Help with removal of gaopdxcounter

[Jared]

Hello,
My business computer is infected with gaopdxcounter.  Could someone please help me in removing the malware?
I've followed your recommended steps of creating logs with SuperAntispyware, Malwarebytes' Anti-Malware & HijackThis:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/29/2010 at 11:19 AM

Application Version : 4.36.1006

Core Rules Database Version : 4867
Trace Rules Database Version: 2679

Scan type       : Complete Scan
Total Scan Time : 00:41:51

Memory items scanned      : 559
Memory threats detected   : 0
Registry items scanned    : 6447
Registry threats detected : 0
File items scanned        : 50112
File threats detected     : 1

NotHarmful.Sysinternals Bluescreen Screen Saver
   C:\PROGRAM FILES\SYSINTERNALS_AUG04\SYSINTERNALS BLUESCREEN.SCR

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

4/29/2010 12:34:01 PM
mbam-log-2010-04-29 (12-34-01).txt

Scan type: Quick scan
Objects scanned: 173968
Time elapsed: 7 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gaopdxserv.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:22:47 PM, on 4/29/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\PROGRA~1\NetIQ\Endpoint\endpoint.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\Sophos\Remote Management System\RouterNT.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://prp.admin.washington.edu/opus/info.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Microsoft Office Outlook 2007.lnk = ?
O4 - Global Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Global Startup: Sophos AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://dirtyharry.police.washington.edu (HKLM)
O15 - Trusted Zone: http://weblogin.washington.edu (HKLM)
O15 - Trusted Zone: http://www.washington.edu (HKLM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229534206550
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229534193269
O16 - DPF: {A9DAF0F6-C13F-4D88-BFA3-39A5F7C22919} (LabelsAnywhere Web Engine) - http://labelsanywhere.com/downloads/FilingTechEngine.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nebula2.washington.edu
O17 - HKLM\Software\..\Telephony: DomainName = clients.nebula2.washington.edu
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD37D7E0-2E02-4024-9DB1-32A0F79256E4}: NameServer = 128.95.120.1,128.95.112.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nebula2.washington.edu
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BOINC - Space Sciences Laboratory - C:\Program Files\BOINC\boinc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NetIQ Endpoint (NetIQEndpoint) - NetIQ Corporation - C:\PROGRA~1\NetIQ\Endpoint\endpoint.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos Agent - Sophos Plc - C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Sophos Message Router - Sophos Plc - C:\Program Files\Sophos\Remote Management System\RouterNT.exe

--
End of file - 8265 bytes

[SuperDave]

Hello and welcome to

Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.

==================================

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

Internet Explorer's security is based upon a set of zones. Each zone has different security in terms of what scripts and applications can be run from a site that is in that zone. There is a security zone called the Trusted Zone. This zone has the lowest security and allows scripts and applications from sites in this zone to run without your knowledge. It is therefore a popular setting for malware sites to use so that future infections can be easily done on your computer without your knowledge as these sites will be in the Trusted Zone. Therefore, I recommend that nothing be allowed in the trusted zone. If you agree, please check the following lines.

O15 - Trusted Zone: http://dirtyharry.police.washington.edu (HKLM)
O15 - Trusted Zone: http://weblogin.washington.edu (HKLM)
O15 - Trusted Zone: http://www.washington.edu (HKLM)



Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.
====================================
Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console[/list]

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you.  Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see How to use ComboFix

[Jared]

Hello SuperDave,

I've followed the recommended steps and disabled Windows Messenger.
For HijackThis I did not fix the washington.edu sites on the list as they are work related.  I hope that is okay.

