Devices not working!

[Mystic220]

There were three files i was not sure of:
  K-Lite Mega Codec pack 6.20
  My APPLication--no info
  VC80CRTRedest

took 5 min to type above-slow keys!

Logs;
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/23/2010 at 05:26 PM

Application Version : 4.44.1000

Core Rules Database Version : 5739
Trace Rules Database Version: 3551

Scan type       : Complete Scan
Total Scan Time : 02:06:11

Memory items scanned      : 668
Memory threats detected   : 0
Registry items scanned    : 8796
Registry threats detected : 0
File items scanned        : 75718
File threats detected     : 3

Adware.Tracking Cookie
   C:\Users\Diana\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Diana\AppData\Roaming\Microsoft\Windows\Cookies\Low\diana@atdmt[1].txt
   C:\Users\Diana\AppData\Roaming\Microsoft\Windows\Cookies\Low\diana@doubleclick[1].txt

---Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4930

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

10/23/2010 6:05:53 PM
mbam-log-2010-10-23 (18-05-53).txt

Scan type: Quick scan
Objects scanned: 144462
Time elapsed: 21 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
---


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:27:55 PM, on 10/23/2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\VitaKey\AC5023\PdtWzd.exe
C:\Program Files\MSN Toolbar\Platform\4.0.0401.0\mswinext.exe
C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files\CyberLink\Shared files\brs.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\HTC\resolution.exe
C:\Program Files\HTC\ShagCtrl.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\VitaKey\AC5023\PwdBank.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HiJackThis\sniper.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.91.48.14:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: MSN Toolbar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0401.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0401.0\npwinext.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [ZPdtWzdVitaKey AC5023] "C:\Program Files\VitaKey\AC5023\PdtWzd.exe" show
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [MSN Toolbar] "C:\Program Files\MSN Toolbar\Platform\4.0.0401.0\mswinext.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [Resolution] C:\Program Files\HTC\resolution.exe
O4 - HKLM\..\Run: [ShagCtrl] C:\Program Files\HTC\ShagCtrl.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Google Update] "C:\Users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RegistryBooster] "C:\Program Files\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1280590727439
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - Winlogon Notify: AWinNotifyVitaKey AC5023 - C:\Program Files\VitaKey\AC5023\WinNotify.dll
O23 - Service: dlbk_device -   - C:\Windows\system32\dlbkcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: shagserv - HTC Corp. - C:\Program Files\HTC\shagserv.exe

--
End of file - 8915 bytes

thanks--so much!

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

Registry cleaners are extremely powerful applications and their potential for harming your OS far outweighs any small potential for improving your computer's performance.
RegistryBooster
There are a number of them available and some are more safe than others. Keep in mind that no two registry cleaners work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad" entry. One cleaner may find entries on your system that will not cause a problem when removed, another may not find the same entries, and still another may want to remove entries required for a program to work. Without research into what the registry entry selected for deletion is, a registry cleaner can end up being an automated method to cause problems with the registry.

For routine use by those not familiar with the registry, the benefits to your computer are negligible while the potential risks are great.

Further reading: XP Fixes Myth #1: Registry Cleaners
**************************************
Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.91.48.14:8080
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.
***********************************
Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
Click Start then copy paste the following command into the search box & hit enter: "%userprofile%\desktop\commy.exe" /stepdel
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. This will not install in Vista. Just continue scanning, and skip the console install.
When finished, it shall produce a log for you.  Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see How to use ComboFix

[Mystic220]

Just a couple of comments -- I have copied the log file to a SD card to post this from my desktop--the shift keyboard is not working at this time and I was not able to log onto this web site.  I am wondering if it is a hardware issue.  The machine is VERY hot to the touch--maybe the fan has gone out?  I hear something, but it does not sound like a fan.  Could a fan problem make the screen go bad?   I appreciate your advice against registery cleaners.  I read your suggested reading and can see how they could really be a problem.  I looked at Registry booster after the problem with this computer began, somewhat out of desperation.

I want to thank you so much for your time and trouble with this issue.  What follows is the log from the comboFix10 (commy) report.   Let me know if you need any further information. 

