10 3479552 c:\windows\Installer\1d7b378e.msp
    + 2009-07-30 08:01 . 2009-04-30 21:22 1207808 c:\windows\ie8updates\KB972260-IE8\urlmon.dll
    + 2009-07-30 08:01 . 2009-05-13 05:15 5936128 c:\windows\ie8updates\KB972260-IE8\mshtml.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 1985024 c:\windows\ie8updates\KB972260-IE8\iertutil.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 1208832 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\urlmon.dll
    + 2009-07-29 13:05 . 2009-07-19 13:17 5938176 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 1985536 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\iertutil.dll
    + 2006-10-17 18:33 . 2009-07-19 23:48 11067392 c:\windows\SYSTEM32\ieframe.dll
    + 2007-05-09 23:33 . 2009-07-19 23:48 11067392 c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 11064832 c:\windows\ie8updates\KB972260-IE8\ieframe.dll
    + 2009-07-29 13:05 . 2009-07-19 13:17 11068416 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\ieframe.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "Weather"="c:\progra~1\AWS\WEATHE~1\Weather.ex e" [2006-01-06 1343488]
    "CyberDefender Early Detection Center"="c:\program files\CyberDefender\AntiSpyware\cdas4c.exe" [2009-08-15 738632]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    "DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-04-23 801904]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "DIGStream"="c:\program files\DIGStream\digstream.exe" [2005-10-31 278528]
    "DIGServices"="c:\program files\ESPNRunTime\DIGServices.exe" [2005-10-31 101888]
    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-26 185896]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
    "Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2009-05-01 75008]
    "RDVCHG"="c:\program files\Sprint\Sprint SmartView\RDVCHG.exe" [2009-05-01 316672]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
    "RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2008-11-26 335872]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2006-2-7 217088]
    HP OfficeJet T Series Startup.lnk - c:\program files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe [2005-1-21 1175552]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\Windows Media Player\\WMPLAYER.EXE"=
    "c:\\StubInstaller.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "c:\\Program Files\\Sprint\\Sprint SmartView\\SwiApiMux.exe"=
    "c:\\WINDOWS\\SYSTEM32\\GPhotos.scr"=
    "c:\\Program Files\\Intel\\Modem Event Monitor\\IntelMEM.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\CyberDefender\\AntiSpyware\\cdas4c.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:Remote Desktop

    R3 hpoid407;IEEE-1284.4 Driver hpoid407;c:\windows\SYSTEM32\DRIVERS\hpoid407.sys [1/21/2005 2:06 AM 50384]
    R3 NaiFiltr;NaiFiltr;c:\windows\SYSTEM32\DRIVERS\NaiF iltr.sys [10/22/2004 8:08 PM 23296]
    S3 CDAVFS;CDAVFS;c:\windows\SYSTEM32\DRIVERS\CDAVFS.s ys [2/26/2007 4:35 PM 67424]
    S3 palmmdm;Palm Modem;c:\windows\SYSTEM32\DRIVERS\palmmdm.sys [1/30/2006 12:42 PM 9728]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - CLASSPNP_2
    *Deregistered* - CLASSPNP_2
    .
    Contents of the 'Scheduled Tasks' folder

    2009-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

    2009-11-24 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-13 19:09]
    .
    .
    ------- Supplementary Scan -------
    .
    mStart Page = hxxp://www.google.com
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer = http=localhost:7171
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: &Search
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: {{5CFA5B80-01F4-420F-B18B-545712C8A1C8} - http://www.playsushi.com/About.ps?l=6&t=nG2npMXvH
    LSP: bmnet.dll
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game08.zylom.com/activex/zylomgamesplayer.cab
    FF - ProfilePath - c:\documents and settings\Jason\Application Data\Mozilla\Firefox\Profiles\bwsbtxcx.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Ask
    FF - prefs.js: browser.startup.homepage - www.yahoo.com
    FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=
    FF - component: c:\documents and settings\Jason\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\P laySushiFF.dll
    FF - plugin: c:\documents and settings\Jason\Application Data\Move Networks\plugins\npqmp071505000010.dll
    FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
    FF - plugin: c:\program files\Picasa2\npPicasa2.dll
    FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
    HKLM-Run-mssysfs - c:\windows\system32\e.exe
    AddRemove-{83682B4C-B98C-4BEB-97CC-8EAD2AF9E4C6} - c:\documents and settings\Jason\Local Settings\Application Data\cdinstx.exe



    ************************************************** ************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-11-24 16:41
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x82248020]<<
    kernel: MBR read successfully
    detected MBR rootkit hooks:
    \Driver\Disk -> CLASSPNP.SYS @ 0xf86bcf28
    \Driver\ACPI -> ACPI.sys @ 0xf85afcb8
    \Driver\atapi -> 0x82248020
    IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8
    \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8
    NDIS: Intel(R) PRO/100 VE Network Connection -> SendCompleteHandler -> 0x822848d0
    PacketIndicateHandler -> NDIS.sys @ 0xf83eaa21
    SendHandler -> NDIS.sys @ 0xf83c887b
    Warning: possible MBR rootkit infection !
    copy of MBR has been found in sector 0x094FE9BD
    malicious code @ sector 0x094FE9C0 !
    PE file found in sector at 0x094FE9D6 !
    MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

    ************************************************** ************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:0 1,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,a5,34 ,46,75,e7,77,4d,83,01,c4,\
    "3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:0 1,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,a5,34 ,46,75,e7,77,4d,83,01,c4,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'lsass.exe'(740)
    c:\windows\system32\bmnet.dll
    .
    Completion time: 2009-11-24 16:52
    ComboFix-quarantined-files.txt 2009-11-24 22:52
    ComboFix2.txt 2009-07-28 17:38
    ComboFix3.txt 2009-05-09 19:25
    ComboFix4.txt 2009-05-09 04:12
    ComboFix5.txt 2009-11-24 21:58

    Pre-Run: 17,830,473,728 bytes free
    Post-Run: 18,620,895,232 bytes free

    - - End Of File - - 9A210B278D493580F8815A1272B7FDD3



    -------------------------------------------------
    Malwarebytes' Anti-Malware 1.36
    Database version: 2101
    Windows 5.1.2600 Service Pack 3


    11/22/2009 4:19:21 PM
    mbam-log-2009-11-22 (16-19-21).txt

    Scan type: Full Scan (C:\|)
    Objects scanned: 268437
    Time elapsed: 3 hour(s), 36 minute(s), 23 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 2
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
    Last edited by jasonstuckey; 28-11-2009 at 06:26 PM.
  2. 29-11-2009  #2
    broni
    broni is offline Senior Member
    You're running two AV programs and one of them, Cyberdefender is a rogue program.
    Please, uninstall it, re-run Combofix and post its fresh log, along with fresh HJT log.
  3. 29-11-2009  #3
    jasonstuckey
    jasonstuckey is offline Junior Member
    Thanks for responding. Browsers are starting now.

    Here are logs:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:08:40 PM, on 11/29/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\DIGStream\digstream.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\Mp***ent.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\bin\HPOVDX05.EXE
    C:\WINDOWS\system32\hpoipm07.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\NOTEPAD.EXE

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Yahoo! SearchBar Home Page
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! UK & Ireland
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=localhost:7171
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local;<local>
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: &ESPN - {AE6F2894-AF10-4C9C-B16E-1DFC6FF8C0C6} - C:\Program Files\ESPN\Toolbar\DIGToolBar.dll
    O3 - Toolbar: (no name) - {68FF9E0F-2E96-4467-87FA-1A8B9734C7E7} - (no file)
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: MyIdentityDefender - {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - C:\Documents and Settings\Jason\Local Settings\Application Data\CyberDefender\cdmyidd.dll
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
    O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [RDVCHG] "C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [mssysfs] C:\WINDOWS\system32\e.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
    O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
    O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    O4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) - http://zone.msn.com/binFrameWork/v10...I.cab55579.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/do...e_Inst_Win.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) - http://zone.msn.com/binframework/v10...t.cab55579.cab
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.myheritage.com/FP/ImageUp...eUploader5.cab
    O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.g...tl_0_0_0_1.ocx
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames...1.cab60096.cab
    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames...l.cab55579.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor....cab102118.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10...y.cab55579.cab
    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - SmithMicro Inc. - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

    --
    End of file - 14422 bytes



    ComboFix 09-11-28.04 - Jason 11/29/2009 11:54.5.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.77 [GMT -6:00]
    Running from: c:\documents and settings\Jason\Desktop\Computer fix programs\ComboFix.exe
    AV: McAfee VirusScan *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Personal Firewall Plus *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\isig.inf
    c:\windows\system32\nvrtm.dll
    c:\windows\system32\wisdstr.exe

    Infected copy of c:\windows\system32\drivers\beep.sys was found and disinfected
    Restored copy from - c:\i386\BEEP.SYS

    .
    ((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-29 )))))))))))))))))))))))))))))))
    .

    2009-11-29 18:24 . 2009-11-29 18:26 -------- d-----w- c:\windows\LastGood
    2009-11-29 18:20 . 2004-08-04 10:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys
    2009-11-29 17:40 . 2009-11-29 17:40 -------- d-----w- c:\documents and settings\Jason_2\Application Data\Yahoo!
    2009-11-29 17:22 . 2009-11-29 17:21 389120 ----a-w- c:\windows\system32\CF7634.exe
    2009-11-29 01:57 . 2009-11-29 01:57 -------- d-----w- c:\documents and settings\Jason\Application Data\SUPERAntiSpyware.com
    2009-11-29 01:57 . 2009-11-29 01:57 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-11-29 01:39 . 2009-11-29 01:39 -------- d-----w- c:\program files\CCleaner
    2009-11-29 00:44 . 2009-11-29 00:44 79488 ----a-w- c:\documents and settings\Jason\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2009-11-28 17:50 . 2009-11-29 18:27 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001
    2009-11-28 17:29 . 2009-11-28 17:29 -------- d-----w- c:\windows\system32\wbem\Repository
    2009-11-28 17:28 . 2009-11-28 17:28 -------- d-----w- c:\program files\QuickTime
    2009-11-28 17:27 . 2009-11-28 17:27 -------- d-----w- c:\program files\iPod
    2009-11-28 17:27 . 2009-11-28 17:27 -------- d-----w- c:\program files\iTunes
    2009-11-25 15:58 . 2009-11-28 17:02 -------- d-----w- c:\program files\ATT-SST
    2009-11-25 15:30 . 2009-11-28 17:03 -------- d-s---w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.000
    2009-11-22 15:27 . 2009-11-22 15:27 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\UserData
    2009-11-22 15:24 . 2009-11-22 15:24 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\The Weather Channel
    2009-11-22 15:23 . 2009-11-22 15:23 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\MTV Networks
    2009-11-22 15:22 . 2009-11-22 15:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup
    2009-11-22 15:22 . 2009-11-22 15:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer
    2009-11-22 15:22 . 2009-11-28 17:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Installer3232
    2009-11-22 15:22 . 2009-11-28 17:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Installer1396
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Identities
    2009-11-22 15:21 . 2008-10-10 01:05 72800 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-11-22 15:21 . 2009-11-28 17:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender
    2009-11-22 15:21 . 2009-11-28 17:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\cdstbar
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\IECompatCache
    2009-11-22 15:19 . 2009-11-22 15:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Yahoo!
    2009-11-22 15:19 . 2009-11-22 15:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\WeatherBug
    2009-11-22 15:18 . 2009-11-28 17:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\SlimBrowser
    2009-11-22 15:18 . 2009-11-22 15:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sierra Wireless
    2009-11-22 15:15 . 2009-11-22 15:15 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Netscape
    2009-11-22 15:15 . 2009-11-22 15:15 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\NCH Swift Sound
    2009-11-22 15:14 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Move Networks
    2009-11-22 15:14 . 2009-11-22 15:14 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Motive
    2009-11-22 15:14 . 2009-11-22 15:14 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Media Player Classic
    2009-11-22 15:13 . 2009-11-22 15:13 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Malwarebytes
    2009-11-22 15:12 . 2009-11-22 15:12 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Leadertech
    2009-11-22 15:11 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\ESPN
    2009-11-22 15:11 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\DivX
    2009-11-22 15:11 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\AdobeUM
    2009-11-22 15:11 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Apple Computer
    2009-11-22 15:10 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\.Torrent Swapper
    2009-11-22 15:10 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\.limewire
    2009-11-22 15:10 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\.GalleryRemot e
    2009-11-21 03:49 . 2009-11-21 03:49 77251196 ----a-w- c:\temp\JS_-_All_Or_Nothing__US_Version_.zip
    2009-11-21 03:24 . 2009-11-21 03:24 46194609 ----a-w- c:\temp\Justin Bieber - My World.zip
    2009-11-20 00:44 . 2009-11-20 00:44 -------- d-----w- c:\documents and settings\Jason_2\Application Data\Apple Computer
    2009-11-20 00:43 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\Jason_2\Application Data\SlimBrowser
    2009-11-20 00:23 . 2009-11-20 00:23 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\PrivacIE
    2009-11-20 00:21 . 2009-11-20 00:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\SupportSoft
    2009-11-20 00:20 . 2009-11-20 00:20 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Mozilla
    2009-11-20 00:19 . 2009-11-28 17:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Google
    2009-11-20 00:19 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Apple Computer
    2009-11-20 00:19 . 2009-11-20 00:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\IETldCache
    2009-11-20 00:18 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\U3
    2009-11-20 00:18 . 2009-11-20 00:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Sprint
    2009-11-20 00:18 . 2009-11-20 00:18 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\GTek
    2009-11-20 00:16 . 2009-11-22 15:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\Creative
    2009-11-19 22:17 . 2009-11-28 17:23 -------- d-----w- c:\documents and settings\Jason_2\Application Data\U3
    2009-11-19 20:19 . 2009-11-19 20:19 -------- d-sh--w- c:\documents and settings\Jason_2\PrivacIE
    2009-11-19 20:14 . 2009-11-19 20:14 -------- d-sh--w- c:\documents and settings\Jason_2\IETldCache
    2009-11-19 19:56 . 2009-11-19 19:56 -------- d-----w- c:\documents and settings\HelpAssistant\IETldCache
    2009-11-19 19:56 . 2009-11-19 19:56 -------- d-----w- c:\documents and settings\HelpAssistant\IECompatCache
    2009-11-19 19:38 . 2009-11-28 17:24 -------- d-----w- c:\documents and settings\HelpAssistant\.limewire
    2009-11-19 19:38 . 2009-11-28 17:24 -------- d-----w- c:\documents and settings\HelpAssistant\.GalleryRemote
    2009-11-19 19:37 . 2009-11-28 17:24 -------- d-s---w- c:\documents and settings\HelpAssistant
    2009-11-06 15:23 . 2009-11-06 15:23 -------- d-----w- c:\documents and settings\Jason\Application Data\Media Player Classic
    2009-11-06 01:10 . 2009-11-06 01:10 -------- d-----w- c:\documents and settings\Jason\Application Data\NCH Swift Sound
    2009-11-06 01:10 . 2009-11-06 01:10 -------- d-----w- c:\program files\NCH Swift Sound