Please find below my contents of ComboFix:

ComboFix 10-05-03.06 - johooper 05/04/2010   8:53.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2046.1385 [GMT -7:00]
Running from: c:\documents and settings\johooper\desktop\commy.exe
Command switches used :: /stepdel
AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\johooper\System
c:\documents and settings\johooper\System\win_qs8.jqx
c:\program files\WindowsUpdate
c:\recycler\S-1-5-21-1229272821-2147056981-682003330-500
c:\recycler\S-1-5-21-2915903831-793999233-381150471-500
c:\recycler\S-1-5-21-3581506895-372829268-2320958936-500
c:\recycler\S-1-5-21-3958095517-1460304000-1292286586-500
c:\recycler\S-1-5-21-1229272821-2147056981-682003330-500\desktop.ini
c:\recycler\S-1-5-21-1229272821-2147056981-682003330-500\INFO2
c:\recycler\S-1-5-21-2915903831-793999233-381150471-500\desktop.ini
c:\recycler\S-1-5-21-2915903831-793999233-381150471-500\INFO2
c:\recycler\S-1-5-21-3581506895-372829268-2320958936-500\desktop.ini
c:\recycler\S-1-5-21-3581506895-372829268-2320958936-500\INFO2
c:\recycler\S-1-5-21-3958095517-1460304000-1292286586-500\desktop.ini
c:\recycler\S-1-5-21-3958095517-1460304000-1292286586-500\INFO2

----- BITS: Possible infected sites -----

hxxp://reflection.nebula2.washington.edu:80
hxxp://whirlwind.cac.washington.edu
.
(((((((((((((((((((((((((   Files Created from 2010-04-04 to 2010-05-04  )))))))))))))))))))))))))))))))
.

2010-05-03 17:45 . 2010-05-03 17:45   768   ----a-w-   c:\windows\system32\d3d8caps.dat
2010-04-29 20:13 . 2010-04-29 20:13   --------   d-----w-   c:\program files\Trend Micro
2010-04-29 19:51 . 2010-04-29 19:51   --------   d-----w-   c:\program files\Common Files\Java
2010-04-29 19:51 . 2010-04-29 19:51   61440   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d8b65d6-n\decora-sse.dll
2010-04-29 19:51 . 2010-04-29 19:51   503808   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1626aeab-n\msvcp71.dll
2010-04-29 19:51 . 2010-04-29 19:51   499712   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1626aeab-n\jmc.dll
2010-04-29 19:51 . 2010-04-29 19:51   348160   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1626aeab-n\msvcr71.dll
2010-04-29 19:51 . 2010-04-29 19:51   12800   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d8b65d6-n\decora-d3d.dll
2010-04-29 19:51 . 2010-04-29 19:51   411368   ----a-w-   c:\windows\system32\deployJava1.dll
2010-04-29 19:51 . 2010-04-29 19:51   --------   d-----w-   c:\program files\Java
2010-04-29 19:50 . 2010-04-29 19:50   79488   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-29 19:50 . 2010-04-29 19:50   152576   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-29 18:29 . 2010-04-29 18:29   --------   d-----w-   c:\documents and settings\johooper\Application Data\Malwarebytes
2010-04-29 18:29 . 2010-04-29 19:19   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 18:29 . 2010-04-29 18:29   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-29 18:29 . 2010-04-29 19:19   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-04-29 18:29 . 2010-04-29 18:29   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-04-29 17:33 . 2010-04-30 19:49   62976   ----a-w-   c:\documents and settings\johooper\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-04-29 17:33 . 2010-04-29 17:33   52224   ----a-w-   c:\documents and settings\johooper\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-29 17:33 . 2010-05-03 14:58   117760   ----a-w-   c:\documents and settings\johooper\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-29 17:32 . 2010-04-29 17:32   --------   d-----w-   c:\program files\SUPERAntiSpyware
2010-04-29 17:31 . 2010-04-29 17:31   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
2010-04-29 17:21 . 2010-04-29 17:21   --------   d-----w-   c:\program files\CCleaner
2010-04-29 15:48 . 2010-04-29 15:48   125952   ----a-w-   c:\documents and settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-04-29 15:47 . 2010-04-29 16:16   48416   --sha-w-   c:\windows\system32\drivers\fidbox.dat
2010-04-29 15:47 . 2010-04-29 16:16   12320   --sha-w-   c:\windows\system32\drivers\fidbox2.dat
2010-04-29 15:41 . 2010-04-29 15:54   --------   d-----w-   c:\program files\Common Files\ParetoLogic
2010-04-29 15:41 . 2010-04-29 15:54   --------   d-----w-   c:\documents and settings\All Users\Application Data\ParetoLogic
2010-04-29 15:18 . 2010-04-29 15:18   --------   d-----w-   c:\documents and settings\johooper\Local Settings\Application Data\Downloaded Installations
2010-04-13 14:48 . 2010-04-13 14:48   --------   d-----w-   c:\windows\ms

