Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Is it fixed?  (Read 5564 times)

0 Members and 1 Guest are viewing this topic.

LizMcDanger

    Topic Starter


    Newbie

    • Experience: Beginner
    • OS: Unknown
    Is it fixed?
    « on: November 26, 2010, 05:17:42 PM »
    Hi there. Got the xp antimalware 2011 virus a while ago, thought I had it cleaned up, but got a flareup of trojan alerts today so I obviously need more than that. Am I clean now? Posting latest scan results:


    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 11/26/2010 at 05:34 PM

    Application Version : 4.46.1000

    Core Rules Database Version : 5918
    Trace Rules Database Version: 3730

    Scan type       : Complete Scan
    Total Scan Time : 01:09:59

    Memory items scanned      : 527
    Memory threats detected   : 0
    Registry items scanned    : 5115
    Registry threats detected : 2
    File items scanned        : 64740
    File threats detected     : 2

    System.BrokenFileAssociation
       HKCR\.exe

    Malware.Trace
       HKU\S-1-5-21-1547161642-73586283-682003330-1003\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON#SHELL

    Adware.Tracking Cookie
       .atdmt.com [ C:\Documents and Settings\Elizabeth\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies ]
       .atdmt.com [ C:\Documents and Settings\Elizabeth\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies ]





    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 5194

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 6.0.2900.5512

    11/26/2010 5:54:26 PM
    mbam-log-2010-11-26 (17-54-26).txt

    Scan type: Quick scan
    Objects scanned: 134628
    Time elapsed: 6 minute(s), 1 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)







    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 7:10:32 PM, on 11/26/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\igfxsrvc.exe
    C:\WINDOWS\System32\igfxpers.exe
    C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
    C:\Program Files\DellTPad\Apoint.exe
    C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    C:\Program Files\Google\Gmail Notifier\gnotify.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    C:\Program Files\DellTPad\ApMsgFwd.exe
    C:\Program Files\DivX\DivX Update\DivXUpdate.exe
    C:\Program Files\AVG\AVG10\avgtray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\DellTPad\HidFind.exe
    C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
    C:\Program Files\DellTPad\Apntex.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\Logitech\Logitech Vid\vid.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    C:\Program Files\AVG\AVG10\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\PC Tools Firewall Plus\FWService.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\WiFi\bin\WLKeeper.exe
    C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    C:\Program Files\AVG\AVG10\avgnsx.exe
    C:\Program Files\AVG\AVG10\avgemcx.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\wbem\unsecapp.exe
    C:\PROGRA~1\AVG\AVG10\avgrsx.exe
    C:\Program Files\AVG\AVG10\avgcsrvx.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\WINDOWS\System32\mshta.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\WINDOWS\System32\mshta.exe
    C:\WINDOWS\System32\mshta.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HiJackThis\sniper.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
    O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
    O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKCU\..\Run: [Aim] "C:\Program Files\AIM\aim.exe" /d locale=en-US
    O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files\Logitech\Logitech Vid\vid.exe" -bootmode
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1264300164140
    O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
    O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    O23 - Service: Google Update Service (gupdate1cacb1a38140aca) (gupdate1cacb1a38140aca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\WLKeeper.exe

    --
    End of file - 9648 bytes

    SuperDave

    • Malware Removal Specialist


    • Genius
    • Thanked: 1020
    • Certifications: List
    • Experience: Expert
    • OS: Windows 10
    Re: Is it fixed?
    « Reply #1 on: November 27, 2010, 12:36:12 PM »
      Hello and welcome to
    Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

    1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
    2. The fixes are specific to your problem and should only be used for this issue on this machine.
    3. If you don't know or understand something, please don't hesitate to ask.
    4. Please DO NOT run any other tools or scans while I am helping you.
    5. It is important that you reply to this thread. Do not start a new topic.
    6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
    7. Absence of symptoms does not mean that everything is clear.

    If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
    **********************************************
    Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

    Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

    Exit out of MessengerDisable then delete the two files that were put on the desktop.
    **************************************************

    Open HijackThis and select Do a system scan only

    Place a check mark next to the following entries: (if there)

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    Important: Close all open windows except for HijackThis and then click Fix checked.