ComboFix 10-10-26.04 - Diana 10/27/2010  19:59:29.1.1 - x86
Microsoft Windows 7 Professional   6.1.7600.0.1252.1.1033.18.1022.218 [GMT -4:00]
Running from: c:\users\Diana\Desktop\commy.exe
Command switches used :: /stepdel
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\arp.exe

.
(((((((((((((((((((((((((   Files Created from 2010-09-28 to 2010-10-28  )))))))))))))))))))))))))))))))
.

2010-10-28 00:20 . 2010-10-28 00:20   --------   d-----w-   C:\Device
2010-10-28 00:19 . 2010-10-28 00:19   --------   d-----w-   c:\users\Default\AppData\Local\temp
2010-10-27 23:52 . 2010-10-27 23:54   --------   d-----w-   C:\32788R22FWJFW
2010-10-27 23:42 . 2010-10-27 23:44   --------   d-----w-   c:\program files\Bing Bar Installer
2010-10-27 23:38 . 2010-10-07 23:21   6146896   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1AA10B6A-A5B2-4C03-8C9A-D29422684DC2}\mpengine.dll
2010-10-27 23:33 . 2010-08-04 06:18   641536   ----a-w-   c:\windows\system32\CPFilters.dll
2010-10-27 23:33 . 2010-08-04 06:17   417792   ----a-w-   c:\windows\system32\msdri.dll
2010-10-27 23:33 . 2010-08-04 06:15   204288   ----a-w-   c:\windows\system32\MSNP.ax
2010-10-27 23:33 . 2010-08-04 06:15   199680   ----a-w-   c:\windows\system32\mpg2splt.ax
2010-10-27 23:33 . 2010-07-13 05:22   26504   ----a-w-   c:\windows\system32\drivers\Diskdump.sys
2010-10-23 23:17 . 2010-10-23 23:17   388096   ----a-r-   c:\users\Diana\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-10-23 23:17 . 2010-10-23 23:17   --------   d-----w-   c:\program files\Trend Micro
2010-10-23 22:52 . 2010-10-23 22:53   --------   d-----w-   c:\users\Diana\AppData\Roaming\PeaZip
2010-10-23 22:51 . 2010-10-23 22:52   --------   d-----w-   c:\program files\Free Files Unzip
2010-10-23 21:43 . 2010-10-23 21:43   --------   d-----w-   c:\users\Diana\AppData\Roaming\Malwarebytes
2010-10-23 21:42 . 2010-04-29 19:39   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-23 21:42 . 2010-10-23 21:42   --------   d-----w-   c:\programdata\Malwarebytes
2010-10-23 21:42 . 2010-10-23 21:43   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-10-23 21:42 . 2010-04-29 19:39   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-10-23 19:11 . 2010-10-23 19:11   --------   d-----w-   c:\users\Diana\AppData\Roaming\SUPERAntiSpyware.com
2010-10-23 19:11 . 2010-10-23 19:11   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
2010-10-23 19:10 . 2010-10-23 19:11   --------   d-----w-   c:\program files\SUPERAntiSpyware
2010-10-23 19:00 . 2010-10-23 19:01   --------   d-----w-   c:\program files\CCleaner
2010-10-22 21:12 . 2010-06-29 04:57   4247040   ----a-w-   c:\program files\Windows NT\Accessories\wordpad.exe
2010-10-22 21:12 . 2010-06-29 05:02   1413632   ----a-w-   c:\windows\system32\ole32.dll
2010-10-22 21:12 . 2010-08-26 04:39   109056   ----a-w-   c:\windows\system32\t2embed.dll
2010-10-22 21:12 . 2010-08-21 05:36   224256   ----a-w-   c:\windows\system32\schannel.dll
2010-10-22 21:12 . 2010-08-21 05:33   530432   ----a-w-   c:\windows\system32\comctl32.dll
2010-10-22 21:12 . 2010-08-31 04:32   954752   ----a-w-   c:\windows\system32\mfc40.dll
2010-10-22 21:12 . 2010-08-31 04:32   954288   ----a-w-   c:\windows\system32\mfc40u.dll
2010-10-22 21:12 . 2010-09-01 04:26   164864   ----a-w-   c:\program files\Windows Media Player\wmplayer.exe
2010-10-22 21:12 . 2010-09-01 04:23   12625408   ----a-w-   c:\windows\system32\wmploc.DLL