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-04 15:58 . 2008-08-26 22:15   --------   d-----w-   c:\program files\BOINC
2010-04-29 18:21 . 2006-07-19 18:14   --------   d-----w-   c:\program files\sysinternals_aug04
2010-04-29 17:32 . 2009-08-04 19:36   --------   d-----w-   c:\documents and settings\johooper\Application Data\SUPERAntiSpyware.com
2010-04-29 17:19 . 2008-11-21 23:27   --------   d-----w-   c:\program files\SmartDraw 2009
2010-04-29 16:21 . 2008-09-10 14:47   --------   d-----w-   c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-29 16:16 . 2010-04-29 15:47   2228   --sha-w-   c:\windows\system32\drivers\fidbox2.idx
2010-04-29 16:16 . 2010-04-29 15:47   1724   --sha-w-   c:\windows\system32\drivers\fidbox.idx
2010-04-29 16:16 . 2009-10-14 15:50   --------   d-----w-   c:\program files\Lavasoft
2010-04-29 14:41 . 2009-05-29 15:09   --------   d---a-w-   c:\documents and settings\All Users\Application Data\TEMP
2010-04-15 14:49 . 2008-12-15 21:32   --------   d-----w-   c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-30 17:51 . 2010-03-30 17:51   --------   d-----w-   c:\program files\Microsoft Silverlight
2010-03-29 17:46 . 2009-10-29 17:15   --------   d-----w-   c:\program files\DYMO Label
2010-03-17 08:01 . 2010-03-04 07:06   26664   ----a-w-   c:\windows\system32\SophosBootTasks.exe
2010-03-17 08:01 . 2010-03-04 07:06   129576   ----a-w-   c:\windows\system32\sdccoinstaller.dll
2010-03-11 12:38 . 2002-12-31 12:00   832512   ----a-w-   c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2002-12-31 12:00   78336   ----a-w-   c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2002-12-31 12:00   17408   ------w-   c:\windows\system32\corpol.dll
2010-03-09 11:09 . 2002-12-31 12:00   430080   ----a-w-   c:\windows\system32\vbscript.dll
2010-02-24 13:11 . 2002-12-31 12:00   455680   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 15:50 . 2009-10-27 14:44   95024   ----a-w-   c:\windows\system32\drivers\SBREDrv.sys
2010-02-16 14:08 . 2002-12-31 12:00   2146304   ----a-w-   c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-03 22:59   2024448   ----a-w-   c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33 . 2002-12-31 12:00   100864   ----a-w-   c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2002-12-31 12:00   226880   ----a-w-   c:\windows\system32\drivers\tcpip6.sys
2008-08-27 17:27 . 2008-08-27 17:27   201712   ----a-w-   c:\program files\sct10en.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-14 88107]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 282624]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-03 7630848]
"nwiz"="nwiz.exe" [2006-10-03 1617920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-03 86016]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-04-02 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\johooper\Start Menu\Programs\Startup\
Microsoft Office Outlook 2007.lnk - c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe [2008-12-15 845584]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BOINC Manager.lnk - c:\program files\BOINC\boincmgr.exe [2007-8-23 4141056]
Sophos AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2010-1-26 429096]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
"ForceStartMenuLogOff"= 1 (0x1)
"RestrictWelcomeCenter"= 1 (0x1)
"NoInplaceSharing"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-08-03 12:12   577536   -c--a-w-   c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/27/2010 5:30 PM 61440]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [3/4/2010 12:05 AM 152192]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [3/4/2010 12:05 AM 24064]
R2 BOINC;BOINC;c:\program files\BOINC\boinc.exe [8/23/2007 5:46 PM 704512]
R2 NetIQEndpoint;NetIQ Endpoint;c:\progra~1\NetIQ\Endpoint\endpoint.exe [7/19/2006 11:13 AM 561212]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [9/7/2009 6:11 AM 104488]
R2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [9/7/2009 6:11 AM 93736]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S3 GTICARD;GTICARD;c:\windows\system32\drivers\gticard.sys [10/23/2003 5:04 PM 76160]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [7/20/2006 10:18 AM 87936]
S3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\drivers\ozscr.sys [4/21/2005 9:58 PM 92550]
S3 sdcfilter;sdcfilter;c:\windows\system32\drivers\sdcfilter.sys [3/4/2010 12:05 AM 23928]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [12/31/2002 5:00 AM 14336]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [3/4/2010 12:05 AM 14976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM   REG_MULTI_SZ      WINRM
.
Contents of the 'Scheduled Tasks' folder