    Once completed, exit HijackThis.
    *****************************************
    Download Security Check by screen317 from one of the following links and save it to your desktop.

    Link 1
    Link 2

    * Unzip SecurityCheck.zip and a folder named Security Check should appear.
    * Open the Security Check folder and double-click Security Check.bat
    * Follow the on-screen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt
    * Post the contents of that document in your next reply.

    Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
    *****************************************
    Please download ComboFix from BleepingComputer.com

    Alternate link: GeeksToGo.com

    Rename ComboFix.exe to commy.exe before you save it to your Desktop
    Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
    Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
    As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console[/list]

    Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


    Click on Yes, to continue scanning for malware.
    When finished, it shall produce a log for you.  Please include the contents of C:\ComboFix.txt in your next reply.

    If you have problems with ComboFix usage, see How to use ComboFix

    Windows 8 and Windows 10 dual boot with two SSD's

    LizMcDanger

      Topic Starter


      Newbie

      • Experience: Beginner
      • OS: Unknown
      Re: Is it fixed?
      « Reply #2 on: November 27, 2010, 02:20:09 PM »
      Thanks so much! Here are the logs:

       Results of screen317's Security Check version 0.99.5 
       Windows XP Service Pack 3 
       Internet Explorer 6 Out of date!
      ``````````````````````````````
      Antivirus/Firewall Check:

       Windows Firewall Enabled! 
       AVG 2011     
       AVG PC Tuneup 2011   
       AVG 2011     
       PC Tools Firewall Plus 6.0 
       Antivirus up to date! 
      ```````````````````````````````
      Anti-malware/Other Utilities Check:

       Malwarebytes' Anti-Malware   
       AVG PC Tuneup 2011 
       CCleaner     
       Java(TM) 6 Update 22 
       Out of date Java installed!
       Adobe Flash Player 10.1.85.3 
      Adobe Reader 9.3.3
       Mozilla Firefox (3.6.12) Firefox Out of Date! 
      ````````````````````````````````
      Process Check: 
      objlist.exe by Laurent

       AVG avgwdsvc.exe
       AVG avgtray.exe
       AVG avgrsx.exe
       AVG avgnsx.exe
       AVG avgemc.exe
       PC Tools Firewall Plus FirewallGUI.exe   
       PC Tools Firewall Plus FWService.exe   
      ````````````````````````````````
      DNS Vulnerability Check:

       Unknown. This method cannot test your vulnerability to DNS cache poisoning. (Wireless connection?)

      ``````````End of Log````````````





      ComboFix 10-11-27.01 - Elizabeth 11/27/2010  16:03:25.2.2 - x86
      Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2038.1521 [GMT -5:00]
      Running from: c:\documents and settings\Elizabeth\Desktop\commy.exe
      FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
      .

      (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      c:\windows\TEMP\logishrd\LVPrcInj02.dll
      .
      ---- Previous Run -------
      .
      c:\documents and settings\Elizabeth\Application Data\Microsoft\~DFK3336489a.tmp
      c:\documents and settings\Elizabeth\Application Data\Microsoft\1eaadjc.dll
      c:\documents and settings\Elizabeth\Application Data\Microsoft\bass.dll
      c:\documents and settings\Elizabeth\Application Data\Microsoft\kfgresk.dll
      c:\documents and settings\Elizabeth\Application Data\Microsoft\mjcriu.dll
      c:\documents and settings\Elizabeth\Application Data\Microsoft\peaadje.dll
      c:\documents and settings\Elizabeth\Application Data\Microsoft\qwadjb.dll
      c:\documents and settings\Elizabeth\Application Data\Microsoft\rsaadjd.dll
      c:\documents and settings\Elizabeth\Application Data\sdhkryu.bat
      c:\windows\Tasks\At1.job
      c:\windows\Tasks\At10.job
      c:\windows\Tasks\At11.job
      c:\windows\Tasks\At12.job
      c:\windows\Tasks\At13.job
      c:\windows\Tasks\At14.job
      c:\windows\Tasks\At15.job
      c:\windows\Tasks\At16.job
      c:\windows\Tasks\At17.job
      c:\windows\Tasks\At18.job
      c:\windows\Tasks\At19.job
      c:\windows\Tasks\At2.job
      c:\windows\Tasks\At20.job
      c:\windows\Tasks\At21.job
      c:\windows\Tasks\At22.job
      c:\windows\Tasks\At23.job
      c:\windows\Tasks\At24.job
      c:\windows\Tasks\At3.job
      c:\windows\Tasks\At4.job
      c:\windows\Tasks\At5.job
      c:\windows\Tasks\At6.job
      c:\windows\Tasks\At7.job
      c:\windows\Tasks\At8.job
      c:\windows\Tasks\At9.job
      c:\windows\TEMP\logishrd\LVPrcInj01.dll