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2009-11-29 18:36 . 2007-05-13 16:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
    2009-11-29 18:32 . 2006-05-20 22:13 -------- d-----w- c:\documents and settings\All Users\Application Data\DIGStream
    2009-11-29 00:34 . 2004-10-23 02:02 -------- d-----w- c:\program files\Real
    2009-11-29 00:32 . 2005-08-11 00:49 -------- d-----w- c:\program files\Palm
    2009-11-29 00:29 . 2008-02-24 19:19 -------- d-----w- c:\program files\Bonjour
    2009-11-28 19:19 . 2005-11-01 22:26 37890 ----a-w- c:\documents and settings\Jason\Application Data\wklnhst.dat
    2009-11-28 17:31 . 2006-02-07 19:56 -------- d-----w- c:\program files\Common Files\Motive
    2009-11-28 17:28 . 2009-09-12 19:42 -------- d-----w- c:\program files\QuickTime(2)
    2009-11-28 17:27 . 2009-09-12 19:45 -------- d-----w- c:\program files\iPod(2)
    2009-11-28 17:27 . 2009-09-12 19:45 -------- d-----w- c:\program files\iTunes(2)
    2009-11-28 17:27 . 2009-01-25 02:32 -------- d-----w- c:\program files\Common Files\Apple
    2009-11-28 17:26 . 2006-07-18 04:18 -------- d-----w- c:\documents and settings\Jason\Application Data\Apple Computer
    2009-11-28 17:25 . 2007-02-27 23:37 -------- d--h--w- c:\documents and settings\Jason\Application Data\Move Networks
    2009-11-28 17:25 . 2009-08-23 19:10 -------- d-----w- c:\documents and settings\Jason\Application Data\U3
    2009-11-28 17:02 . 2006-02-07 19:56 -------- d-----w- c:\program files\SBC Self Support Tool
    2009-11-25 18:18 . 2004-10-23 01:58 -------- d-----w- c:\program files\Java
    2009-11-25 16:05 . 2006-03-28 01:02 -------- d-----w- c:\documents and settings\Jason\Application Data\Motive
    2009-11-25 15:58 . 2006-02-07 19:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
    2009-11-21 17:32 . 2009-11-22 15:19 37642 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Application Data\wklnhst.dat
    2009-11-19 20:34 . 2009-02-08 20:22 -------- d--h--w- c:\documents and settings\Jason_2\Application Data\GTek
    2009-11-06 16:31 . 2009-02-01 22:41 -------- d-----w- c:\documents and settings\Jason\Application Data\SlimBrowser
    2009-10-18 16:02 . 2009-10-18 16:02 -------- d-----w- c:\program files\Microsoft Silverlight
    2006-04-29 20:12 . 2006-04-29 20:12 774144 ----a-w- c:\program files\RngInterstitial.dll
    2009-05-07 14:19 . 2009-05-06 21:01 3693344 --sha-w- c:\windows\SYSTEM32\DRIVERS\fidbox.dat
    2009-05-07 14:19 . 2009-05-06 21:01 288 --sha-w- c:\windows\SYSTEM32\DRIVERS\fidbox2.dat
    .