2010-05-04 c:\windows\Tasks\Nebula Daily Scan.job
- c:\program files\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe [2009-09-07 13:11]
.
.
------- Supplementary Scan -------
.
uStart Page = https://prp.admin.washington.edu/opus/info.asp
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: dell.com\rcommerce.us
Trusted Zone: eway.com\www
Trusted Zone: microsoft.com\search.support
Trusted Zone: microsoft.com\support
Trusted Zone: microsoft.com\www
Trusted Zone: vwrsp.com\obi2
Trusted Zone: yourensync.com\boi
Trusted Zone: dell.com\rcommerce.us
Trusted Zone: eway.com\www
Trusted Zone: microsoft.com\search.support
Trusted Zone: microsoft.com\support
Trusted Zone: microsoft.com\www
Trusted Zone: vwrsp.com\obi2
Trusted Zone: washington.edu\dirtyharry.police
Trusted Zone: washington.edu\exchange
Trusted Zone: washington.edu\ftp2.pubserv
Trusted Zone: washington.edu\myuw
Trusted Zone: washington.edu\oars.ehs
Trusted Zone: washington.edu\tbirds-ps.pubserv
Trusted Zone: washington.edu\tbirds-ps2.pubserv
Trusted Zone: washington.edu\tbirds-ps2.uwps.pubserv
Trusted Zone: washington.edu\upws-logic.uwps.pubserv
Trusted Zone: washington.edu\uwnetid
Trusted Zone: washington.edu\uwps-huskies.pubserv
Trusted Zone: washington.edu\uwps-huskies.uwps.pubserv
Trusted Zone: washington.edu\uwps-logic.pubserv
Trusted Zone: washington.edu\uwpss095.pubserv
Trusted Zone: washington.edu\uwpss095.uwps.pubserv
Trusted Zone: washington.edu\uwps_dtcmu.pubserv
Trusted Zone: washington.edu\uwps_dtmcu.uwps.pubserv
Trusted Zone: washington.edu\weblogin
Trusted Zone: washington.edu\www
Trusted Zone: yourensync.com\boi
TCP: {FD37D7E0-2E02-4024-9DB1-32A0F79256E4} = 128.95.120.1,128.95.112.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {A9DAF0F6-C13F-4D88-BFA3-39A5F7C22919} - hxxp://labelsanywhere.com/downloads/FilingTechEngine.cab
.
- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-04 09:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sophos Message Router]
"ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3672)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Sophos\Remote Management System\ManagementAgentNT.exe
c:\program files\Sophos\AutoUpdate\ALsvc.exe
c:\program files\Sophos\Remote Management System\RouterNT.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\CCM\CcmExec.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\rundll32.exe
c:\windows\AGRSMMSG.exe
.
**************************************************************************
.
Completion time: 2010-05-04  09:04:25 - machine was rebooted
ComboFix-quarantined-files.txt  2010-05-04 16:04

Pre-Run: 23,563,407,360 bytes free
Post-Run: 23,465,320,448 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 83AE74B3C605BCF6000AD4BADF598D65

[SuperDave]

For HijackThis I did not fix the washington.edu sites on the list as they are work related.  I hope that is okay.