      .
      (((((((((((((((((((((((((   Files Created from 2010-10-27 to 2010-11-27  )))))))))))))))))))))))))))))))
      .

      2010-11-27 21:00 . 2010-11-27 21:00   --------   d-----w-   c:\program files\Common Files\Adobe
      2010-11-27 20:08 . 2010-11-27 20:08   388096   ----a-r-   c:\documents and settings\Elizabeth\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
      2010-11-26 21:17 . 2010-11-26 21:17   --------   d-----w-   c:\documents and settings\Elizabeth\Application Data\SUPERAntiSpyware.com
      2010-11-26 21:17 . 2010-11-26 21:17   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
      2010-11-26 21:17 . 2010-11-26 21:18   --------   d-----w-   c:\program files\SUPERAntiSpyware
      2010-11-26 21:15 . 2010-11-26 21:15   --------   d-----w-   c:\program files\CCleaner
      2010-11-26 21:14 . 2010-11-26 21:14   --------   d-----w-   c:\program files\Common Files\Java
      2010-11-26 21:13 . 2010-09-15 09:50   472808   ----a-w-   c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
      2010-11-26 21:13 . 2010-09-15 09:50   472808   ----a-w-   c:\windows\system32\deployJava1.dll
      2010-11-26 21:04 . 2010-11-26 21:07   --------   d-----w-   c:\documents and settings\Elizabeth\Application Data\PCToolsFirewallPlus
      2010-11-26 21:03 . 2009-11-23 18:54   88040   ----a-w-   c:\windows\system32\drivers\PCTAppEvent.sys
      2010-11-26 21:03 . 2009-11-09 16:20   207792   ----a-w-   c:\windows\system32\drivers\PCTCore.sys
      2010-11-26 21:03 . 2010-01-07 17:40   233136   ----a-w-   c:\windows\system32\drivers\pctgntdi.sys
      2010-11-26 21:02 . 2010-11-26 21:03   --------   d-----w-   c:\program files\Common Files\PC Tools
      2010-11-26 21:02 . 2010-01-12 14:34   70664   ----a-w-   c:\windows\system32\drivers\pctNdis-PacketFilter.sys
      2010-11-26 21:02 . 2010-01-07 16:35   58816   ----a-w-   c:\windows\system32\drivers\pctNdis.sys
      2010-11-26 21:02 . 2010-01-07 16:35   32680   ----a-w-   c:\windows\system32\drivers\pctNdis-DNS.sys
      2010-11-26 21:02 . 2010-01-13 13:59   115216   ----a-w-   c:\windows\system32\drivers\pctplfw.sys
      2010-11-26 21:02 . 2010-11-26 21:07   --------   d-----w-   c:\program files\PC Tools Firewall Plus
      2010-11-26 20:34 . 2010-11-26 20:34   --------   d-----w-   c:\program files\Trend Micro
      2010-11-26 05:31 . 2010-11-26 05:31   --------   d-----w-   c:\program files\iPod
      2010-11-26 05:31 . 2010-11-26 05:32   --------   d-----w-   c:\program files\iTunes
      2010-11-21 20:15 . 2010-11-21 20:15   --------   d-----w-   c:\documents and settings\Elizabeth\Application Data\Malwarebytes
      2010-11-21 20:14 . 2010-04-29 20:39   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
      2010-11-21 20:14 . 2010-11-21 20:14   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
      2010-11-21 20:14 . 2010-04-29 20:39   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
      2010-11-21 20:14 . 2010-11-21 20:14   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
      2010-11-21 19:43 . 2010-11-21 19:43   --------   d-----w-   c:\documents and settings\All Users\Application Data\PC Tools
      2010-11-16 17:24 . 2010-11-16 17:24   --------   d-----w-   c:\documents and settings\Elizabeth\Local Settings\Application Data\Tracker Software
      2010-11-16 16:10 . 1999-12-31 22:00   166680   ----a-w-   c:\program files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
      2010-11-16 16:09 . 2010-11-16 16:10   --------   d-----w-   c:\program files\Tracker Software
      2010-11-15 18:41 . 2010-11-15 18:41   --------   d-----w-   c:\documents and settings\Elizabeth\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
      2010-11-15 18:38 . 2010-11-15 18:38   --------   d-----w-   c:\program files\gs
      2010-11-06 16:37 . 2010-11-06 16:37   103864   ----a-w-   c:\program files\Mozilla Firefox\plugins\nppdf32.dll
      2010-11-06 16:37 . 2010-11-06 16:37   103864   ----a-w-   c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
      2010-11-04 23:04 . 2010-11-27 21:10   --------   d---a-w-   c:\documents and settings\All Users\Application Data\TEMP
      2010-11-04 21:51 . 2010-11-04 21:51   --------   d-----w-   c:\documents and settings\Elizabeth\Application Data\AVG10
      2010-11-04 21:48 . 2010-11-04 21:48   --------   d--h--w-   c:\documents and settings\All Users\Application Data\Common Files
      2010-11-04 21:46 . 2010-11-27 20:28   --------   d-----w-   c:\documents and settings\All Users\Application Data\AVG10
      2010-11-04 21:15 . 2010-11-04 21:36   --------   d-----w-   c:\documents and settings\All Users\Application Data\MFAData
      2010-10-30 05:07 . 2010-10-30 05:07   --------   d-----w-   c:\documents and settings\LocalService\Application Data\McAfee