    ((((((((((((((((((((((((((((( SnapShot_2009-07-28_17.30.47 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-11-29 18:23 . 2009-11-29 18:23 16384 c:\windows\Temp\Perflib_Perfdata_218.dat
    + 2004-08-04 10:00 . 2009-08-07 01:24 53472 c:\windows\SYSTEM32\wuauclt.exe
    + 2004-08-04 10:00 . 2008-04-14 00:12 49152 c:\windows\SYSTEM32\wdigest(2).dll
    + 2009-11-29 18:25 . 2009-08-07 01:24 44768 c:\windows\SYSTEM32\SoftwareDistribution\Setup\Ser viceStartup\wups2.dll\7.4.7600.226\wups2.dll
    + 2009-11-29 18:25 . 2009-08-07 01:24 35552 c:\windows\SYSTEM32\SoftwareDistribution\Setup\Ser viceStartup\wups.dll\7.4.7600.226\wups.dll
    + 2004-08-04 10:00 . 2009-02-03 19:59 56832 c:\windows\SYSTEM32\secur32(2).dll
    + 2004-10-23 01:50 . 2009-11-28 17:44 53436 c:\windows\SYSTEM32\PERFC009.DAT
    - 2004-10-23 01:50 . 2009-05-25 22:59 53436 c:\windows\SYSTEM32\PERFC009.DAT
    + 2006-10-17 18:33 . 2009-07-03 17:09 55296 c:\windows\SYSTEM32\msfeedsbs.dll
    - 2006-10-17 18:33 . 2009-03-08 09:31 55296 c:\windows\SYSTEM32\msfeedsbs.dll
    + 2004-08-04 10:00 . 2008-04-14 00:11 57344 c:\windows\SYSTEM32\msasn1(2).dll
    - 2006-11-08 00:32 . 2008-03-15 04:31 98304 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwOnce.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 98304 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwOnce.dll
    - 2008-09-27 23:03 . 2008-03-15 16:38 86016 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwMenuX.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 86016 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwMenuX.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 77824 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwInit.exe
    - 2006-11-08 00:32 . 2008-03-15 04:31 77824 c:\windows\SYSTEM32\Macromed\Shockwave 10\SwInit.exe
    + 2009-07-16 11:00 . 2009-07-16 11:00 24576 c:\windows\SYSTEM32\Macromed\Shockwave 10\DynaPlayer.dll
    - 2006-11-08 00:32 . 2008-03-15 04:29 24576 c:\windows\SYSTEM32\Macromed\Shockwave 10\DynaPlayer.dll
    + 2009-03-16 08:59 . 2009-03-16 08:59 53248 c:\windows\SYSTEM32\Macromed\Common\SwSupport.dll
    - 2004-10-23 02:06 . 2002-01-09 07:38 53248 c:\windows\SYSTEM32\Macromed\Common\SwSupport.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 25600 c:\windows\SYSTEM32\jsproxy.dll
    - 2004-08-04 10:00 . 2009-04-30 21:22 25600 c:\windows\SYSTEM32\jsproxy.dll
    + 2009-06-16 21:16 . 2009-07-03 17:09 12800 c:\windows\SYSTEM32\DLLCACHE\xpshims.dll
    - 2009-06-16 21:16 . 2009-04-30 21:22 12800 c:\windows\SYSTEM32\DLLCACHE\xpshims.dll
    + 2004-08-04 10:00 . 2009-08-07 01:24 53472 c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
    + 2007-05-09 23:33 . 2009-07-03 17:09 55296 c:\windows\SYSTEM32\DLLCACHE\msfeedsbs.dll
    - 2007-05-09 23:33 . 2009-03-08 09:31 55296 c:\windows\SYSTEM32\DLLCACHE\msfeedsbs.dll
    + 2006-05-10 05:22 . 2009-07-03 17:09 25600 c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll
    - 2006-05-10 05:22 . 2009-04-30 21:22 25600 c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll
    + 2004-08-04 10:00 . 2009-08-07 01:24 96480 c:\windows\SYSTEM32\DLLCACHE\cdm.dll
    + 2001-08-17 18:52 . 2001-08-17 18:52 13952 c:\windows\SYSTEM32\DLLCACHE\cbidf2k.sys
    + 2009-07-28 17:34 . 2008-10-16 20:09 51224 c:\windows\SYSTEM32\DLLCACHE\cache\wuauclt.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 82432 c:\windows\SYSTEM32\DLLCACHE\cache\ws2_32.dll
    + 2009-07-28 17:34 . 2004-08-04 10:00 24576 c:\windows\SYSTEM32\DLLCACHE\cache\userinit.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 14336 c:\windows\SYSTEM32\DLLCACHE\cache\svchost.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 57856 c:\windows\SYSTEM32\DLLCACHE\cache\spoolsv.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 88576 c:\windows\SYSTEM32\DLLCACHE\cache\rasauto.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 17408 c:\windows\SYSTEM32\DLLCACHE\cache\powrprof.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 33792 c:\windows\SYSTEM32\DLLCACHE\cache\msgsvc.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 13312 c:\windows\SYSTEM32\DLLCACHE\cache\lsass.exe
    + 2009-07-28 17:34 . 2008-04-14 00:11 22016 c:\windows\SYSTEM32\DLLCACHE\cache\lpk.dll
    + 2009-07-28 17:34 . 2008-04-13 18:39 24576 c:\windows\SYSTEM32\DLLCACHE\cache\kbdclass.sys
    + 2009-07-28 17:34 . 2008-04-13 18:53 36608 c:\windows\SYSTEM32\DLLCACHE\cache\ip6fw.sys
    + 2009-07-28 17:34 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\DLLCACHE\cache\ctfmon.exe
    + 2009-07-28 17:34 . 2004-08-04 10:00 11648 c:\windows\SYSTEM32\DLLCACHE\cache\ACPIEC.SYS
    + 2009-08-13 23:40 . 2009-08-13 23:40 29184 c:\windows\SYSTEM32\DLLCACHE\beep.sys
    + 1980-01-01 05:00 . 2008-04-13 18:40 96512 c:\windows\SYSTEM32\DLLCACHE\atapi.sys
    - 2004-10-29 21:12 . 2009-05-08 21:56 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2004-10-29 21:12 . 2009-11-21 22:03 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2004-10-29 21:12 . 2009-11-21 22:03 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2004-10-29 21:12 . 2009-05-08 21:56 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2004-08-04 10:00 . 2009-08-07 01:24 96480 c:\windows\SYSTEM32\cdm.dll
    + 2004-08-04 10:00 . 2008-04-14 00:11 58880 c:\windows\SYSTEM32\atl(2).dll
    + 2009-08-12 19:16 . 2009-08-12 19:16 87618 c:\windows\SYSTEM32\Adobe\Shockwave 11\uninstaller.exe
    + 2009-07-31 13:26 . 2009-07-31 13:26 94208 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwMenu.dll
    - 2008-09-27 15:45 . 2009-01-17 01:16 94208 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwMenu.dll
    + 2009-07-31 12:54 . 2009-07-31 12:54 79488 c:\windows\SYSTEM32\Adobe\Shockwave 11\gtapi.dll
    - 2007-04-14 01:58 . 2007-04-14 01:58 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor sn.dll
    + 2008-05-28 06:49 . 2007-04-14 01:58 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor sn.dll
    + 2008-05-28 06:49 . 2007-04-14 01:57 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor ie.dll
    - 2007-04-14 01:57 . 2007-04-14 01:57 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor ie.dll
    - 2007-04-14 01:57 . 2007-04-14 01:57 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPe rfMonExt.dll
    + 2008-05-28 06:49 . 2007-04-14 01:57 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPe rfMonExt.dll
    + 2008-05-28 07:30 . 2007-04-14 02:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspne t_wp.exe
    - 2007-04-14 02:30 . 2007-04-14 02:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspne t_wp.exe
    + 2009-11-29 18:25 . 2008-10-16 20:09 43544 c:\windows\LastGood\system32\wups2.dll
    + 2009-11-29 18:25 . 2008-10-16 20:08 34328 c:\windows\LastGood\system32\wups.dll
    + 2009-11-29 18:25 . 2008-10-16 20:09 51224 c:\windows\LastGood\system32\wuauclt.exe
    + 2009-11-29 18:24 . 2008-10-16 20:09 92696 c:\windows\LastGood\system32\cdm.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 12800 c:\windows\ie8updates\KB972260-IE8\xpshims.dll
    + 2009-07-30 08:01 . 2009-03-08 09:31 55296 c:\windows\ie8updates\KB972260-IE8\msfeedsbs.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 25600 c:\windows\ie8updates\KB972260-IE8\jsproxy.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB972260-IE8\update\spcustom.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB972260-IE8\spmsg.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 12800 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\xpshims.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 55296 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\msfeedsbs.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 25600 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\jsproxy.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 5120 c:\windows\SYSTEM32\DLLCACHE\cache\sfc.dll
    + 2009-07-28 17:34 . 2004-08-04 10:00 2944 c:\windows\SYSTEM32\DLLCACHE\cache\NULL.SYS
    - 2008-09-27 15:45 . 2009-01-17 01:17 9216 c:\windows\SYSTEM32\Adobe\Shockwave 11\DynaPlayer.dll
    + 2009-07-31 13:28 . 2009-07-31 13:28 9216 c:\windows\SYSTEM32\Adobe\Shockwave 11\DynaPlayer.dll
    + 2004-08-04 10:00 . 2009-08-07 01:24 209632 c:\windows\SYSTEM32\wuweb.dll
    + 2004-08-04 10:00 . 2009-08-07 01:24 327896 c:\windows\SYSTEM32\wucltui.dll
    + 2004-08-04 10:00 . 2009-08-07 01:23 575704 c:\windows\SYSTEM32\wuapi.dll
    - 2004-08-04 10:00 . 2009-05-13 05:15 915456 c:\windows\SYSTEM32\wininet.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 915456 c:\windows\SYSTEM32\wininet.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 915456 c:\windows\SYSTEM32\wininet(2).dll
    + 2004-08-04 10:00 . 2004-08-04 10:00 295424 c:\windows\SYSTEM32\termsrv32.dll
    + 2004-08-04 10:00 . 2004-08-04 10:00 295424 c:\windows\SYSTEM32\termsrv32(2)(2).dll
    + 2004-10-23 01:50 . 2009-11-28 17:44 381692 c:\windows\SYSTEM32\PERFH009.DAT
    - 2004-10-23 01:50 . 2009-05-25 22:59 381692 c:\windows\SYSTEM32\PERFH009.DAT
    + 2004-08-04 10:00 . 2009-07-03 17:09 206848 c:\windows\SYSTEM32\occache.dll
    + 2006-10-17 18:33 . 2009-07-03 17:09 594432 c:\windows\SYSTEM32\msfeeds.dll
    - 2006-10-17 18:33 . 2009-03-08 09:32 594432 c:\windows\SYSTEM32\msfeeds.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 180224 c:\windows\SYSTEM32\Macromed\Shockwave 10\Proj.dll
    - 2006-11-08 00:32 . 2008-03-15 04:21 180224 c:\windows\SYSTEM32\Macromed\Shockwave 10\Proj.dll
    - 2006-11-08 00:32 . 2008-03-15 04:28 475136 c:\windows\SYSTEM32\Macromed\Shockwave 10\PluginPing.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 475136 c:\windows\SYSTEM32\Macromed\Shockwave 10\PluginPing.dll
    - 2006-11-08 00:32 . 2008-03-15 04:28 339968 c:\windows\SYSTEM32\Macromed\Shockwave 10\Plugin.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 339968 c:\windows\SYSTEM32\Macromed\Shockwave 10\Plugin.dll
    - 2008-09-27 23:02 . 2008-03-15 04:10 606208 c:\windows\SYSTEM32\Macromed\Shockwave 10\iml32X.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 606208 c:\windows\SYSTEM32\Macromed\Shockwave 10\iml32X.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 581632 c:\windows\SYSTEM32\Macromed\Shockwave 10\Control.dll
    - 2006-11-08 00:32 . 2008-03-15 04:29 581632 c:\windows\SYSTEM32\Macromed\Shockwave 10\Control.dll
    + 2004-08-04 10:00 . 2008-04-14 00:11 299520 c:\windows\SYSTEM32\kerberos(2).dll
    + 2009-11-06 02:05 . 2009-07-25 10:23 149280 c:\windows\SYSTEM32\javaws.exe
    + 2009-11-06 02:05 . 2009-07-25 10:23 145184 c:\windows\SYSTEM32\javaw.exe
    + 2009-11-06 02:05 . 2009-07-25 10:23 145184 c:\windows\SYSTEM32\java.exe
    + 2004-08-04 10:00 . 2009-07-03 17:09 184320 c:\windows\SYSTEM32\iepeers.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 386048 c:\windows\SYSTEM32\iedkcs32.dll
    - 2004-08-04 10:00 . 2009-04-30 11:21 173056 c:\windows\SYSTEM32\ie4uinit.exe
    + 2004-08-04 10:00 . 2009-07-03 11:01 173056 c:\windows\SYSTEM32\ie4uinit.exe
    + 2004-08-04 10:00 . 2009-08-07 01:24 209632 c:\windows\SYSTEM32\DLLCACHE\wuweb.dll
    + 2004-08-04 10:00 . 2009-08-07 01:24 327896 c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
    + 2004-08-04 10:00 . 2009-08-07 01:23 575704 c:\windows\SYSTEM32\DLLCACHE\wuapi.dll
    + 2006-05-10 05:23 . 2009-07-03 17:09 915456 c:\windows\SYSTEM32\DLLCACHE\wininet.dll
    - 2006-05-10 05:23 . 2009-05-13 05:15 915456 c:\windows\SYSTEM32\DLLCACHE\wininet.dll
    + 2006-10-17 18:04 . 2009-07-03 17:09 206848 c:\windows\SYSTEM32\DLLCACHE\occache.dll
    - 2007-05-09 23:33 . 2009-03-08 09:32 594432 c:\windows\SYSTEM32\DLLCACHE\msfeeds.dll
    + 2007-05-09 23:33 . 2009-07-03 17:09 594432 c:\windows\SYSTEM32\DLLCACHE\msfeeds.dll
    - 2009-06-16 21:16 . 2009-04-30 21:22 246272 c:\windows\SYSTEM32\DLLCACHE\ieproxy.dll
    + 2009-06-16 21:16 . 2009-07-03 17:09 246272 c:\windows\SYSTEM32\DLLCACHE\ieproxy.dll
    + 2006-05-10 05:22 . 2009-07-03 17:09 184320 c:\windows\SYSTEM32\DLLCACHE\iepeers.dll
    + 2006-10-17 18:01 . 2009-07-03 17:09 386048 c:\windows\SYSTEM32\DLLCACHE\iedkcs32.dll
    - 2006-10-17 18:00 . 2009-04-30 11:21 173056 c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
    + 2006-10-17 18:00 . 2009-07-03 11:01 173056 c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 507904 c:\windows\SYSTEM32\DLLCACHE\cache\winlogon.exe
    + 2009-07-28 17:34 . 2009-05-13 05:15 915456 c:\windows\SYSTEM32\DLLCACHE\cache\wininet.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 578560 c:\windows\SYSTEM32\DLLCACHE\cache\user32.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 295424 c:\windows\SYSTEM32\DLLCACHE\cache\termsrv.dll
    + 2009-07-28 17:34 . 2008-06-20 11:51 361600 c:\windows\SYSTEM32\DLLCACHE\cache\tcpip.sys
    + 2009-07-28 17:34 . 2008-04-14 00:12 171008 c:\windows\SYSTEM32\DLLCACHE\cache\srsvc.dll
    + 2009-07-28 17:34 . 2009-02-06 11:11 110592 c:\windows\SYSTEM32\DLLCACHE\cache\services.exe
    + 2009-07-28 17:34 . 2009-02-09 12:10 401408 c:\windows\SYSTEM32\DLLCACHE\cache\rpcss.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 435200 c:\windows\SYSTEM32\DLLCACHE\cache\ntmssvc.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 407040 c:\windows\SYSTEM32\DLLCACHE\cache\netlogon.dll
    + 2009-07-28 17:34 . 2008-04-13 19:20 182656 c:\windows\SYSTEM32\DLLCACHE\cache\ndis.sys
    + 2009-07-28 17:34 . 2008-04-14 00:11 927504 c:\windows\SYSTEM32\DLLCACHE\cache\mfc40u.dll
    + 2009-07-28 17:34 . 2009-03-21 14:06 989696 c:\windows\SYSTEM32\DLLCACHE\cache\kernel32.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 110080 c:\windows\SYSTEM32\DLLCACHE\cache\imm32.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 792064 c:\windows\SYSTEM32\DLLCACHE\cache\comres.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 617472 c:\windows\SYSTEM32\DLLCACHE\cache\comctl32.dll
    + 2009-07-28 17:34 . 2008-04-14 00:11 167936 c:\windows\SYSTEM32\DLLCACHE\cache\appmgmts.dll
    + 2009-07-28 17:34 . 2008-04-13 16:39 142592 c:\windows\SYSTEM32\DLLCACHE\cache\aec.sys
    + 2009-03-18 19:52 . 2009-07-25 10:23 411368 c:\windows\SYSTEM32\deploytk.dll
    + 2009-07-28 20:36 . 2009-07-28 20:35 389120 c:\windows\SYSTEM32\CF23077.exe
    + 2009-07-31 12:54 . 2009-07-31 12:54 132472 c:\windows\SYSTEM32\Adobe\Shockwave 11\SYMCCHECKER.DLL
    + 2009-07-31 13:26 . 2009-07-31 13:26 114688 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwInit.exe
    - 2008-09-27 15:45 . 2009-01-17 01:16 114688 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwInit.exe
    + 2009-07-31 13:40 . 2009-07-31 13:40 468408 c:\windows\SYSTEM32\Adobe\Shockwave 11\SwHelper_1151601.exe
    - 2008-09-27 15:45 . 2009-01-17 01:18 446464 c:\windows\SYSTEM32\Adobe\Shockwave 11\Proj.dll
    + 2009-07-31 13:28 . 2009-07-31 13:28 446464 c:\windows\SYSTEM32\Adobe\Shockwave 11\Proj.dll
    + 2009-07-31 13:26 . 2009-07-31 13:26 372736 c:\windows\SYSTEM32\Adobe\Shockwave 11\Plugin.dll
    + 2009-07-31 12:54 . 2009-07-31 12:54 714752 c:\windows\SYSTEM32\Adobe\Shockwave 11\gi.dll
    + 2009-07-31 13:25 . 2009-07-31 13:25 614400 c:\windows\SYSTEM32\Adobe\Shockwave 11\Control.dll
    + 2009-07-31 13:41 . 2009-07-31 13:41 206264 c:\windows\SYSTEM32\Adobe\Director\SwDir.dll
    + 2009-07-31 13:27 . 2009-07-31 13:27 131072 c:\windows\SYSTEM32\Adobe\Director\np32dsw.dll
    - 2007-04-14 01:58 . 2007-04-14 01:58 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor ld.dll
    + 2008-05-28 06:49 . 2007-04-14 01:58 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor ld.dll
    - 2007-04-14 01:56 . 2007-04-14 01:56 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor jit.dll
    + 2008-05-28 06:48 . 2007-04-14 01:56 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor jit.dll
    - 2007-04-14 02:30 . 2007-04-14 02:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspne t_isapi.dll
    + 2008-05-28 07:30 . 2007-04-14 02:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspne t_isapi.dll
    + 2009-11-29 18:25 . 2008-10-16 20:13 202776 c:\windows\LastGood\system32\wuweb.dll
    + 2009-11-29 18:25 . 2008-10-16 20:12 323608 c:\windows\LastGood\system32\wucltui.dll
    + 2009-11-29 18:25 . 2008-10-16 20:12 561688 c:\windows\LastGood\system32\wuapi.dll
    + 2009-08-06 18:36 . 2009-08-06 18:36 102400 c:\windows\Installer\{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}\iTunesIco.exe
    + 2009-07-30 08:01 . 2009-05-13 05:15 915456 c:\windows\ie8updates\KB972260-IE8\wininet.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 382840 c:\windows\ie8updates\KB972260-IE8\spuninst\updspapi.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 231288 c:\windows\ie8updates\KB972260-IE8\spuninst\spuninst.exe
    + 2009-07-30 08:01 . 2009-03-08 09:34 109568 c:\windows\ie8updates\KB972260-IE8\occache.dll
    + 2009-07-30 08:01 . 2009-03-08 09:32 594432 c:\windows\ie8updates\KB972260-IE8\msfeeds.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 246272 c:\windows\ie8updates\KB972260-IE8\ieproxy.dll
    + 2009-07-30 08:01 . 2009-03-08 09:31 183808 c:\windows\ie8updates\KB972260-IE8\iepeers.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 385536 c:\windows\ie8updates\KB972260-IE8\iedkcs32.dll
    + 2009-07-30 08:01 . 2009-04-30 11:21 173056 c:\windows\ie8updates\KB972260-IE8\ie4uinit.exe
    + 2009-07-30 08:01 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB972260-IE8\update\updspapi.dll
    + 2009-07-30 08:01 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB972260-IE8\update\update.exe
    + 2009-07-30 08:01 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB972260-IE8\spuninst.exe
    + 2009-07-29 13:05 . 2009-07-03 17:06 915456 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 206848 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\occache.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 594432 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\msfeeds.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 246272 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\ieproxy.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 184320 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\iepeers.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 386048 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\iedkcs32.dll
    + 2009-07-29 13:05 . 2009-07-03 11:38 173056 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\ie4uinit.exe
    + 2004-08-04 10:00 . 2009-08-07 01:23 1929952 c:\windows\SYSTEM32\wuaueng.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 1208832 c:\windows\SYSTEM32\urlmon.dll
    + 2004-08-04 10:00 . 2009-07-03 17:09 1208832 c:\windows\SYSTEM32\urlmon(2).dll
    + 2009-07-21 06:05 . 2008-09-30 22:43 1286152 c:\windows\SYSTEM32\msxml4.dll
    - 2008-09-30 22:43 . 2008-09-30 22:43 1286152 c:\windows\SYSTEM32\msxml4.dll
    + 2004-08-04 10:00 . 2008-09-04 17:15 1106944 c:\windows\SYSTEM32\msxml3(2).dll
    + 2004-08-04 10:00 . 2009-07-19 13:18 5937152 c:\windows\SYSTEM32\mshtml.dll
    - 2008-09-27 23:02 . 2008-03-15 04:12 1490944 c:\windows\SYSTEM32\Macromed\Shockwave 10\dirapiX.dll
    + 2009-07-16 11:00 . 2009-07-16 11:00 1490944 c:\windows\SYSTEM32\Macromed\Shockwave 10\dirapiX.dll
    + 2006-10-17 17:57 . 2009-07-03 17:09 1985536 c:\windows\SYSTEM32\iertutil.dll
    + 2004-08-11 22:20 . 2009-11-25 15:12 1536544 c:\windows\SYSTEM32\FNTCACHE.DAT
    - 2004-08-11 22:20 . 2009-06-12 08:12 1536544 c:\windows\SYSTEM32\FNTCACHE.DAT
    + 2004-08-04 10:00 . 2009-08-07 01:23 1929952 c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
    + 2006-05-10 05:23 . 2009-07-03 17:09 1208832 c:\windows\SYSTEM32\DLLCACHE\urlmon.dll
    + 2006-05-19 15:08 . 2009-07-19 13:18 5937152 c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
    + 2007-05-09 23:33 . 2009-07-03 17:09 1985536 c:\windows\SYSTEM32\DLLCACHE\iertutil.dll
    + 2009-07-28 17:34 . 2008-04-14 00:12 1614848 c:\windows\SYSTEM32\DLLCACHE\cache\sfcfiles.dll
    + 2009-07-28 17:34 . 2009-02-06 11:08 2189056 c:\windows\SYSTEM32\DLLCACHE\cache\ntoskrnl.exe
    + 2009-07-28 17:34 . 2009-02-08 00:02 2066048 c:\windows\SYSTEM32\DLLCACHE\cache\ntkrnlpa.exe
    + 2009-07-28 17:34 . 2008-04-14 00:12 1033728 c:\windows\SYSTEM32\DLLCACHE\cache\explorer.exe
    + 2009-07-31 13:00 . 2009-07-31 13:00 1011712 c:\windows\SYSTEM32\Adobe\Shockwave 11\iml32.dll
    + 2009-07-31 12:54 . 2009-07-31 12:54 1886320 c:\windows\SYSTEM32\Adobe\Shockwave 11\gt.exe
    + 2009-07-31 13:04 . 2009-07-31 13:04 1798144 c:\windows\SYSTEM32\Adobe\Shockwave 11\dirapi.dll
    - 2008-09-27 15:45 . 2009-01-17 00:58 1798144 c:\windows\SYSTEM32\Adobe\Shockwave 11\dirapi.dll
    + 2008-05-28 07:35 . 2007-04-14 02:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\Syste m.Web.dll
    - 2007-04-14 02:35 . 2007-04-14 02:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\Syste m.Web.dll
    - 2007-04-14 02:35 . 2007-04-14 02:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\Syste m.dll
    + 2008-05-28 07:35 . 2007-04-14 02:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\Syste m.dll
    + 2008-05-28 06:48 . 2007-04-14 01:57 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor wks.dll
    - 2007-04-14 01:57 . 2007-04-14 01:57 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor wks.dll
    + 2008-05-28 06:48 . 2007-04-14 01:57 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor svr.dll
    - 2007-04-14 01:57 . 2007-04-14 01:57 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor svr.dll
    - 2007-04-14 01:50 . 2007-04-14 01:50 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor lib.dll
    + 2008-05-28 06:43 . 2007-04-14 01:50 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscor lib.dll
    + 2009-11-29 18:25 . 2008-10-16 20:13 1809944 c:\windows\LastGood\system32\wuaueng.dll
    + 2008-10-05 09:12 . 2008-10-05 09:12 4784128 c:\windows\Installer\31da566c.msp
    + 2009-08-06 18:36 . 2009-08-06 18:36 4945408 c:\windows\Installer\26409469.msi
    + 2009-08-06 18:27 . 2009-08-06 18:27 3295232 c:\windows\Installer\2640911d.msi
    + 2009-10-22 02:00 . 2009-10-22 02:00 4733440 c:\windows\Installer\211ba5.msp
    + 2009-05-26 15:10 . 2009-05-26 15:10 3479552 c:\windows\Installer\1d7b378e.msp
    + 2009-07-30 08:01 . 2009-04-30 21:22 1207808 c:\windows\ie8updates\KB972260-IE8\urlmon.dll
    + 2009-07-30 08:01 . 2009-05-13 05:15 5936128 c:\windows\ie8updates\KB972260-IE8\mshtml.dll
    + 2009-07-30 08:01 . 2009-04-30 21:22 1985024 c:\windows\ie8updates\KB972260-IE8\iertutil.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 1208832 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\urlmon.dll
    + 2009-07-29 13:05 . 2009-07-19 13:17 5938176 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll
    + 2009-07-29 13:05 . 2009-07-03 17:06 1985536 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\iertutil.dll
    + 2008-12-11 21:29 . 2009-11-28 17:30 66385428 c:\windows\SYSTEM32\Restore\rstrlog.dat
    + 2006-10-17 18:33 . 2009-07-19 23:48 11067392 c:\windows\SYSTEM32\ieframe.dll
    + 2007-05-09 23:33 . 2009-07-19 23:48 11067392 c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
    + 2009-08-11 03:08 . 2009-08-11 03:08 11315712 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updat es(2)\M953297\M953297Uninstall.msp
    + 2009-08-10 20:09 . 2009-08-10 20:09 17254912 c:\windows\Installer\d536d.msp
    + 2009-07-30 08:01 . 2009-04-30 21:22 11064832 c:\windows\ie8updates\KB972260-IE8\ieframe.dll
    + 2009-07-29 13:05 . 2009-07-19 13:17 11068416 c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\ieframe.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6}"= "c:\documents and settings\Jason\Local Settings\Application Data\CyberDefender\cdmyidd.dll" [2009-08-15 3962184]