When you allow trusted zones on your computer you are opening up the front door and saying "come on in and help yourself to all my goodies." Removing this trusted zone will not affect the way you do business on your computer. Also, sorry for the delay.

==============================
Re-running ComboFix to remove infections:

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:
  

  KillAll::
  DDS::
  
  Trusted Zone: dell.com\rcommerce.us
  Trusted Zone: eway.com\www
  Trusted Zone: microsoft.com\search.support
  Trusted Zone: microsoft.com\support
  Trusted Zone: microsoft.com\www
  Trusted Zone: vwrsp.com\obi2
  Trusted Zone: yourensync.com\boi
  Trusted Zone: dell.com\rcommerce.us
  Trusted Zone: eway.com\www
  Trusted Zone: microsoft.com\search.support
  Trusted Zone: microsoft.com\support
  Trusted Zone: microsoft.com\www
  Trusted Zone: vwrsp.com\obi2
  Trusted Zone: washington.edu\dirtyharry.police
  Trusted Zone: washington.edu\exchange
  Trusted Zone: washington.edu\ftp2.pubserv
  Trusted Zone: washington.edu\myuw
  Trusted Zone: washington.edu\oars.ehs
  Trusted Zone: washington.edu\tbirds-ps.pubserv
  Trusted Zone: washington.edu\tbirds-ps2.pubserv
  Trusted Zone: washington.edu\tbirds-ps2.uwps.pubserv
  Trusted Zone: washington.edu\upws-logic.uwps.pubserv
  Trusted Zone: washington.edu\uwnetid
  Trusted Zone: washington.edu\uwps-huskies.pubserv
  Trusted Zone: washington.edu\uwps-huskies.uwps.pubserv
  Trusted Zone: washington.edu\uwps-logic.pubserv
  Trusted Zone: washington.edu\uwpss095.pubserv
  Trusted Zone: washington.edu\uwpss095.uwps.pubserv
  Trusted Zone: washington.edu\uwps_dtcmu.pubserv
  Trusted Zone: washington.edu\uwps_dtmcu.uwps.pubserv
  Trusted Zone: washington.edu\weblogin
  Trusted Zone: washington.edu\www
  Trusted Zone: yourensync.com\boi
  
  
• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

==================================
I'd like us to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[Jared]