      .
      ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2010-09-18 16:23 . 2002-09-03 19:44   974848   ----a-w-   c:\windows\system32\mfc42u.dll
      2010-09-18 06:53 . 2002-09-03 19:44   974848   ----a-w-   c:\windows\system32\mfc42.dll
      2010-09-18 06:53 . 2002-09-03 19:44   954368   ----a-w-   c:\windows\system32\mfc40.dll
      2010-09-18 06:53 . 2002-09-03 19:44   953856   ----a-w-   c:\windows\system32\mfc40u.dll
      2010-09-15 07:29 . 2010-06-08 03:25   73728   ----a-w-   c:\windows\system32\javacpl.cpl
      2010-09-09 14:16 . 2002-09-03 20:03   667136   ----a-w-   c:\windows\system32\wininet.dll
      2010-09-09 14:16 . 2002-09-03 19:58   61952   ----a-w-   c:\windows\system32\tdc.ocx
      2010-09-09 14:16 . 2010-01-23 20:57   81920   ------w-   c:\windows\system32\ieencode.dll
      2010-09-08 16:49 . 2010-01-23 20:57   369664   ------w-   c:\windows\system32\html.iec
      2010-09-08 15:17 . 2010-09-08 15:17   94208   ----a-w-   c:\windows\system32\QuickTimeVR.qtx
      2010-09-08 15:17 . 2010-09-08 15:17   69632   ----a-w-   c:\windows\system32\QuickTime.qts
      2010-09-01 11:51 . 2002-09-03 19:33   285824   ----a-w-   c:\windows\system32\atmfd.dll
      2010-08-31 13:42 . 2002-09-03 20:03   1852800   ----a-w-   c:\windows\system32\win32k.sys
      .