2010-10-22 21:09 . 2010-09-01 02:34   2327552   ----a-w-   c:\windows\system32\win32k.sys
2010-10-22 21:08 . 2010-08-27 05:46   168448   ----a-w-   c:\windows\system32\srvsvc.dll
2010-10-22 21:08 . 2010-08-27 03:31   310784   ----a-w-   c:\windows\system32\drivers\srv.sys
2010-10-22 21:08 . 2010-08-27 03:30   308736   ----a-w-   c:\windows\system32\drivers\srv2.sys
2010-10-22 21:08 . 2010-08-27 03:30   113664   ----a-w-   c:\windows\system32\drivers\srvnet.sys
2010-10-22 21:08 . 2010-08-21 05:36   738816   ----a-w-   c:\windows\system32\wmpmde.dll
2010-10-22 21:08 . 2010-05-05 06:46   363520   ----a-w-   c:\windows\system32\StructuredQuery.dll
2010-10-12 00:48 . 2010-10-12 20:26   --------   d-----w-   C:\c0e79157bb860675a9
2010-10-11 19:18 . 2010-10-11 19:18   --------   d-----w-   c:\users\Diana\AppData\Roaming\DivX
2010-10-10 18:52 . 2010-10-13 12:59   --------   d-----w-   c:\program files\FreeOTFE
2010-09-29 23:56 . 2010-03-04 04:04   146304   ----a-w-   c:\windows\system32\drivers\usbvideo.sys
2010-09-29 23:56 . 2010-03-04 03:57   190976   ----a-w-   c:\windows\system32\drivers\ks.sys
2010-09-28 22:37 . 2010-06-19 06:15   2048   ----a-w-   c:\windows\system32\tzres.dll
2010-09-28 22:33 . 2010-08-27 05:30   13312   ----a-w-   c:\program files\Internet Explorer\iecompat.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2010-07-20 06:29   222080   ------w-   c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2010-07-26 15:11   6146896   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-26 13:50 . 2010-07-31 17:16   737072   ----a-w-   c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2010-09-26 13:49 . 2010-08-06 00:17   4277016   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2010-09-26 13:49 . 2010-07-31 17:15   42776   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2010-09-26 13:49 . 2010-07-31 17:15   588096   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-09-17 21:56 . 2010-08-06 00:17   737072   ----a-w-   c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2010-09-17 21:55 . 2010-07-31 17:16   4277016   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2010-09-17 21:41 . 2010-08-06 00:16   42776   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2010-09-17 21:41 . 2010-08-06 00:16   588096   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-09-15 08:50 . 2010-07-20 06:03   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2010-08-21 05:32 . 2010-09-15 23:23   316928   ----a-w-   c:\windows\system32\spoolsv.exe
2010-08-01 02:49 . 2010-08-01 02:50   26987008   ----a-w-   C:\Agilix GoBinder 2006.msi
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlay1]
@="{E9B2B461-3280-4783-88E5-91EFBA78A119}"
[HKEY_CLASSES_ROOT\CLSID\{E9B2B461-3280-4783-88E5-91EFBA78A119}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-08-01 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZPdtWzdVitaKey AC5023"="c:\program files\VitaKey\AC5023\PdtWzd.exe" [2010-07-19 3026432]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"RemoteControl10"="c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2010-03-13 75048]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2010-01-07 158448]
"Resolution"="c:\program files\HTC\resolution.exe" [2008-02-20 49152]
"ShagCtrl"="c:\program files\HTC\ShagCtrl.exe" [2008-06-20 430080]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\6.3.2348.0\mswinext.exe" [2010-10-11 273672]