After following the steps and dragging CFScript into ComboFix.exe, I only had commy.exe so I dragged it into there.  ComboFix installed a newer version and below is the log:
ComboFix 10-05-10.05 - johooper 05/11/2010  13:47:53.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2046.1347 [GMT -7:00]
Running from: c:\protection\Logs\commy.exe
Command switches used :: c:\protection\Logs\CFScript.txt
AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\ialmuARA.dll
c:\windows\system32\ialmuARB.dll
c:\windows\system32\ialmuCHS.dll
c:\windows\system32\ialmuCHT.dll
c:\windows\system32\ialmuCSY.dll
c:\windows\system32\ialmuDAN.dll
c:\windows\system32\ialmuDEU.dll
c:\windows\system32\ialmudlg.exe
c:\windows\system32\ialmuELL.dll
c:\windows\system32\ialmuENG.dll
c:\windows\system32\ialmuESP.dll
c:\windows\system32\ialmuFIN.dll
c:\windows\system32\ialmuFRA.dll
c:\windows\system32\ialmuFRC.dll
c:\windows\system32\ialmuHEB.dll
c:\windows\system32\ialmuHUN.dll
c:\windows\system32\ialmuITA.dll
c:\windows\system32\ialmuJPN.dll
c:\windows\system32\ialmuKOR.dll
c:\windows\system32\ialmuNLD.dll
c:\windows\system32\ialmuNOR.dll
c:\windows\system32\ialmuPLK.dll
c:\windows\system32\ialmuPTB.dll
c:\windows\system32\ialmuPTG.dll
c:\windows\system32\ialmuRUS.dll
c:\windows\system32\ialmuSVE.dll
c:\windows\system32\ialmuTHA.dll
c:\windows\system32\ialmuTRK.dll
c:\windows\system32\igfxrara.lrc
c:\windows\system32\igfxrchs.lrc
c:\windows\system32\igfxrcht.lrc
c:\windows\system32\igfxrcsy.lrc
c:\windows\system32\igfxrdan.lrc
c:\windows\system32\igfxrdeu.lrc
c:\windows\system32\igfxrell.lrc
c:\windows\system32\igfxrenu.lrc
c:\windows\system32\igfxresp.lrc
c:\windows\system32\igfxrfin.lrc
c:\windows\system32\igfxrfra.lrc
c:\windows\system32\igfxrheb.lrc
c:\windows\system32\igfxrhun.lrc
c:\windows\system32\igfxrita.lrc
c:\windows\system32\igfxrjpn.lrc
c:\windows\system32\igfxrkor.lrc
c:\windows\system32\igfxrnld.lrc
c:\windows\system32\igfxrnor.lrc
c:\windows\system32\igfxrplk.lrc
c:\windows\system32\igfxrptb.lrc
c:\windows\system32\igfxrptg.lrc
c:\windows\system32\igfxrrus.lrc
c:\windows\system32\igfxrsve.lrc
c:\windows\system32\igfxrtha.lrc
c:\windows\system32\igfxrtrk.lrc

----- BITS: Possible infected sites -----

hxxp://reflection.nebula2.washington.edu:80
.
(((((((((((((((((((((((((   Files Created from 2010-04-11 to 2010-05-11  )))))))))))))))))))))))))))))))
.

2010-05-10 16:27 . 2010-05-10 16:27   664   ----a-w-   c:\windows\system32\d3d9caps.dat
2010-05-03 17:45 . 2010-05-03 17:45   768   ----a-w-   c:\windows\system32\d3d8caps.dat
2010-04-29 20:13 . 2010-04-29 20:13   --------   d-----w-   c:\program files\Trend Micro
2010-04-29 19:51 . 2010-04-29 19:51   --------   d-----w-   c:\program files\Common Files\Java
2010-04-29 19:51 . 2010-04-29 19:51   61440   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d8b65d6-n\decora-sse.dll
2010-04-29 19:51 . 2010-04-29 19:51   503808   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1626aeab-n\msvcp71.dll
2010-04-29 19:51 . 2010-04-29 19:51   499712   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1626aeab-n\jmc.dll
2010-04-29 19:51 . 2010-04-29 19:51   348160   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1626aeab-n\msvcr71.dll
2010-04-29 19:51 . 2010-04-29 19:51   12800   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d8b65d6-n\decora-d3d.dll
2010-04-29 19:51 . 2010-04-29 19:51   411368   ----a-w-   c:\windows\system32\deployJava1.dll
2010-04-29 19:51 . 2010-04-29 19:51   --------   d-----w-   c:\program files\Java
2010-04-29 19:50 . 2010-04-29 19:50   79488   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-29 19:50 . 2010-04-29 19:50   152576   ----a-w-   c:\documents and settings\johooper\Application Data\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-29 18:29 . 2010-04-29 18:29   --------   d-----w-   c:\documents and settings\johooper\Application Data\Malwarebytes
2010-04-29 18:29 . 2010-04-29 19:19   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 18:29 . 2010-04-29 18:29   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-29 18:29 . 2010-04-29 19:19   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-04-29 18:29 . 2010-04-29 18:29   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-04-29 17:33 . 2010-05-11 14:38   63488   ----a-w-   c:\documents and settings\johooper\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-04-29 17:33 . 2010-04-29 17:33   52224   ----a-w-   c:\documents and settings\johooper\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-29 17:33 . 2010-05-11 14:38   117760   ----a-w-   c:\documents and settings\johooper\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-29 17:32 . 2010-05-10 14:40   --------   d-----w-   c:\program files\SUPERAntiSpyware
2010-04-29 17:31 . 2010-04-29 17:31   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
2010-04-29 17:21 . 2010-04-29 17:21   --------   d-----w-   c:\program files\CCleaner
2010-04-29 15:48 . 2010-04-29 15:48   125952   ----a-w-   c:\documents and settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-04-29 15:47 . 2010-04-29 16:16   48416   --sha-w-   c:\windows\system32\drivers\fidbox.dat
2010-04-29 15:47 . 2010-04-29 16:16   12320   --sha-w-   c:\windows\system32\drivers\fidbox2.dat
2010-04-29 15:41 . 2010-04-29 15:54   --------   d-----w-   c:\program files\Common Files\ParetoLogic
2010-04-29 15:41 . 2010-04-29 15:54   --------   d-----w-   c:\documents and settings\All Users\Application Data\ParetoLogic
2010-04-29 15:18 . 2010-04-29 15:18   --------   d-----w-   c:\documents and settings\johooper\Local Settings\Application Data\Downloaded Installations
2010-04-13 14:48 . 2010-04-13 14:48   --------   d-----w-   c:\windows\ms