      (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Aim"="c:\program files\AIM\aim.exe" [2010-03-08 3972440]
      "Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IgfxTray"="c:\windows\System32\igfxtray.exe" [2007-03-31 138008]
      "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2007-03-31 162584]
      "Persistence"="c:\windows\System32\igfxpers.exe" [2007-03-31 138008]
      "Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-07-02 159744]
      "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
      "IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-05-21 1372160]
      "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-05-21 1202448]
      "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
      "LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
      "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
      "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
      "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
      "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
      "00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2010-01-12 3168216]
      "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
      "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
      "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

      c:\documents and settings\All Users\Start Menu\Programs\Startup\
      Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2010-1-23 24576]

      [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
      "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
      2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
      @="Driver"

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "DisableNotifications"= 1 (0x1)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "c:\\Program Files\\AIM\\aim.exe"=
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
      "c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
      "c:\\Program Files\\iTunes\\iTunes.exe"=

      R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [11/26/2010 4:03 PM 233136]
      R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
      R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
      R2 ASFIPmon;Broadcom ASF IP Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe -service --> c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe -service [?]
      R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [11/26/2010 4:03 PM 88040]
      R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [11/26/2010 4:02 PM 70664]
      R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [11/26/2010 4:02 PM 58816]
      R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [11/26/2010 4:02 PM 115216]
      S2 gupdate1cacb1a38140aca;Google Update Service (gupdate1cacb1a38140aca);c:\program files\Google\Update\GoogleUpdate.exe [3/24/2010 1:21 AM 133104]
      .
      Contents of the 'Scheduled Tasks' folder

      2010-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job
      - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

      2010-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-24 06:21]

      2010-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-24 06:21]

      2010-06-02 c:\windows\Tasks\Install_NSS.job
      - c:\program files\DivX\Symantec\scstubinstaller.exe [2010-03-08 18:00]

      2010-11-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1547161642-73586283-682003330-1003.job
      - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

      2010-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1547161642-73586283-682003330-1003.job
      - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
      .
      .
      ------- Supplementary Scan -------
      .
      uInternet Connection Wizard,ShellNext = iexplore
      uInternet Settings,ProxyOverride = *.local
      DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
      DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
      FF - ProfilePath - c:\documents and settings\Elizabeth\Application Data\Mozilla\Firefox\Profiles\i8so9c0b.default\
      FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
      FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
      FF - component: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
      FF - component: c:\documents and settings\Elizabeth\Application Data\Mozilla\Firefox\Profiles\i8so9c0b.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
      FF - component: c:\documents and settings\Elizabeth\Application Data\Mozilla\Firefox\Profiles\i8so9c0b.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
      FF - plugin: c:\documents and settings\Elizabeth\Application Data\Mozilla\Firefox\Profiles\i8so9c0b.default\extensions\[email protected]\plugins\npLogitechDeviceDetection.dll
      FF - plugin: c:\documents and settings\Elizabeth\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
      FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
      FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
      FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
      FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
      FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
      FF - plugin: c:\program files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
      FF - plugin: c:\program files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll
      FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
      FF - Extension: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
      FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
      FF - Extension: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
      FF - Extension: FireGestures: [email protected] - c:\documents and settings\Elizabeth\Application Data\Mozilla\Firefox\Profiles\i8so9c0b.default\extensions\[email protected]
      FF - Extension: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - c:\documents and settings\Elizabeth\Application Data\Mozilla\Firefox\Profiles\i8so9c0b.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
      FF - Extension: Media Converter: {6e764c17-863a-450f-bdd0-6772bd5aaa18} - c:\documents and settings\Elizabeth\Application Data\Mozilla\Firefox\Profiles\i8so9c0b.default\extensions\{6e764c17-863a-450f-bdd0-6772bd5aaa18}

      ---- FIREFOX POLICIES ----
      FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
      .
      - - - - ORPHANS REMOVED - - - -

      Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
      WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
      HKLM-Run-SigmatelSysTrayApp - %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe



      **************************************************************************

      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2010-11-27 16:11
      Windows 5.1.2600 Service Pack 3 NTFS

      scanning hidden processes ... 

      scanning hidden autostart entries ...

      scanning hidden files ... 

      scan completed successfully
      hidden files: 0

      **************************************************************************
      .
      --------------------- LOCKED REGISTRY KEYS ---------------------