c:\users\Diana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey AC5023]
2010-07-19 22:52   2124800   ----a-w-   c:\program files\VitaKey\AC5023\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages   REG_MULTI_SZ      kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-26 42368]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]
R3 SD8686;SD8686;c:\windows\system32\DRIVERS\sd8686.sys [2008-08-22 331264]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-20 1343400]
S0 AlfaFF;AlfaFF mini-filter driver;c:\windows\system32\Drivers\AlfaFF.sys [2010-07-19 42608]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/07/20 02:35];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-03-13 16:58 87536]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 dlbk_device;dlbk_device;c:\windows\system32\dlbkcoms.exe [2007-04-06 538096]
S2 shagserv;shagserv;c:\program files\HTC\shagserv.exe [2008-06-20 22016]
S3 ec-driver;HTC Embedded Controller Service;c:\windows\system32\DRIVERS\ecdrv.sys [2007-08-10 25216]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile   REG_MULTI_SZ      wcescomm rapimgr
LocalServiceRestricted   REG_MULTI_SZ      WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder

2010-10-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1461597072-95375171-4021482590-1001Core.job
- c:\users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-01 01:41]

2010-10-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1461597072-95375171-4021482590-1001UA.job
- c:\users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-01 01:41]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-RegistryBooster - c:\program files\Uniblue\RegistryBooster\launcher.exe



[HKEY_LOCAL_MACHINE\system\ControlSet002\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3824)
c:\progra~1\VitaKey\AC5023\FILEPT~1.DLL
c:\program files\VitaKey\AC5023\CustomRes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\program files\VitaKey\AC5023\CompPtcVUI.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
.
**************************************************************************
.
Completion time: 2010-10-27  20:29:53 - machine was rebooted
ComboFix-quarantined-files.txt  2010-10-28 00:29

Pre-Run: 72,906,063,872 bytes free
Post-Run: 72,558,759,936 bytes free

- - End Of File - - F17556922746B09DD7E264226F080408ComboFi x 10-10-26.04 - Diana 10/27/2010  19:59:29.1.1 - x86
Microsoft Windows 7 Professional   6.1.7600.0.1252.1.1033.18.1022.218 [GMT -4:00]
Running from: c:\users\Diana\Desktop\commy.exe
Command switches used :: /stepdel
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\arp.exe

.
(((((((((((((((((((((((((   Files Created from 2010-09-28 to 2010-10-28  )))))))))))))))))))))))))))))))
.

