Background Name changed malware

Yesterday I began getting an error message stating that my "background image" had changed and did I want to accept it. It's locking up my laptop if I don't run in Safe Mode. I've run CCleaner, Trendmicro House Call, Spybot Search & Destroy, Malwarebyte's Anti-Malware, etc. in an effort to clean it. Here is my latest Hijack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:41:25 PM, on 1/20/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\ThinkPad\Tablet Shortcut\ASR\ASRSVC.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\notes\ntmulti.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\WINDOWS\system32\PGPserv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThinkPad\Tablet Shortcut\TSMService.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\ThinkPad\Tablet Shortcut\TSMRESIDENT.EXE
C:\Program Files\Lenovo\TrackPoint\tp4serv.exe
C:\WINDOWS\system32\TpShocks.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Lenovo\Productivity Keyboard\SKDaemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe
C:\WINDOWS\system32\FSRremoS.EXE
C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
C:\PROGRA~1\THINKV~2\PrdCtr\LPMLCHK.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\Laser App Enterprise\laupdate.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\Program Files\Lenovo\Client Security Solution\password_manager.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O2 - BHO: DCA - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files\Upromise\dca-bho.dll
O2 - BHO: Password Manager Browser Helper Object - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ToolHelper - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files\Upromise\upromisetoolbar.dll
O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [TSMResident] "C:\Program Files\ThinkPad\Tablet Shortcut\TSMRESIDENT.EXE" /r
O4 - HKLM\..\Run: [TrackPointSrv] C:\Program Files\Lenovo\TrackPoint\tp4serv.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
O4 - HKLM\..\Run: [SKDaemon.exe] C:\Program Files\Lenovo\Productivity Keyboard\SKDaemon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Message Center Plus] C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [LPMailChecker] C:\PROGRA~1\THINKV~2\PrdCtr\LPMLCHK.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [IBMTBCTL] "C:\Program Files\ThinkPad\Tablet Shortcut\IBMTBCTL.EXE" /r
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [LaserAppUpdate] "C:\Program Files\Laser App Enterprise\laupdate.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: PGPtray.exe.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll
O9 - Extra 'Tools' menuitem: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.ez-data.com
O15 - Trusted Zone: *.ezdata.com
O15 - Trusted Zone: http://www10.glic.com
O15 - Trusted Zone: http://www6.glic.com
O15 - Trusted Zone: http://w3.gliconline.com
O15 - Trusted Zone: *.gliconline.com/java
O15 - Trusted Zone: http://www.guardianonline.com
O15 - Trusted Zone: *.smartofficeonline.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - https://www6.glic.com/gol/Virtual%20University/cab/awswaxd.cab
O16 - DPF: {1FA44E01-A60B-4449-BF97-66CDAA200433} (SOConfig6 Class) - https://ezdata.gliconline.com/java/downloads/SOConfig6.cab
O16 - DPF: {21D817CE-B22E-11D2-B514-00C04F930B5E} (GuardianDownload.Download) - http://w3.gliconline.com/Common/Scripts/GuardianDownload.CAB
O16 - DPF: {2E764AF3-8311-11D2-B4EC-00C04F930B5E} (prjDownloadHelp.ctlDownloadHelp_2) - http://w3.gliconline.com/GuardianHelp/Scripts/ctlDownloadHelp_2.CAB
O16 - DPF: {2F01ABF9-0799-11D2-B771-00C04F930B5E} (prjShowHelp_3.ctlShowHelp_3) - http://w3.gliconline.com/GuardianHelp/scripts/ctlshowHelp_3.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {3E755E01-BB38-11D4-B44C-00105A0D610A} (VbpCommonControls.ctlCommonControls) - http://w3.gliconline.com/Common/Cabs/ctlCommonControls.CAB
O16 - DPF: {439AF17B-E5CF-41D4-963A-87F849576092} (SOConfig Class) - https://ezdata.gliconline.com/java/downloads/SOConfig32.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O16 - DPF: {465FAD36-B01B-40B7-836C-FA4B5AC6684E} (Install Class) - file:///D:/DL_Installer.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1212526777984
O16 - DPF: {8EB7A892-8135-11D1-842A-00A02495BC15} (AppLauncherCtrl2 Class) - http://w3.gliconline.com/scripts/AppLauncher2.cab
O16 - DPF: {9C57F717-5659-4657-89B7-5BA6F0EB37E1} (SmartBridge Class) - https://ezdata.gliconline.com/java/downloads/SmartOfficeLink.cab
O16 - DPF: {9E4A8277-58D1-11D4-8E62-00C04F6F3010} (VbRuntime.RuntimeControls) - http://w3.gliconline.com/Common/Cabs/GDL_VbRuntime.CAB
O16 - DPF: {D22621D3-E219-4B03-AF3E-5E8AEF7CC70B} (SmartBridge6 Class) - https://ezdata.gliconline.com/java/downloads/SmartOfficeLink6.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://emoneyadvisor.webex.com/client/T26L/training/ieatgpc.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E7DE712F-FC5D-11D4-B58B-00C04F584B78} (Pal2AXControl.Pal2DeleteExpiredFiles) - https://www6.glic.com/gol/palinforcedownload/Scripts/Pal2AXControl.CAB
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B440E0F4-469A-4927-AB90-5DC2BE71C584}: Domain = gcvs.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5776AF4-0697-435A-A1CD-51129FF70B45}: Domain = gcvs.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5776AF4-0697-435A-A1CD-51129FF70B45}: NameServer = 192.168.0.252,192.168.0.206
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: ASR Service (ASRSVC) - Lenovo Group Limited - C:\Program Files\ThinkPad\Tablet Shortcut\ASR\ASRSVC.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\notes\ntmulti.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe
O23 - Service: Power Manager DBC Service - Unknown owner - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: TABLET Service (TabletSVC) - Lenovo Group Limited - C:\Program Files\ThinkPad\Tablet Shortcut\TSMService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - Lenovo - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
O23 - Service: TVT Windows Update Monitor (TVT_UpdateMonitor) - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 19658 bytes