      [HKEY_USERS\S-1-5-21-1547161642-73586283-682003330-1003\Software\SecuROM\License information*]
      "datasecu"=hex:9e,0c,b6,8f,ab,ab,3f,79,6e,50,2d,e9,07,d4,d0,05,5b,03,79,d3,22,
         92,ce,56,f8,0c,35,1b,ce,42,1a,2f,85,8d,75,26,30,31,40,bf,20,aa,f8,38,cf,0f,\
      "rkeysecu"=hex:de,b6,88,f1,4a,ef,9e,a7,7b,a7,e0,ef,c4,ac,6c,b4

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
      @Denied: (A 2) (Everyone)
      @="FlashBroker"
      "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
      "Enabled"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
      @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

      [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
      @Denied: (A 2) (Everyone)
      @="IFlashBroker4"

      [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
      @="{00020424-0000-0000-C000-000000000046}"

      [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      "Version"="1.0"
      .
      --------------------- DLLs Loaded Under Running Processes ---------------------

      - - - - - - - > 'winlogon.exe'(1264)
      c:\program files\SUPERAntiSpyware\SASWINLO.DLL
      c:\windows\system32\netprovcredman.dll

      - - - - - - - > 'explorer.exe'(2476)
      c:\windows\TEMP\logishrd\LVPrcInj01.dll
      .
      ------------------------ Other Running Processes ------------------------
      .
      c:\program files\Intel\WiFi\bin\S24EvMon.exe
      c:\windows\System32\SCardSvr.exe
      c:\program files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
      c:\windows\System32\igfxsrvc.exe
      c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe
      c:\program files\DellTPad\ApMsgFwd.exe
      c:\program files\DellTPad\Apntex.exe
      c:\program files\DellTPad\HidFind.exe
      c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
      c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
      c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe
      c:\program files\Bonjour\mDNSResponder.exe
      c:\program files\Intel\WiFi\bin\EvtEng.exe
      c:\program files\Java\jre6\bin\jqs.exe
      c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
      c:\program files\PC Tools Firewall Plus\FWService.exe
      c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
      c:\program files\Intel\WiFi\bin\WLKeeper.exe
      c:\windows\System32\wbem\unsecapp.exe
      c:\program files\iPod\bin\iPodService.exe
      c:\windows\system32\wscntfy.exe
      .
      **************************************************************************
      .
      Completion time: 2010-11-27  16:16:12 - machine was rebooted
      ComboFix-quarantined-files.txt  2010-11-27 21:16

      Pre-Run: 27,126,910,976 bytes free
      Post-Run: 27,083,415,552 bytes free

      - - End Of File - - 6AB117A52EB137FF1EF1D178FD6065A3

      SuperDave

      • Malware Removal Specialist


      • Genius
      • Thanked: 1020
      • Certifications: List
      • Experience: Expert
      • OS: Windows 10
      Re: Is it fixed?
      « Reply #3 on: November 27, 2010, 06:34:25 PM »
      The Security Check shows that you're running Windows Firewall as well as PC Tools Firewall Plus 6.0. One will have to be disabled. I suggest you disable the Windows Firewall.

      Very good. That log looks ok. Let's try another scan.

      SysProt Antirootkit

      Download
      SysProt Antirootkit from the link below (you will find it at the bottom
      of the page under attachments, or you can get it from one of the
      mirrors).

      http://sites.google.com/site/sysprotantirootkit/

      Unzip it into a folder on your desktop.
      • Double click Sysprot.exe to start the program.
      • Click on the Log tab.
      • In the Write to log box select the following items.
        • Process << Selected
        • Kernel Modules << Selected
        • SSDT << Selected
        • Kernel Hooks << Selected
        • IRP Hooks << NOT Selected
        • Ports << NOT Selected
        • Hidden Files << Selected
      • At the bottom of the page
        • Hidden Objects Only << Selected
      • Click on the Create Log button on the bottom right.
      • After a few seconds a new window should appear.
      • Select Scan Root Drive. Click on the Start button.
      • When it is complete a new window will appear to indicate that the scan is finished.
      • The log will be saved automatically in the same folder Sysprot.exe was

      extracted to. Open the text file and copy/paste the log here.
      [/list]
      Windows 8 and Windows 10 dual boot with two SSD's