2010-10-28 00:20 . 2010-10-28 00:20   --------   d-----w-   C:\Device
2010-10-28 00:19 . 2010-10-28 00:19   --------   d-----w-   c:\users\Default\AppData\Local\temp
2010-10-27 23:52 . 2010-10-27 23:54   --------   d-----w-   C:\32788R22FWJFW
2010-10-27 23:42 . 2010-10-27 23:44   --------   d-----w-   c:\program files\Bing Bar Installer
2010-10-27 23:38 . 2010-10-07 23:21   6146896   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1AA10B6A-A5B2-4C03-8C9A-D29422684DC2}\mpengine.dll
2010-10-27 23:33 . 2010-08-04 06:18   641536   ----a-w-   c:\windows\system32\CPFilters.dll
2010-10-27 23:33 . 2010-08-04 06:17   417792   ----a-w-   c:\windows\system32\msdri.dll
2010-10-27 23:33 . 2010-08-04 06:15   204288   ----a-w-   c:\windows\system32\MSNP.ax
2010-10-27 23:33 . 2010-08-04 06:15   199680   ----a-w-   c:\windows\system32\mpg2splt.ax
2010-10-27 23:33 . 2010-07-13 05:22   26504   ----a-w-   c:\windows\system32\drivers\Diskdump.sys
2010-10-23 23:17 . 2010-10-23 23:17   388096   ----a-r-   c:\users\Diana\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-10-23 23:17 . 2010-10-23 23:17   --------   d-----w-   c:\program files\Trend Micro
2010-10-23 22:52 . 2010-10-23 22:53   --------   d-----w-   c:\users\Diana\AppData\Roaming\PeaZip
2010-10-23 22:51 . 2010-10-23 22:52   --------   d-----w-   c:\program files\Free Files Unzip
2010-10-23 21:43 . 2010-10-23 21:43   --------   d-----w-   c:\users\Diana\AppData\Roaming\Malwarebytes
2010-10-23 21:42 . 2010-04-29 19:39   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-23 21:42 . 2010-10-23 21:42   --------   d-----w-   c:\programdata\Malwarebytes
2010-10-23 21:42 . 2010-10-23 21:43   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-10-23 21:42 . 2010-04-29 19:39   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-10-23 19:11 . 2010-10-23 19:11   --------   d-----w-   c:\users\Diana\AppData\Roaming\SUPERAntiSpyware.com
2010-10-23 19:11 . 2010-10-23 19:11   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
2010-10-23 19:10 . 2010-10-23 19:11   --------   d-----w-   c:\program files\SUPERAntiSpyware
2010-10-23 19:00 . 2010-10-23 19:01   --------   d-----w-   c:\program files\CCleaner
2010-10-22 21:12 . 2010-06-29 04:57   4247040   ----a-w-   c:\program files\Windows NT\Accessories\wordpad.exe
2010-10-22 21:12 . 2010-06-29 05:02   1413632   ----a-w-   c:\windows\system32\ole32.dll
2010-10-22 21:12 . 2010-08-26 04:39   109056   ----a-w-   c:\windows\system32\t2embed.dll
2010-10-22 21:12 . 2010-08-21 05:36   224256   ----a-w-   c:\windows\system32\schannel.dll
2010-10-22 21:12 . 2010-08-21 05:33   530432   ----a-w-   c:\windows\system32\comctl32.dll
2010-10-22 21:12 . 2010-08-31 04:32   954752   ----a-w-   c:\windows\system32\mfc40.dll
2010-10-22 21:12 . 2010-08-31 04:32   954288   ----a-w-   c:\windows\system32\mfc40u.dll
2010-10-22 21:12 . 2010-09-01 04:26   164864   ----a-w-   c:\program files\Windows Media Player\wmplayer.exe
2010-10-22 21:12 . 2010-09-01 04:23   12625408   ----a-w-   c:\windows\system32\wmploc.DLL
2010-10-22 21:09 . 2010-09-01 02:34   2327552   ----a-w-   c:\windows\system32\win32k.sys
2010-10-22 21:08 . 2010-08-27 05:46   168448   ----a-w-   c:\windows\system32\srvsvc.dll
2010-10-22 21:08 . 2010-08-27 03:31   310784   ----a-w-   c:\windows\system32\drivers\srv.sys
2010-10-22 21:08 . 2010-08-27 03:30   308736   ----a-w-   c:\windows\system32\drivers\srv2.sys
2010-10-22 21:08 . 2010-08-27 03:30   113664   ----a-w-   c:\windows\system32\drivers\srvnet.sys
2010-10-22 21:08 . 2010-08-21 05:36   738816   ----a-w-   c:\windows\system32\wmpmde.dll
2010-10-22 21:08 . 2010-05-05 06:46   363520   ----a-w-   c:\windows\system32\StructuredQuery.dll
2010-10-12 00:48 . 2010-10-12 20:26   --------   d-----w-   C:\c0e79157bb860675a9
2010-10-11 19:18 . 2010-10-11 19:18   --------   d-----w-   c:\users\Diana\AppData\Roaming\DivX
2010-10-10 18:52 . 2010-10-13 12:59   --------   d-----w-   c:\program files\FreeOTFE
2010-09-29 23:56 . 2010-03-04 04:04   146304   ----a-w-   c:\windows\system32\drivers\usbvideo.sys
2010-09-29 23:56 . 2010-03-04 03:57   190976   ----a-w-   c:\windows\system32\drivers\ks.sys
2010-09-28 22:37 . 2010-06-19 06:15   2048   ----a-w-   c:\windows\system32\tzres.dll
2010-09-28 22:33 . 2010-08-27 05:30   13312   ----a-w-   c:\program files\Internet Explorer\iecompat.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2010-07-20 06:29   222080   ------w-   c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2010-07-26 15:11   6146896   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-26 13:50 . 2010-07-31 17:16   737072   ----a-w-   c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2010-09-26 13:49 . 2010-08-06 00:17   4277016   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2010-09-26 13:49 . 2010-07-31 17:15   42776   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2010-09-26 13:49 . 2010-07-31 17:15   588096   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-09-17 21:56 . 2010-08-06 00:17   737072   ----a-w-   c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2010-09-17 21:55 . 2010-07-31 17:16   4277016   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2010-09-17 21:41 . 2010-08-06 00:16   42776   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2010-09-17 21:41 . 2010-08-06 00:16   588096   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-09-15 08:50 . 2010-07-20 06:03   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2010-08-21 05:32 . 2010-09-15 23:23   316928   ----a-w-   c:\windows\system32\spoolsv.exe
2010-08-01 02:49 . 2010-08-01 02:50   26987008   ----a-w-   C:\Agilix GoBinder 2006.msi
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlay1]
@="{E9B2B461-3280-4783-88E5-91EFBA78A119}"
[HKEY_CLASSES_ROOT\CLSID\{E9B2B461-3280-4783-88E5-91EFBA78A119}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-08-01 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZPdtWzdVitaKey AC5023"="c:\program files\VitaKey\AC5023\PdtWzd.exe" [2010-07-19 3026432]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"RemoteControl10"="c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2010-03-13 75048]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2010-01-07 158448]
"Resolution"="c:\program files\HTC\resolution.exe" [2008-02-20 49152]
"ShagCtrl"="c:\program files\HTC\ShagCtrl.exe" [2008-06-20 430080]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\6.3.2348.0\mswinext.exe" [2010-10-11 273672]