    [HKEY_CLASSES_ROOT\clsid\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6}]
    [HKEY_CLASSES_ROOT\Cdmyidd.SecurityToolbar.1]
    [HKEY_CLASSES_ROOT\TypeLib\{CD24EB02-9831-4838-99D0-726D411B1328}]
    [HKEY_CLASSES_ROOT\Cdmyidd.SecurityToolbar]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2007-05-13 68856]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
    "DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-04-23 801904]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "DIGServices"="c:\program files\ESPNRunTime\DIGServices.exe " [X]
    "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
    "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
    "CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
    "VSOCheckTask"="c:\progra~1\mcafee.com\vso\mcmnhdl r.exe" [2003-08-08 122880]
    "MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent .exe" [2005-09-22 303104]
    "MCUpdateExe"="c:\progra~1\McAfee.com\Agent\McUpda te.exe" [2006-01-11 212992]
    "VirusScan Online"="c:\progra~1\mcafee.com\vso\mcvsshld.exe" [2003-08-18 163840]
    "MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray. exe" [2004-03-24 1380352]
    "Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-12-06 50688]
    "YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.ex e" [2003-12-09 57344]
    "Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\Motive SB.exe" [2003-12-10 380928]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "DIGStream"="c:\program files\DIGStream\digstream.exe" [2005-10-31 278528]
    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-26 185896]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
    "Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2009-05-01 75008]
    "RDVCHG"="c:\program files\Sprint\Sprint SmartView\RDVCHG.exe" [2009-05-01 316672]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
    "mssysfs"="c:\windows\system32\e.exe" [BU]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
    "P17Helper"="P17.dll" - c:\windows\SYSTEM32\P17.dll [2004-06-10 60928]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
    "RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe RealNetworks|RealPlayer|6.0" [X]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2006-2-7 217088]
    HP OfficeJet T Series Startup.lnk - c:\program files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe [2005-1-21 1175552]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "FirewallDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\Windows Media Player\\WMPLAYER.EXE"=
    "c:\\StubInstaller.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "c:\\Program Files\\Sprint\\Sprint SmartView\\SwiApiMux.exe"=
    "c:\\WINDOWS\\SYSTEM32\\GPhotos.scr"=
    "c:\\Program Files\\Intel\\Modem Event Monitor\\IntelMEM.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:Remote Desktop

    R3 hpoid407;IEEE-1284.4 Driver hpoid407;c:\windows\SYSTEM32\DRIVERS\hpoid407.sys [1/21/2005 2:06 AM 50384]
    R3 NaiFiltr;NaiFiltr;c:\windows\SYSTEM32\DRIVERS\NaiF iltr.sys [10/22/2004 8:08 PM 23296]
    S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\Jason\LOCALS~1\T emp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\Jason\LOCALS~1\Temp\SAS_SelfExtract\SA SDIFSV.SYS [?]
    S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\Jason\LOCALS~1\T emp\SAS_SelfExtract\SASKUTIL.sys --> c:\docume~1\Jason\LOCALS~1\Temp\SAS_SelfExtract\SA SKUTIL.sys [?]
    S3 palmmdm;Palm Modem;c:\windows\SYSTEM32\DRIVERS\palmmdm.sys [1/30/2006 12:42 PM 9728]
    S3 SASENUM;SASENUM;\??\c:\docume~1\Jason\LOCALS~1\Tem p\SAS_SelfExtract\SASENUM.SYS --> c:\docume~1\Jason\LOCALS~1\Temp\SAS_SelfExtract\SA SENUM.SYS [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