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-11 20:53 . 2008-08-26 22:15   --------   d-----w-   c:\program files\BOINC
2010-04-29 18:21 . 2006-07-19 18:14   --------   d-----w-   c:\program files\sysinternals_aug04
2010-04-29 17:32 . 2009-08-04 19:36   --------   d-----w-   c:\documents and settings\johooper\Application Data\SUPERAntiSpyware.com
2010-04-29 17:19 . 2008-11-21 23:27   --------   d-----w-   c:\program files\SmartDraw 2009
2010-04-29 16:21 . 2008-09-10 14:47   --------   d-----w-   c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-29 16:16 . 2010-04-29 15:47   2228   --sha-w-   c:\windows\system32\drivers\fidbox2.idx
2010-04-29 16:16 . 2010-04-29 15:47   1724   --sha-w-   c:\windows\system32\drivers\fidbox.idx
2010-04-29 16:16 . 2009-10-14 15:50   --------   d-----w-   c:\program files\Lavasoft
2010-04-29 14:41 . 2009-05-29 15:09   --------   d---a-w-   c:\documents and settings\All Users\Application Data\TEMP
2010-04-15 14:49 . 2008-12-15 21:32   --------   d-----w-   c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-30 17:51 . 2010-03-30 17:51   --------   d-----w-   c:\program files\Microsoft Silverlight
2010-03-29 17:46 . 2009-10-29 17:15   --------   d-----w-   c:\program files\DYMO Label
2010-03-17 08:01 . 2010-03-04 07:06   26664   ----a-w-   c:\windows\system32\SophosBootTasks.exe
2010-03-17 08:01 . 2010-03-04 07:06   129576   ----a-w-   c:\windows\system32\sdccoinstaller.dll
2010-03-11 12:38 . 2002-12-31 12:00   832512   ----a-w-   c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2002-12-31 12:00   78336   ----a-w-   c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2002-12-31 12:00   17408   ------w-   c:\windows\system32\corpol.dll
2010-03-09 11:09 . 2002-12-31 12:00   430080   ----a-w-   c:\windows\system32\vbscript.dll
2010-02-24 13:11 . 2002-12-31 12:00   455680   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 15:50 . 2009-10-27 14:44   95024   ----a-w-   c:\windows\system32\drivers\SBREDrv.sys
2010-02-16 14:08 . 2002-12-31 12:00   2146304   ----a-w-   c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-03 22:59   2024448   ----a-w-   c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33 . 2002-12-31 12:00   100864   ----a-w-   c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2002-12-31 12:00   226880   ----a-w-   c:\windows\system32\drivers\tcpip6.sys
2008-08-27 17:27 . 2008-08-27 17:27   201712   ----a-w-   c:\program files\sct10en.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-14 88107]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 282624]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-03 7630848]
"nwiz"="nwiz.exe" [2006-10-03 1617920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-03 86016]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-04-02 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\johooper\Start Menu\Programs\Startup\
Microsoft Office Outlook 2007.lnk - c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe [2008-12-15 845584]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BOINC Manager.lnk - c:\program files\BOINC\boincmgr.exe [2007-8-23 4141056]
Sophos AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2010-1-26 429096]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
"ForceStartMenuLogOff"= 1 (0x1)
"RestrictWelcomeCenter"= 1 (0x1)
"NoInplaceSharing"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-08-03 12:12   577536   -c--a-w-   c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/27/2010 5:30 PM 68168]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [3/4/2010 12:05 AM 152192]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [3/4/2010 12:05 AM 24064]
R2 BOINC;BOINC;c:\program files\BOINC\boinc.exe [8/23/2007 5:46 PM 704512]
R2 NetIQEndpoint;NetIQ Endpoint;c:\progra~1\NetIQ\Endpoint\endpoint.exe [7/19/2006 11:13 AM 561212]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [9/7/2009 6:11 AM 104488]
R2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [9/7/2009 6:11 AM 93736]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S3 GTICARD;GTICARD;c:\windows\system32\drivers\gticard.sys [10/23/2003 5:04 PM 76160]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [7/20/2006 10:18 AM 87936]
S3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\drivers\ozscr.sys [4/21/2005 9:58 PM 92550]
S3 sdcfilter;sdcfilter;c:\windows\system32\drivers\sdcfilter.sys [3/4/2010 12:05 AM 23928]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [12/31/2002 5:00 AM 14336]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [3/4/2010 12:05 AM 14976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM   REG_MULTI_SZ      WINRM
.
Contents of the 'Scheduled Tasks' folder