c:\users\Diana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey AC5023]
2010-07-19 22:52   2124800   ----a-w-   c:\program files\VitaKey\AC5023\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages   REG_MULTI_SZ      kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-26 42368]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]
R3 SD8686;SD8686;c:\windows\system32\DRIVERS\sd8686.sys [2008-08-22 331264]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-20 1343400]
S0 AlfaFF;AlfaFF mini-filter driver;c:\windows\system32\Drivers\AlfaFF.sys [2010-07-19 42608]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/07/20 02:35];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-03-13 16:58 87536]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 dlbk_device;dlbk_device;c:\windows\system32\dlbkcoms.exe [2007-04-06 538096]
S2 shagserv;shagserv;c:\program files\HTC\shagserv.exe [2008-06-20 22016]
S3 ec-driver;HTC Embedded Controller Service;c:\windows\system32\DRIVERS\ecdrv.sys [2007-08-10 25216]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile   REG_MULTI_SZ      wcescomm rapimgr
LocalServiceRestricted   REG_MULTI_SZ      WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder

2010-10-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1461597072-95375171-4021482590-1001Core.job
- c:\users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-01 01:41]

2010-10-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1461597072-95375171-4021482590-1001UA.job
- c:\users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-01 01:41]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-RegistryBooster - c:\program files\Uniblue\RegistryBooster\launcher.exe



[HKEY_LOCAL_MACHINE\system\ControlSet002\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3824)
c:\progra~1\VitaKey\AC5023\FILEPT~1.DLL
c:\program files\VitaKey\AC5023\CustomRes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\program files\VitaKey\AC5023\CompPtcVUI.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
.
**************************************************************************
.
Completion time: 2010-10-27  20:29:53 - machine was rebooted
ComboFix-quarantined-files.txt  2010-10-28 00:29

Pre-Run: 72,906,063,872 bytes free
Post-Run: 72,558,759,936 bytes free

- - End Of File - - F17556922746B09DD7E264226F080408

[SuperDave]

The machine is VERY hot to the touch--maybe the fan has gone out?  I hear something, but it does not sound like a fan.  Could a fan problem make the screen go bad?

An overheating computer can cause lots of problems. Have you opened up the box to see if it's clean and if the fans are working?

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
  
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  
• Now click the Scan button.
• Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  
• Save it where you can easily find it, such as your desktop.

[Mystic220]

I was in the middle of running the scan when I received a blue screen--the computer has restarted in normal mode.  What do you want me to do?

[SuperDave]

What do you want me to do?