    2009-11-29 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-13 19:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*Yahoo! SearchBar Home Page
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer = http=localhost:7171
    uInternet Settings,ProxyOverride = *.local;<local>
    uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*Yahoo! UK & Ireland
    IE: &Search
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    LSP: bmnet.dll
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game08.zylom.com/activex/zylomgamesplayer.cab
    FF - ProfilePath - c:\documents and settings\Jason\Application Data\Mozilla\Firefox\Profiles\bwsbtxcx.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Ask
    FF - prefs.js: browser.startup.homepage - Yahoo! UK & Ireland
    FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=
    FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
    FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.
    - - - - ORPHANS REMOVED - - - -

    AddRemove-{C5096216-7703-409E-B85A-8A6EE7395128}}_is1 - c:\program files\System Search Dispatcher\1.3.0.840\unins000.exe



    ************************************************** ************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2009-11-29 12:30
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, GMER - Rootkit Detector and Remover

    device: opened successfully
    user: MBR read successfully
    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8224A020]<<
    kernel: MBR read successfully
    detected MBR rootkit hooks:
    \Driver\Disk -> CLASSPNP.SYS @ 0xf86bcf28
    \Driver\ACPI -> ACPI.sys @ 0xf85afcb8
    \Driver\atapi -> 0x8224a020
    IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8
    \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8
    NDIS: Intel(R) PRO/100 VE Network Connection -> SendCompleteHandler -> 0x822868d0
    PacketIndicateHandler -> NDIS.sys @ 0xf83eaa21
    SendHandler -> NDIS.sys @ 0xf83c887b
    Warning: possible MBR rootkit infection !
    copy of MBR has been found in sector 0x094FE9BD
    malicious code @ sector 0x094FE9C0 !
    PE file found in sector at 0x094FE9D6 !
    MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

    ************************************************** ************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:0 1,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,a5,34 ,46,75,e7,77,4d,83,01,c4,\
    "3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:0 1,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,a5,34 ,46,75,e7,77,4d,83,01,c4,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'lsass.exe'(748)
    c:\windows\system32\bmnet.dll

    - - - - - - - > 'explorer.exe'(1720)
    c:\windows\system32\WININET.dll
    c:\progra~1\SBCSEL~1\SMARTB~1\SBHook.dll
    c:\program files\iTunes\iTunesMiniPlayer.dll
    c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\i TunesMiniPlayerLocalized.dll
    c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMini Player.dll
    c:\progra~1\mcafee.com\vso\McVSSkt.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\system32\CTsvcCDA.EXE
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\progra~1\mcafee.com\agent\mctskshd.exe
    c:\progra~1\mcafee.com\vso\mcvsrte.exe
    c:\program files\Dell Support Center\bin\sprtsvc.exe
    c:\windows\system32\MsPMSPSv.exe
    c:\progra~1\mcafee.com\vso\mcshield.exe
    c:\windows\system32\Rundll32.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    c:\progra~1\Yahoo!\browser\ycommon.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\progra~1\McAfee.com\PERSON~1\Mp***ent.exe
    c:\progra~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    c:\program files\Hewlett-Packard\HP OfficeJet T Series NT\bin\HPOVDX05.EXE
    c:\windows\system32\hpoipm07.exe
    c:\program files\Microsoft Office\Office10\WINWORD.EXE
    c:\program files\Microsoft Works\WkDStore.exe
    c:\windows\msagent\AgentSvr.exe
    .
    ************************************************** ************************
    .
    Completion time: 2009-11-29 13:18 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-11-29 19:18
    ComboFix2.txt 2009-11-24 22:52
    ComboFix3.txt 2009-07-28 17:38
    ComboFix4.txt 2009-05-09 19:25
    ComboFix5.txt 2009-11-29 17:52

    Pre-Run: 15,497,322,496 bytes free
    Post-Run: 15,602,683,904 bytes free

    - - End Of File - - 143AFFF2970EC8EC41AAA789E707214C
  4. 29-11-2009  #4
    broni
    broni is offline Senior Member
    Browsers are starting now
    Very good


    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.


    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    KillAll::

File::
c:\windows\system32\CF7634.exe


Folder::
c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender


Driver::

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6}"=-
[-HKEY_CLASSES_ROOT\clsid\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6}]
[-HKEY_CLASSES_ROOT\Cdmyidd.SecurityToolbar.1]
[-HKEY_CLASSES_ROOT\TypeLib\{CD24EB02-9831-4838-99D0-726D411B1328}]
[-HKEY_CLASSES_ROOT\Cdmyidd.SecurityToolbar]


RegLockDel::

mbr::

    3. Save the above as CFScript.txt

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




    5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    • A new HijackThis log.
  5. 29-11-2009  #5
    jasonstuckey
    jasonstuckey is offline Junior Member
    Thanks



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:53:10 PM, on 11/29/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\DIGStream\digstream.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\Mp***ent.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\bin\HPOVDX05.EXE
    C:\WINDOWS\system32\hpoipm07.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Yahoo! SearchBar Home Page
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! UK & Ireland
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=localhost:7171
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local;<local>
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: &ESPN - {AE6F2894-AF10-4C9C-B16E-1DFC6FF8C0C6} - C:\Program Files\ESPN\Toolbar\DIGToolBar.dll
    O3 - Toolbar: (no name) - {68FF9E0F-2E96-4467-87FA-1A8B9734C7E7} - (no file)
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
    O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [RDVCHG] "C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [mssysfs] C:\WINDOWS\system32\e.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
    O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
    O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    O4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) - http://zone.msn.com/binFrameWork/v10...I.cab55579.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/do...e_Inst_Win.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) - http://zone.msn.com/binframework/v10...t.cab55579.cab
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.myheritage.com/FP/ImageUp...eUploader5.cab
    O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.g...tl_0_0_0_1.ocx
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames...1.cab60096.cab
    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames...l.cab55579.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor....cab102118.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10...y.cab55579.cab
    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - SmithMicro Inc. - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

    --
    End of file - 14122 bytes




    ComboFix 09-11-29.02 - Jason 11/29/2009 16:52.6.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.244 [GMT -6:00]
    Running from: c:\documents and settings\Jason\Desktop\Computer fix programs\ComboFix.exe
    Command switches used :: c:\documents and settings\Jason\Desktop\CFScript.txt
    AV: McAfee VirusScan *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    FILE ::
    "c:\windows\system32\CF7634.exe"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\DoubleD
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\database.db
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Download\stbarpat.dat.03
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Download\wsliveup.dat.03
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Includes\Loading.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Includes\NoItems Index.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Includes\Password Cookie.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Includes\Passwords Index.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Includes\Privacy Index.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\charset.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\cookie.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\defaultCharset.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\form.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\frame.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\gray.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\green.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\host.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bg.jpg
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bg_button.jpg
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bg_top.jpg
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bt_go.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bt_go_down.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bt_go_over.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bt_grey.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bt_red - Copy.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bt_red.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bt_red_down.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\bt_red_over.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\caution.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\frame.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\logo.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\logo.jpg
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\logo_orange.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\topbar.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\topbar_orange.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\images\warning.gif
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\popup.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\port.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\protocol.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\red.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\referrer.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\scamalert.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\scamalert.htm1
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\script.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\security.html
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\style.css
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\Scam Alert\yellow.htm
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\stbarpat.dat.03
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\UserGuide\cybdefstbar.set
    c:\documents and settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\CyberDefender\wsliveup.dat.03
    c:\windows\system32\CF7634.exe

    .
    ((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-29 )))))))))))))))))))))))))))))))
    .

    2009-11-29 18:20 . 2004-08-04 10:00 4224 ------w- c:\windows\system32\drivers\beep.sys
    2009-11-29 17:40 . 2009-11-29 17:40 -------- d-----w- c:\documents and settings\Jason_2\Application Data\Yahoo!
    2009-11-29 02:57 . 2009-11-29 02:57 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\SUPERAntiSpyware.com
    2009-11-29 01:57 . 2009-11-29 01:57 -------- d-----w- c:\documents and settings\Jason\Application Data\SUPERAntiSpyware.com
    2009-11-29 01:57 . 2009-11-29 01:57 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-11-29 01:39 . 2009-11-29 01:39 -------- d-----w- c:\program files\CCleaner
    2009-11-29 01:38 . 2009-11-29 00:44 79488 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2009-11-29 00:44 . 2009-11-29 00:44 79488 ----a-w- c:\documents and settings\Jason\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2009-11-28 18:06 . 2009-11-28 18:06 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\UserData
    2009-11-28 18:06 . 2009-11-28 18:06 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Shared
    2009-11-28 18:06 . 2009-11-28 18:06 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\PrivacIE
    2009-11-28 18:04 . 2009-11-28 18:04 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Yahoo
    2009-11-28 18:04 . 2009-11-28 18:04 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Unity
    2009-11-28 18:04 . 2009-11-28 18:04 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\The Weather Channel
    2009-11-28 18:03 . 2009-11-28 18:03 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\SupportSoft
    2009-11-28 18:03 . 2009-11-28 18:03 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Powercinema
    2009-11-28 18:03 . 2009-11-28 18:03 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\MTV Networks
    2009-11-28 18:03 . 2009-11-28 18:03 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Mozilla
    2009-11-28 18:02 . 2009-11-28 18:02 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup
    2009-11-28 18:02 . 2009-11-28 18:02 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\KodakGallery
    2009-11-28 18:02 . 2009-11-28 18:02 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer
    2009-11-28 17:59 . 2009-11-28 17:59 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Yahoo!
    2009-11-28 17:59 . 2009-11-28 17:59 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\WeatherBug
    2009-11-28 17:59 . 2009-11-28 17:59 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\U3
    2009-11-28 17:59 . 2009-11-28 17:59 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Talkback
    2009-11-28 17:59 . 2009-08-21 18:41 152576 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sun\Java\jre1.6.0_15\lzma.dll
    2009-11-28 17:59 . 2009-07-09 18:55 152576 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sun\Java\jre1.6.0_14\lzma.dll
    2009-11-28 17:59 . 2009-03-18 19:47 152576 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sun\Java\jre1.6.0_11\lzma.dll
    2009-11-28 17:59 . 2007-10-23 14:27 110592 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\U3\temp\cleanup.exe
    2009-11-28 17:58 . 2009-03-18 19:54 348160 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-3c7d0873-n\msvcr71.dll
    2009-11-28 17:58 . 2009-03-18 19:54 503808 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-3c7d0873-n\msvcp71.dll
    2009-11-28 17:58 . 2009-03-18 19:54 499712 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-3c7d0873-n\jmc.dll
    2009-11-28 17:58 . 2009-11-28 17:58 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sprint
    2009-11-28 17:58 . 2009-11-28 17:58 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\SlimBrowser
    2009-11-28 17:58 . 2009-11-28 17:58 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Sierra Wireless
    2009-11-28 17:55 . 2009-11-28 17:55 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Netscape
    2009-11-28 17:54 . 2009-11-28 17:54 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Motive
    2009-11-28 17:54 . 2009-03-09 17:29 97144 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
    2009-11-28 17:54 . 2006-08-30 02:04 8854 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\PDTHelpShortcut__4B691FC6F103435EA1F 6339BD6C78617_2.exe
    2009-11-28 17:54 . 2006-08-30 02:04 65536 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\PalmDesktopShortcut.exe
    2009-11-28 17:54 . 2006-08-30 02:04 40960 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\NewShortcut6_45BA714564B04B5DBDC240E 20FCDC6DC.exe
    2009-11-28 17:54 . 2006-08-30 02:04 65536 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\NewShortcut1_1.4DA64122_6F1D_4317_BC 6A_2B3299881D1B.exe
    2009-11-28 17:54 . 2006-08-30 02:04 65536 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\ARPPRODUCTICON.exe
    2009-11-28 17:54 . 2006-08-30 02:04 40960 ----a-r- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Microsoft\Installer\{0C0BF96E-05A1-41CA-8F9B-796904BD3C7A}\NewShortcut1_45BA714564B04B5DBDC240E 20FCDC6DC.exe
    2009-11-28 17:54 . 2009-11-28 17:54 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Media Player Classic
    2009-11-28 17:54 . 2009-11-28 17:54 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\McAfee.com Personal Firewall
    2009-11-28 17:53 . 2009-11-28 17:53 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Malwarebytes
    2009-11-28 17:52 . 2009-11-28 17:52 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Leadertech
    2009-11-28 17:52 . 2009-11-28 17:52 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\HotSync
    2009-11-28 17:52 . 2008-11-13 20:29 19115 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\lati.exe
    2009-11-28 17:52 . 2007-07-19 00:44 64512 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\HTML\ite m_templ\coach\RunGdp.exe
    2009-11-28 17:52 . 2007-04-13 01:11 64512 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\HTML\ite m_templ\coach\RunGdp.exe
    2009-11-28 17:52 . 2007-05-10 12:30 225280 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\HTML\Aut oMaintenance\Images.dll
    2009-11-28 17:52 . 2008-02-01 01:23 698511 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\HTML\Aut oMaintenance\AutoMaintenance.dll
    2009-11-28 17:52 . 2007-04-13 01:08 123138 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\HTML\Mak eDesktopShortcut.EXE
    2009-11-28 17:52 . 2007-04-13 01:08 64512 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\HTML\ite m_templ\coach\RunGdp.exe
    2009-11-28 17:29 . 2009-11-28 17:29 -------- d-----w- c:\windows\system32\wbem\Repository
    2009-11-28 17:28 . 2009-11-28 17:28 -------- d-----w- c:\program files\QuickTime
    2009-11-28 17:27 . 2009-11-28 17:27 -------- d-----w- c:\program files\iPod
    2009-11-28 17:27 . 2009-11-28 17:27 -------- d-----w- c:\program files\iTunes
    2009-11-25 16:11 . 2009-11-25 16:11 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.000\UserData
    2009-11-25 16:07 . 2009-11-25 16:07 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.000\IETldCach e
    2009-11-25 16:07 . 2009-11-25 16:07 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.000\IECompatC ache
    2009-11-25 15:58 . 2009-11-28 17:02 -------- d-----w- c:\program files\ATT-SST
    2009-11-25 15:31 . 2009-11-28 17:03 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.000\.limewire
    2009-11-25 15:31 . 2009-11-28 17:03 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.000\.GalleryR emote
    2009-11-25 15:30 . 2009-11-28 17:03 -------- d-s---w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.000
    2009-11-22 15:27 . 2009-11-22 15:27 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\UserData
    2009-11-22 15:21 . 2009-11-22 15:21 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\IECompatCache
    2009-11-22 15:10 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\.limewire
    2009-11-22 15:10 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\.GalleryRemot e
    2009-11-21 03:49 . 2009-11-21 03:49 77251196 ----a-w- c:\temp\JS_-_All_Or_Nothing__US_Version_.zip
    2009-11-21 03:24 . 2009-11-21 03:24 46194609 ----a-w- c:\temp\Justin Bieber - My World.zip
    2009-11-20 00:44 . 2009-11-20 00:44 -------- d-----w- c:\documents and settings\Jason_2\Application Data\Apple Computer
    2009-11-20 00:43 . 2009-11-28 17:22 -------- d-----w- c:\documents and settings\Jason_2\Application Data\SlimBrowser
    2009-11-20 00:23 . 2009-11-20 00:23 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\PrivacIE
    2009-11-20 00:19 . 2009-11-20 00:19 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY\IETldCache
    2009-11-20 00:15 . 2009-11-28 17:22 -------- d-s---w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY
    2009-11-19 22:17 . 2009-11-28 17:23 -------- d-----w- c:\documents and settings\Jason_2\Application Data\U3
    2009-11-19 20:19 . 2009-11-19 20:19 -------- d-sh--w- c:\documents and settings\Jason_2\PrivacIE
    2009-11-19 20:14 . 2009-11-19 20:14 -------- d-sh--w- c:\documents and settings\Jason_2\IETldCache
    2009-11-19 19:56 . 2009-11-19 19:56 -------- d-----w- c:\documents and settings\HelpAssistant\IETldCache
    2009-11-19 19:56 . 2009-11-19 19:56 -------- d-----w- c:\documents and settings\HelpAssistant\IECompatCache
    2009-11-19 19:38 . 2009-11-28 17:24 -------- d-----w- c:\documents and settings\HelpAssistant\.limewire
    2009-11-19 19:38 . 2009-11-28 17:24 -------- d-----w- c:\documents and settings\HelpAssistant\.GalleryRemote
    2009-11-19 19:37 . 2009-11-28 17:24 -------- d-s---w- c:\documents and settings\HelpAssistant
    2009-11-06 15:23 . 2009-11-06 15:23 -------- d-----w- c:\documents and settings\Jason\Application Data\Media Player Classic
    2009-11-06 01:10 . 2009-11-06 01:10 -------- d-----w- c:\documents and settings\Jason\Application Data\NCH Swift Sound
    2009-11-06 01:10 . 2009-11-06 01:10 -------- d-----w- c:\program files\NCH Swift Sound