2010-05-11 c:\windows\Tasks\Nebula Daily Scan.job
- c:\program files\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe [2009-09-07 13:11]
.
.
------- Supplementary Scan -------
.
uStart Page = https://prp.admin.washington.edu/opus/info.asp
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {FD37D7E0-2E02-4024-9DB1-32A0F79256E4} = 128.95.120.1,128.95.112.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {A9DAF0F6-C13F-4D88-BFA3-39A5F7C22919} - hxxp://labelsanywhere.com/downloads/FilingTechEngine.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-11 13:54
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sophos Message Router]
"ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'winlogon.exe'(3464)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(412)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Sophos\Remote Management System\ManagementAgentNT.exe
c:\program files\Sophos\AutoUpdate\ALsvc.exe
c:\program files\Sophos\Remote Management System\RouterNT.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\CCM\CcmExec.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\rundll32.exe
c:\windows\AGRSMMSG.exe
c:\windows\system32\rdpclip.exe
.
**************************************************************************
.
Completion time: 2010-05-11  13:59:21 - machine was rebooted
ComboFix-quarantined-files.txt  2010-05-11 20:59
ComboFix2.txt  2010-05-04 16:04

Pre-Run: 23,295,213,568 bytes free
Post-Run: 23,347,449,856 bytes free

- - End Of File - - ACD69A9F27B4789EFA0CD9F145B672F7


I scanned my computer with ESET OnlineScan and here are the results:

Scan results
No threats found.
Scanned Files:  60,564
Infected Files:  0
Cleaned Files:  0
Total scan time:  01:15:12
Scan status:  Finished

[SuperDave]

Well, that looks good. If there are no other issues, it's time for some clean-up. You can uninstall HJT but you may keep SAS and MBAM. Update them and run them on a regular basis.

To uninstall ComboFix

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in commy /uninstall
  

(Note: Make sure there's a space between the word commy and the forward-slash.)

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

=======================================

Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

======================================

Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
======================================

Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!