Let's try this one:

SysProt Antirootkit

Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel Modules << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was

extracted to. Open the text file and copy/paste the log here.
[/list]

[Mystic220]

Here is the log--only took few seconds to run

SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
No Hidden Kernel Modules found

******************************************************************************************
******************************************************************************************
No SSDT Hooks found

******************************************************************************************
******************************************************************************************
No Kernel Hooks found

******************************************************************************************
******************************************************************************************
No hidden files/folders found

[SuperDave]

How's your computer running now?

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[Mystic220]

How's your computer running now?

The keyboard still takes about two seconds to type each letter. slow! no mousepad or touch screen-- wireless worked about 2 min then not there

scan completed--said no threats-no button "list of found threats" or "back"

below is log from program files

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK

[Mystic220]

I hope this is ok.  I went ahead and ran the GMER scan on my HTC Shift again.  This time there were no problems.  I copied the txt file to a SD card and am posting this from my desktop computer.  You asked about how the Shift was running, well the keystrokes take 2-3 seconds each to register.  Each word is painstakingly produced.  When I first turned the computer on this morning, I saw where the wireless came up and found the network.  As soon as it connected, it was gone and I had to plug in the cable off my desktop.  The wireless adapter was not recognized at all.  There is no touch screen and the mousepad does not respond.  So basically there is no change.  It does run a little hot, but I have never gotten a message that the fan was not working.l  I am a high school teacher and have not yet had the time to take it apart--don't have a star screw driver and spend every second working on class preparation and assessment analysis--maybe during Christmas break.  I don't want to get it apart-- at least while you are so gracious to try and help me get it working! 

Could it be that the touchscreen has stopped working and needs replacing?  I just can't believe that nothing has shown up on these logs.  It was weird how everything quit working at the same time--so I want to believe that it is a virus, but it is not showing itself--that's for sure.  Thanks so much for all that you do--with that said, here is the log from the gmer scan.


GMER 1.0.15.15477 - http://www.gmer.net
Rootkit scan 2010-10-31 21:15:59
Windows 6.1.7600
Running: gmer.exe; Driver: C:\Users\Diana\AppData\Local\Temp\uwrcapog.sys


---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                                81E55599 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                         81E79F52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl                                                        section is writeable [0xA5175000, 0x2892, 0xE8000020]
.vmp2           C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl                                                        entry point in ".vmp2" section [0xA5198050]

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Program Files\Zune\ZuneLauncher.exe[2820] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]  [75B45E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT             C:\Program Files\Zune\ZuneLauncher.exe[2820] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [75B45E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT             C:\Program Files\Zune\ZuneLauncher.exe[2820] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]     [75B45E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT             C:\Program Files\Zune\ZuneLauncher.exe[2820] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]   [75B45E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device          \Driver\ACPI_HAL \Device\00000047                                                                              halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                         fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                         rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                         fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                         rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                                                                                       fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\00092db350ae (not active ControlSet)               
Reg             HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\00190e022662 (not active ControlSet)               
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00092db350ae                                   
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00190e022662                                   
Reg             HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\00092db350ae (not active ControlSet)               
Reg             HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\00190e022662 (not active ControlSet)               

---- EOF - GMER 1.0.15 ----

[SuperDave]

The keyboard still takes about two seconds to type each letter. slow! no mousepad or touch screen-- wireless worked about 2 min then not there

This sounds more and more like a hardware problem.Is this a built-in wireless receiver? What happens when you hard-wire the laptop? Viruses don't usually affect the keyboard or touchpad.

[Mystic220]

Yes, it is a built in wireless receiver.  There is no problem when I hardwire it.  I have a wired mouse that works fine as well.  It is just the mousepad that does not work--  I really appreciate all that you have done to try and help me.  I want to give a big "Thank you" --for all you do for everyone who comes here in desperation.  Can't win them all, but it's not for lack of trying!  Thanks so much.

Diana

[SuperDave]

Yes. This certainly sounds like a hardware problem. The touchpad on my laptop is a bit squirrely but I don't use it. I'd like to do some cleanup before you leave.

* Click START then RUN - Vista users press the Windows Key and the R keys together for the Run box.
* Now type commy /uninstall in the runbox
* Make sure there's a space between commy and /Uninstall
* Then hit Enter

* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.

******************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

***********************************
Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
****************************************
Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Good Luck!