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2009-11-29 23:29 . 2006-05-20 22:13 -------- d-----w- c:\documents and settings\All Users\Application Data\DIGStream
    2009-11-29 21:41 . 2005-11-01 22:26 37992 ----a-w- c:\documents and settings\Jason\Application Data\wklnhst.dat
    2009-11-29 20:20 . 2009-02-01 22:41 -------- d-----w- c:\documents and settings\Jason\Application Data\SlimBrowser
    2009-11-29 18:36 . 2007-05-13 16:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
    2009-11-29 00:34 . 2004-10-23 02:02 -------- d-----w- c:\program files\Real
    2009-11-29 00:32 . 2005-08-11 00:49 -------- d-----w- c:\program files\Palm
    2009-11-29 00:29 . 2008-02-24 19:19 -------- d-----w- c:\program files\Bonjour
    2009-11-28 19:19 . 2009-11-28 17:59 37890 ----a-w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\wklnhst.dat
    2009-11-28 17:55 . 2009-11-28 17:55 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\NCH Swift Sound
    2009-11-28 17:55 . 2009-11-28 17:54 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Move Networks
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Gtek
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\ESPN
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Download Manager
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\DivX
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\CyberLink
    2009-11-28 17:51 . 2009-11-28 17:50 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Creative
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Arcsoft
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\Apple Computer
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\AdobeUM
    2009-11-28 17:51 . 2009-11-28 17:51 -------- d-----w- c:\documents and settings\HelpAssistant.STUCKEYFAMILY.001\Applicati on Data\.Torrent Swapper
    2009-11-28 17:31 . 2006-02-07 19:56 -------- d-----w- c:\program files\Common Files\Motive
    2009-11-28 17:28 . 2009-09-12 19:42 -------- d-----w- c:\program files\QuickTime(2)
    2009-11-28 17:27 . 2009-09-12 19:45 -------- d-----w- c:\program files\iPod(2)
    2009-11-28 17:27 . 2009-09-12 19:45 -------- d-----w- c:\program files\iTunes(2)
    2009-11-28 17:27 . 2009-01-25 02:32 -------- d-----w- c:\program files\Common Files\Apple
    2009-11-28 17:26 . 2006-07-18 04:18 -------- d-----w- c:\documents and settings\Jason\Application Data\Apple Computer
    2009-11-28 17:25 . 2007-02-27 23:37 -------- d--h--w- c:\documents and settings\Jason\Application Data\Move Networks
    2009-11-28 17:25 . 2009-08-23 19:10 -------- d-----w- c:\documents and settings\Jason\Application Data\U3
    2009-11-28 17:02 . 2006-02-07 19:56 -------- d-----w- c:\program files\SBC Self Support Tool
    2009-11-25 18:18 . 2004-10-23 01:58 -------- d-----w- c:\program files\Java
    2009-11-25 16:05 . 2006-03-28 01:02 -------- d-----w- c:\documents and settings\Jason\Application Data\Motive
    2009-11-25 15:58 . 2006-02-07 19:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
    2009-11-19 20:34 . 2009-02-08 20:22 -------- d--h--w- c:\documents and settings\Jason_2\Application Data\GTek
    2009-10-18 16:02 . 2009-10-18 16:02 -------- d-----w- c:\program files\Microsoft Silverlight
    2006-04-29 20:12 . 2006-04-29 20:12 774144 ----a-w- c:\program files\RngInterstitial.dll
    2009-05-07 14:19 . 2009-05-06 21:01 3693344 --sha-w- c:\windows\SYSTEM32\DRIVERS\fidbox.dat
    2009-05-07 14:19 . 2009-05-06 21:01 288 --sha-w- c:\windows\SYSTEM32\DRIVERS\fidbox2.dat
    .

    ((((((((((((((((((((((((((((( SnapShot_2009-11-29_18.33.07 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-11-29 23:16 . 2009-11-29 23:16 16384 c:\windows\Temp\Perflib_Perfdata_6e0.dat
    + 2005-05-26 09:16 . 2009-08-07 01:24 44768 c:\windows\SYSTEM32\wups2.dll
    + 2004-11-05 13:14 . 2009-08-07 01:24 35552 c:\windows\SYSTEM32\wups.dll
    + 2004-11-05 13:14 . 2009-08-07 01:24 35552 c:\windows\SYSTEM32\DLLCACHE\wups.dll
    - 2009-11-24 23:19 . 2009-05-26 11:40 26488 c:\windows\SoftwareDistribution\Download\e15760431 e46367ca5a3dfd40a9d03e3\update\spcustom.dll
    - 2009-11-24 23:19 . 2009-05-26 11:40 17272 c:\windows\SoftwareDistribution\Download\e15760431 e46367ca5a3dfd40a9d03e3\spmsg.dll
    - 2009-11-24 23:21 . 2008-07-08 13:02 26488 c:\windows\SoftwareDistribution\Download\d3767eab8 f4479a8d252b47e8ec225c8\update\spcustom.dll
    - 2009-11-24 23:18 . 2009-10-29 02:03 16896 c:\windows\SoftwareDistribution\Download\9e970568c 595db5e0a749b72a9ab2cda\update\tzchange.dll
    - 2009-11-24 23:18 . 2009-05-26 11:40 26488 c:\windows\SoftwareDistribution\Download\9e970568c 595db5e0a749b72a9ab2cda\update\spcustom.dll
    - 2009-11-24 23:18 . 2009-10-28 15:07 46080 c:\windows\SoftwareDistribution\Download\9e970568c 595db5e0a749b72a9ab2cda\tzchange.exe
    - 2009-11-24 23:18 . 2009-10-29 02:03 16896 c:\windows\SoftwareDistribution\Download\9e970568c 595db5e0a749b72a9ab2cda\tzchange.dll
    - 2009-11-24 23:18 . 2009-05-26 11:40 17272 c:\windows\SoftwareDistribution\Download\9e970568c 595db5e0a749b72a9ab2cda\spmsg.dll
    - 2009-11-24 23:19 . 2008-07-08 13:02 26488 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\update\spcustom.dll
    - 2009-11-24 23:19 . 2008-07-08 13:02 17272 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\spmsg.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 12800 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\xpshims.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 55296 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\msfeedsbs.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 25600 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\jsproxy.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 12800 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\xpshims.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 55296 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\msfeedsbs.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 25600 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\jsproxy.dll
    - 2009-11-24 23:21 . 2008-07-08 13:02 26488 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\update\spcustom.dll
    - 2009-11-24 23:21 . 2008-07-08 13:02 17272 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\spmsg.dll
    - 2009-06-12 12:03 . 2009-06-12 12:03 80896 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\sp3qfe\tlntsess.exe
    - 2009-06-12 12:03 . 2009-06-12 12:03 76288 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\sp3qfe\telnet.exe
    - 2009-06-12 12:31 . 2009-06-12 12:31 80896 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\sp3gdr\tlntsess.exe
    - 2009-06-12 12:31 . 2009-06-12 12:31 76288 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\sp3gdr\telnet.exe
    - 2009-11-24 23:19 . 2009-05-26 11:40 382840 c:\windows\SoftwareDistribution\Download\e15760431 e46367ca5a3dfd40a9d03e3\update\updspapi.dll
    - 2009-11-24 23:19 . 2009-05-26 11:40 755576 c:\windows\SoftwareDistribution\Download\e15760431 e46367ca5a3dfd40a9d03e3\update\update.exe
    - 2009-11-24 23:19 . 2009-05-26 11:40 231288 c:\windows\SoftwareDistribution\Download\e15760431 e46367ca5a3dfd40a9d03e3\spuninst.exe
    - 2009-11-24 23:21 . 2009-05-26 11:40 382840 c:\windows\SoftwareDistribution\Download\d3767eab8 f4479a8d252b47e8ec225c8\update\updspapi.dll
    - 2009-11-24 23:21 . 2009-05-26 11:40 755576 c:\windows\SoftwareDistribution\Download\d3767eab8 f4479a8d252b47e8ec225c8\update\update.exe
    - 2009-11-24 23:18 . 2009-05-26 11:40 382840 c:\windows\SoftwareDistribution\Download\9e970568c 595db5e0a749b72a9ab2cda\update\updspapi.dll
    - 2009-11-24 23:18 . 2009-05-26 11:40 755576 c:\windows\SoftwareDistribution\Download\9e970568c 595db5e0a749b72a9ab2cda\update\update.exe
    - 2009-11-24 23:18 . 2009-05-26 11:40 231288 c:\windows\SoftwareDistribution\Download\9e970568c 595db5e0a749b72a9ab2cda\spuninst.exe
    - 2009-11-24 23:19 . 2009-05-26 11:40 382840 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\update\updspapi.dll
    - 2009-11-24 23:19 . 2008-07-08 13:02 755576 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\update\update.exe
    - 2009-11-24 23:19 . 2008-07-08 13:02 231288 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\spuninst.exe
    - 2009-11-24 23:19 . 2009-08-29 08:01 916480 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\wininet.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 206848 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\occache.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 594432 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\msfeeds.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 246272 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\ieproxy.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 184320 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\iepeers.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 387584 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\iedkcs32.dll
    - 2009-11-24 23:19 . 2009-08-28 10:07 173056 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\ie4uinit.exe
    - 2009-11-24 23:19 . 2009-08-29 08:08 916480 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\wininet.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 206848 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\occache.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 594432 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\msfeeds.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 246272 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\ieproxy.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 184320 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\iepeers.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 387584 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\iedkcs32.dll
    - 2009-11-24 23:19 . 2009-08-28 10:35 173056 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\ie4uinit.exe
    - 2009-11-24 23:21 . 2009-05-26 11:40 382840 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\update\updspapi.dll
    - 2009-11-24 23:21 . 2009-05-26 11:40 755576 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\update\update.exe
    - 2009-11-24 23:21 . 2008-07-08 13:02 231288 c:\windows\SoftwareDistribution\Download\07a96de17 6867bc25b7dc839d22b07e2\spuninst.exe
    - 2009-11-24 23:19 . 2009-08-13 13:55 1748992 c:\windows\SoftwareDistribution\Download\e15760431 e46367ca5a3dfd40a9d03e3\SP3QFE\asms\10\msft\window s\gdiplus\gdiplus.dll
    - 2009-07-17 16:01 . 2009-07-17 16:01 1435648 c:\windows\SoftwareDistribution\Download\d3767eab8 f4479a8d252b47e8ec225c8\sp3qfe\query.dll
    - 2009-07-17 16:22 . 2009-07-17 16:22 1435648 c:\windows\SoftwareDistribution\Download\d3767eab8 f4479a8d252b47e8ec225c8\sp3gdr\query.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 1209344 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\urlmon.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 5942272 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\mshtml.dll
    - 2009-11-24 23:19 . 2009-08-29 08:01 1986048 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\iertutil.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 1208832 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\urlmon.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 5940224 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\mshtml.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 1985536 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\iertutil.dll
    - 2009-08-29 19:31 . 2009-08-29 19:31 11069952 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3QFE\ieframe.dll
    - 2009-11-24 23:19 . 2009-08-29 08:08 11069440 c:\windows\SoftwareDistribution\Download\9e56f14e7 203556d1448d8e8d058de0f\SP3GDR\ieframe.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2007-05-13 68856]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
    "DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-04-23 801904]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "DIGServices"="c:\program files\ESPNRunTime\DIGServices.exe " [X]
    "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
    "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
    "CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
    "VSOCheckTask"="c:\progra~1\mcafee.com\vso\mcmnhdl r.exe" [2003-08-08 122880]
    "MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent .exe" [2005-09-22 303104]
    "MCUpdateExe"="c:\progra~1\McAfee.com\Agent\McUpda te.exe" [2006-01-11 212992]
    "VirusScan Online"="c:\progra~1\mcafee.com\vso\mcvsshld.exe" [2003-08-18 163840]
    "MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray. exe" [2004-03-24 1380352]
    "Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-12-06 50688]
    "YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.ex e" [2003-12-09 57344]
    "Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\Motive SB.exe" [2003-12-10 380928]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "DIGStream"="c:\program files\DIGStream\digstream.exe" [2005-10-31 278528]
    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-26 185896]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
    "Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2009-05-01 75008]
    "RDVCHG"="c:\program files\Sprint\Sprint SmartView\RDVCHG.exe" [2009-05-01 316672]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
    "mssysfs"="c:\windows\system32\e.exe" [BU]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
    "P17Helper"="P17.dll" - c:\windows\SYSTEM32\P17.dll [2004-06-10 60928]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
    "RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe RealNetworks|RealPlayer|6.0" [X]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2006-2-7 217088]
    HP OfficeJet T Series Startup.lnk - c:\program files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe [2005-1-21 1175552]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "FirewallDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\Windows Media Player\\WMPLAYER.EXE"=
    "c:\\StubInstaller.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "c:\\Program Files\\Sprint\\Sprint SmartView\\SwiApiMux.exe"=
    "c:\\WINDOWS\\SYSTEM32\\GPhotos.scr"=
    "c:\\Program Files\\Intel\\Modem Event Monitor\\IntelMEM.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:Remote Desktop

    R3 hpoid407;IEEE-1284.4 Driver hpoid407;c:\windows\SYSTEM32\DRIVERS\hpoid407.sys [1/21/2005 2:06 AM 50384]
    R3 NaiFiltr;NaiFiltr;c:\windows\SYSTEM32\DRIVERS\NaiF iltr.sys [10/22/2004 8:08 PM 23296]
    S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\Jason\LOCALS~1\T emp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\Jason\LOCALS~1\Temp\SAS_SelfExtract\SA SDIFSV.SYS [?]
    S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\Jason\LOCALS~1\T emp\SAS_SelfExtract\SASKUTIL.sys --> c:\docume~1\Jason\LOCALS~1\Temp\SAS_SelfExtract\SA SKUTIL.sys [?]
    S3 palmmdm;Palm Modem;c:\windows\SYSTEM32\DRIVERS\palmmdm.sys [1/30/2006 12:42 PM 9728]
    S3 SASENUM;SASENUM;\??\c:\docume~1\Jason\LOCALS~1\Tem p\SAS_SelfExtract\SASENUM.SYS --> c:\docume~1\Jason\LOCALS~1\Temp\SAS_SelfExtract\SA SENUM.SYS [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

    2009-11-29 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-13 19:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*Yahoo! SearchBar Home Page
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer = http=localhost:7171
    uInternet Settings,ProxyOverride = *.local;<local>
    uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*Yahoo! UK & Ireland
    IE: &Search
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    LSP: bmnet.dll
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game08.zylom.com/activex/zylomgamesplayer.cab
    FF - ProfilePath - c:\documents and settings\Jason\Application Data\Mozilla\Firefox\Profiles\bwsbtxcx.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Ask
    FF - prefs.js: browser.startup.homepage - Yahoo! UK & Ireland
    FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=
    FF - component: c:\documents and settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
    FF - component: c:\documents and settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
    FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
    FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.

    ************************************************** ************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2009-11-29 17:29
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:0 1,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,a5,34 ,46,75,e7,77,4d,83,01,c4,\
    "3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:0 1,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,a5,34 ,46,75,e7,77,4d,83,01,c4,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'lsass.exe'(740)
    c:\windows\system32\bmnet.dll

    - - - - - - - > 'explorer.exe'(176)
    c:\windows\system32\WININET.dll
    c:\progra~1\SBCSEL~1\SMARTB~1\SBHook.dll
    c:\progra~1\mcafee.com\vso\McVSSkt.dll
    c:\program files\iTunes\iTunesMiniPlayer.dll
    c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\i TunesMiniPlayerLocalized.dll
    c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMini Player.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\system32\CTsvcCDA.EXE
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\progra~1\mcafee.com\agent\mctskshd.exe
    c:\progra~1\mcafee.com\vso\mcvsrte.exe
    c:\program files\Dell Support Center\bin\sprtsvc.exe
    c:\windows\system32\MsPMSPSv.exe
    c:\progra~1\mcafee.com\vso\mcshield.exe
    c:\windows\system32\Rundll32.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    c:\progra~1\Yahoo!\browser\ycommon.exe
    c:\progra~1\McAfee.com\PERSON~1\Mp***ent.exe
    c:\progra~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    c:\program files\Hewlett-Packard\HP OfficeJet T Series NT\bin\HPOVDX05.EXE
    c:\windows\system32\hpoipm07.exe
    .
    ************************************************** ************************
    .
    Completion time: 2009-11-29 17:48 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-11-29 23:48
    ComboFix2.txt 2009-11-29 19:18
    ComboFix3.txt 2009-11-24 22:52
    ComboFix4.txt 2009-07-28 17:38
    ComboFix5.txt 2009-11-29 22:50

    Pre-Run: 15,569,776,640 bytes free
    Post-Run: 15,577,280,512 bytes free

    - - End Of File - - 3CF34F524AD6E04987BEAE68DCBA3F56
  6. 30-11-2009  #6
    broni
    broni is offline Senior Member
    Very good

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start>"Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall"
    Restart computer.



    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: SUPERAntiSpyware.com - Database Definition Information.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Terminate memory threats before quarantining.

    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.

    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: Malwarebytes.org to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    ************************************************** ****************************************
    Due to a bug in Malwarebytes, you may see in MBAM's log following entries:
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a tapi (Rootkit)
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a tapi (Rootkit)
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\atapi (Rootkit)
    DO NOT remove those entries!
    If you do, your computer will become UN-bootable.
    The issue has been fixed in the latest MBAM update, so, it's EXTREMELY important, you update MBAM before you run it.
    ************************************************** **************************************

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!


    STEP 3.
    Post fresh HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
  7. 30-11-2009  #7
    jasonstuckey
    jasonstuckey is offline Junior Member
    New Logs:

    SUPERAntiSpyware Scan Log
    SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

    Generated 11/30/2009 at 05:02 AM

    Application Version : 4.31.1000

    Core Rules Database Version : 4318
    Trace Rules Database Version: 2177

    Scan type : Complete Scan
    Total Scan Time : 10:02:58

    Memory items scanned : 209
    Memory threats detected : 0
    Registry items scanned : 6378
    Registry threats detected : 1
    File items scanned : 240997
    File threats detected : 58

    Adware.DesktopSmileyToolbar
    HKU\S-1-5-21-2341872376-2418399524-2346475032-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{5617ECA9-488D-4BA2-8562-9710B9AB78D2}

    Adware.DoubleD/ISO
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\config.md
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\ipdata.md
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090724-122619.671.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090724-123829.859.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090724-131313.312.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090726-122811.984.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090726-140537.515.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090726-162314.093.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090726-223612.531.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090726-224238.531.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-075049.281.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-104841.046.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-124301.421.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-142028.984.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-152613.625.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-164148.578.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-185804.453.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-190257.046.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090727-191539.328.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090728-075214.031.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\NP_20090728-114611.593.log
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340\rstatus.md
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER\3.4.0.4340
    C:\Documents and Settings\Jason\Local Settings\Application Data\INTERNET SAVING OPTIMIZER

    Trojan.Dropper/Gen-C
    C:\DOCUMENTS AND SETTINGS\HELPASSISTANT.STUCKEYFAMILY\LOCAL SETTINGS\TEMP\D.EXE

    Trojan.Agent/Gen-Nullo[Short]
    C:\DOCUMENTS AND SETTINGS\JASON\LOCAL SETTINGS\APPLICATION DATA\CYBERDEFENDER\CDMYIDD.DLL
    C:\QOOBOX\QUARANTINE\C\BOMP.EXE.VIR
    C:\QOOBOX\QUARANTINE\C\CELKADAA.EXE.VIR
    C:\QOOBOX\QUARANTINE\C\CQCSSS.EXE.VIR
    C:\QOOBOX\QUARANTINE\C\KGGI.EXE.VIR
    C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\EDUWECOTAR.DLL.VIR
    C:\QOOBOX\QUARANTINE\C\TEMP\SSV_WINDOWS2.22.0046.E XE.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\INSTSP2.EXE.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\CLICK_SETU P.EXE.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\CWRST_SETU P.EXE.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\DRIVERS\BE EP.SYS.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\GYPGXUYW.D LL.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\HCFIXV.DLL .VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\LJXAYQTK.D LL.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\LMN_SETUP. EXE.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\NIJEGANO.D LL.VIR.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\QRQIAIDD.D LL.VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\VSAGKK.DLL .VIR
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\XZGNDH.DLL .VIR
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1631\A0271925.DLL
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1631\A0271926.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1631\A0271927.DLL
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1631\A0271928.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1631\A0271930.SYS
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1631\A0271931.SYS
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1664\A0330271.DLL
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1664\A0330272.SYS
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1664\A0330273.SYS
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1668\A0345186.SYS
    C:\WINDOWS\SYSTEM32\DLLCACHE\BEEP.SYS

    Trojan.Agent/Gen-FakeInit
    C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\USERINIT.E XE.VIR

    Trojan.Dropper/Gen-NV
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1660\A0313126.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1668\A0341795.EXE


    __________________________________________________ ______________-

    Malwarebytes' Anti-Malware 1.41
    Database version: 2775
    Windows 5.1.2600 Service Pack 3

    11/30/2009 2:31:18 PM
    mbam-log-2009-11-30 (14-31-18).txt

    Scan type: Full Scan (C:\|)
    Objects scanned: 362664
    Time elapsed: 5 hour(s), 19 minute(s), 56 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 6
    Registry Values Infected: 3
    Registry Data Items Infected: 3
    Folders Infected: 25
    Files Infected: 289

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{877f3eab-4462-44df-8475-6064eafd7fbf} (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extens ions\{0ba0192d-94a5-45e3-b2b8-3ec5a1a0b5ec} (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extens ions\{2224e955-00e9-4613-a844-ce69fccaae91} (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\mssysfs (Trojan.Downloader) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850 (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins (Adware.DoubleD) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Qoobox\Quarantine\C\Documents and Settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\productinfo.dll.vir (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\Documents and Settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Setup.exe.vir (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\Documents and Settings\Jason\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\stbup.exe.vir (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1664\A0330262.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1664\A0330263.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1670\A0346194.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1595\A0268380.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1595\A0268381.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1598\A0269380.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1598\A0269381.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1598\A0270045.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1598\A0270046.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1598\A0271045.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1598\A0271046.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1600\A0271132.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1600\A0271133.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1631\A0271873.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1631\A0271874.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1620\A0271642.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1620\A0271643.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\stbup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\ipdata.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-122619.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-123829.859.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-131313.312.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-122811.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-140537.515.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-162314.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-223612.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-224238.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-075049.281.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-104841.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-124301.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-142028.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-152613.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-164148.578.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-185804.453.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-190257.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-191539.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-075214.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-114611.593.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\rstatus.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\ipdata.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-122619.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-123829.859.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-131313.312.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-122811.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-140537.515.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-162314.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-223612.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-224238.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-075049.281.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-104841.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-124301.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-142028.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-152613.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-164148.578.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-185804.453.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-190257.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-191539.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-075214.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-114611.593.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\rstatus.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\ipdata.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-122619.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-123829.859.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-131313.312.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-122811.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-140537.515.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-162314.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-223612.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-224238.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-075049.281.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-104841.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-124301.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-142028.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-152613.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-164148.578.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-185804.453.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-190257.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-191539.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-075214.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-114611.593.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\rstatus.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\ipdata.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-122619.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-123829.859.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-131313.312.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-122811.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-140537.515.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-162314.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-223612.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-224238.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-075049.281.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-104841.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-124301.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-142028.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-152613.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-164148.578.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-185804.453.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-190257.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-191539.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-075214.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-114611.593.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\rstatus.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\ipdata.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-122619.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-123829.859.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090724-131313.312.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-122811.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-140537.515.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-162314.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-223612.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090726-224238.531.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-075049.281.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-104841.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-124301.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-142028.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-152613.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-164148.578.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-185804.453.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-190257.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090727-191539.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-075214.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\NP_20090728-114611.593.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jason\Local Settings\Application Data\Internet Saving Optimizer\3.4.0.4340\rstatus.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-122355.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-122618.687.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-123829.750.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-131313.062.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-122811.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-140537.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-162312.750.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-223611.140.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-224237.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-075048.718.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-104840.890.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-124301.187.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-142028.843.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-152613.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-164148.140.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-185803.203.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-185803.218.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-190255.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-191538.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090728-075213.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090728-114610.218.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-122355.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-122618.687.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-123829.750.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-131313.062.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-122811.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-140537.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-162312.750.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-223611.140.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-224237.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-075048.718.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-104840.890.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-124301.187.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-142028.843.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-152613.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-164148.140.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-185803.203.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-185803.218.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-190255.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-191538.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090728-075213.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090728-114610.218.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-122355.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-122618.687.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-123829.750.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-131313.062.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-122811.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-140537.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-162312.750.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-223611.140.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-224237.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-075048.718.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-104840.890.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-124301.187.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-142028.843.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-152613.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-164148.140.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-185803.203.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-185803.218.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-190255.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-191538.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090728-075213.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.000\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090728-114610.218.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-122355.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-122618.687.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-123829.750.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090724-131313.062.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-122811.031.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-140537.093.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-162312.750.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-223611.140.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090726-224237.625.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-075048.718.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-104840.890.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-124301.187.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-142028.843.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-152613.421.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-164148.140.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-185803.203.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-185803.218.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-190255.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090727-191538.671.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090728-075213.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY.001\Local Settings\Application Data\Media Access Startup\1.5.0.850\HJHP_20090728-114610.218.log (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\bg.jpg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\CurrentVersion.xml (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\ExtractZipFile.zip (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\icon.ico (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\tdf.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\Data\ProductInfo.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\01c9eb2893468d1fba80553d2b 75bd30.gif (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\867b44b1158783875052f103c3 a2f11a.gif (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\bc83ac54dd36e7479704363c8f bd7e43.gif (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\c14631dd1d688aa0ae8e9c9dd3 96c653.gif (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\default1.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\loading.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Cache\loading.gif (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_DailyVideo.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Game.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Logo.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Option.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Search.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Smiley_Config.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Smiley_TellAFriend.m x (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Wallpaper.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\Module_Web.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\pixel.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\ProductInfo.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\profile.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\SearchEngineList.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\tbcore.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\ToolbarLayout.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\UpdateCentre.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\UpdateCentreBk.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\URLDynamic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Data\URLStatic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\About.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Component_ComboBox.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_DailyVideo.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Game.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Logo.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Option.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Search.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Smiley.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Wallpaper.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\Module_Web.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDefault.png (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDisplay.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDisplay.png (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDisplay18.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnDisplay20.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnGlitters.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnGlitters.png (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnGlitters18.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnGlitters20.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnOption.png (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnSmiley.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnSmiley.png (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnSmiley18.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnSmiley20.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnTellFd.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnTellFd.png (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnTellFd18.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnTellFd20.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnWink.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnWink.png (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnWink18.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Icons\TBBtnWink20.bmp (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\myskin1.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\myskin2.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\myskin3.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\myskin4.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\TellafriendSkin_s.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HelpAssistant.STUCKEYFAMILY\Local Settings\Temporary Internet Files\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\TDF\Skins\ToastSkin.skf (Adware.DoubleD) -> Quarantined and deleted successfully.


    __________________________________________________ ______



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:16:37 PM, on 11/30/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\DIGStream\digstream.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\Mp***ent.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\bin\HPOVDX05.EXE
    C:\WINDOWS\system32\hpoipm07.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Yahoo! SearchBar Home Page
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! UK & Ireland
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=localhost:7171
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local;<local>
    R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Dealio Toolbar\SearchSettings.dll
    O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Dealio Toolbar\SearchSettings.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: &ESPN - {AE6F2894-AF10-4C9C-B16E-1DFC6FF8C0C6} - C:\Program Files\ESPN\Toolbar\DIGToolBar.dll
    O3 - Toolbar: (no name) - {68FF9E0F-2E96-4467-87FA-1A8B9734C7E7} - (no file)
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
    O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [RDVCHG] "C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Dealio Toolbar\SearchSettings.exe
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
    O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
    O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    O4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) - http://zone.msn.com/binFrameWork/v10...I.cab55579.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/do...e_Inst_Win.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) - http://zone.msn.com/binframework/v10...t.cab55579.cab
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.myheritage.com/FP/ImageUp...eUploader5.cab
    O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.g...tl_0_0_0_1.ocx
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames...1.cab60096.cab
    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames...l.cab55579.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor....cab102118.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10...y.cab55579.cab
    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - SmithMicro Inc. - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

    --
    End of file - 14836 bytes
  8. 30-11-2009  #8
    broni
    broni is offline Senior Member
    Download Dr.Web CureIt to the desktop:
    ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
    • Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.
    • This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
    • Once the short scan has finished, select Complete scan.
    • Click the green arrow at the right, and the scan will start.
    • Click Yes to all if it asks if you want to cure/move the file.
    • When the scan has finished, in the menu, click File and choose Save report list
    • Save the report to your desktop. The report will be called DrWeb.csv
    • Close Dr.Web Cureit.
    • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
    • Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.


    NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.


    Post fresh HijackThis log as well.
  9. 01-12-2009  #9
    jasonstuckey
    jasonstuckey is offline Junior Member
    DrWeb

    DSRIRREM.EXE;C:\WINDOWS\system32;Trojan.DownLoader .origin;Incurable.Moved.;



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:02:18 PM, on 11/30/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\DIGStream\digstream.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\Mp***ent.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\bin\HPOVDX05.EXE
    C:\WINDOWS\system32\hpoipm07.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Documents and Settings\Jason\Desktop\drweb-cureit.exe
    C:\DOCUME~1\Jason\LOCALS~1\Temp\RarSFX0\3b8vp9.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\DOCUME~1\Jason\LOCALS~1\Temp\RarSFX0\fx2a8XP.ex e
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Yahoo! SearchBar Home Page
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! UK & Ireland
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=localhost:7171
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local;<local>
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: &ESPN - {AE6F2894-AF10-4C9C-B16E-1DFC6FF8C0C6} - C:\Program Files\ESPN\Toolbar\DIGToolBar.dll
    O3 - Toolbar: (no name) - {68FF9E0F-2E96-4467-87FA-1A8B9734C7E7} - (no file)
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
    O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [RDVCHG] "C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'HelpAssistant')
    O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'HelpAssistant')
    O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User 'HelpAssistant')
    O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe (User 'HelpAssistant')
    O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter (User 'HelpAssistant')
    O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" (User 'HelpAssistant')
    O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1010\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Jason_2')
    O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-500\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Administrator')
    O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
    O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    O4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O10 - Unknown file in Winsock LSP: bmnet.dll
    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) - http://zone.msn.com/binFrameWork/v10...I.cab55579.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/do...e_Inst_Win.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) - http://zone.msn.com/binframework/v10...t.cab55579.cab
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.myheritage.com/FP/ImageUp...eUploader5.cab
    O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.g...tl_0_0_0_1.ocx
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames...1.cab60096.cab
    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames...l.cab55579.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor....cab102118.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10...y.cab55579.cab
    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - SmithMicro Inc. - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

    --
    End of file - 15930 bytes
  10. 01-12-2009  #10
    broni
    broni is offline Senior Member
    Save 20% on AVG Internet Security 2012 Suite!
    Print this post out, since you won't have an access to it, at some point.

    1. Open HijackThis.

    2. Close all windows, except for HijackThis.

    3. Put checkmarks next to the following HijackThis entries:

    - O3 - Toolbar: (no name) - {68FF9E0F-2E96-4467-87FA-1A8B9734C7E7} - (no file)
    - O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present


    4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed) - give your computer some breathing room; this is insane number of startups:

    - O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    - O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    - O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    - O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    - O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    - O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    - O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    - O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    - O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    - O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    - O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    - O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    - O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    - O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    - O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    - O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    - O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    - O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    - O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'HelpAssistant')
    - O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'HelpAssistant')
    - O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User 'HelpAssistant')
    - O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1004\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter (User 'HelpAssistant')
    - O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-1010\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Jason_2')
    - O4 - HKUS\S-1-5-21-2341872376-2418399524-2346475032-500\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Administrator')
    - O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM')
    - O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
    - O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    - O4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series NT\Bin\HPOstr05.exe
    - O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    - O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


    5. Click on Fix checked button.

    6. Restart computer.

    7. Post new HijackThis log.
+ Reply to Thread
Page 1 of 2 1 2 LastLast
« [Resolved] Please help my PC says I have 34 viruses! :-( | [Active] Google links redirecting »