Please advise ASAP. Thanks!

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
  O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
  
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Nothing found by Malwarebyte. Now, however, I'm getting some error messages that rundll32.exe is being modified to run as an APP. It also references ieframe.dll. Any thoughts?

I'll look into it, for now, please post the MBAM log.

Malwarebytes' Anti-Malware 1.44
Database version: 3600
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/21/2010 10:08:20 AM
mbam-log-2010-01-21 (10-08-20).txt

Scan type: Quick Scan
Objects scanned: 138473
Time elapsed: 1 hour(s), 20 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 10-01-21.01 - Kevin 01/21/2010 17:50:59.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2022.1042 [GMT -6:00]
Running from: c:\documents and settings\Kevin\Desktop\Combo-Fix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\LOG.TXT
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
---- Previous Run -------
.
C:\LOG.TXT
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\Thumbs.db
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2009-12-22 to 2010-01-22 )))))))))))))))))))))))))))))))
.

2010-01-20 14:32 . 2010-01-20 15:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-20 14:32 . 2010-01-20 14:42 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-20 05:06 . 2010-01-20 05:06 -------- d-----w- c:\documents and settings\Kevin\Local Settings\Application Data\Tific
2010-01-20 05:05 . 2010-01-20 05:05 -------- d-----w- c:\documents and settings\Kevin\Application Data\Tific
2010-01-20 05:04 . 2010-01-20 05:04 -------- d-----w- c:\documents and settings\Kevin\Local Settings\Application Data\Symantec
2010-01-20 03:49 . 2009-05-07 07:04 157712 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-01-20 03:30 . 2010-01-20 03:30 -------- d-----w- c:\program files\CCleaner
2010-01-20 00:06 . 2010-01-20 00:06 -------- d-----w- c:\documents and settings\Kevin\Application Data\Malwarebytes
2010-01-20 00:06 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 00:06 . 2010-01-20 00:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 00:06 . 2010-01-20 00:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-20 00:06 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-19 23:58 . 2010-01-19 23:58 -------- d-----w- c:\program files\Trend Micro
2010-01-18 16:44 . 2010-01-18 16:44 -------- d-----w- c:\program files\PGP Corporation
2010-01-16 00:14 . 2010-01-16 00:14 -------- d-----w- c:\documents and settings\Kevin\Local Settings\Application Data\PCHealth
2010-01-13 02:40 . 2009-11-21 15:51 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-01-05 21:24 . 2010-01-21 23:57 7459616 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-02 00:19 . 2010-01-02 00:19 -------- d-----w- c:\documents and settings\Kevin\Application Data\Auslogics
2010-01-02 00:19 . 2010-01-02 00:19 -------- d-----w- c:\program files\Auslogics
2010-01-02 00:17 . 2010-01-02 00:17 -------- d-----w- c:\documents and settings\Kevin\Application Data\WinPatrol
2010-01-02 00:16 . 2010-01-02 00:16 -------- d-----w- c:\program files\BillP Studios
2010-01-01 20:56 . 2010-01-01 20:56 -------- d-----w- c:\documents and settings\Kevin\Local Settings\Application Data\Move Networks
2009-12-31 19:21 . 2009-12-31 19:21 -------- d-----w- c:\program files\TomTom International B.V
2009-12-31 19:21 . 2009-12-31 19:21 -------- d-----w- c:\program files\TomTom HOME 2
2009-12-23 15:40 . 2009-12-23 15:40 -------- d-----w- c:\program files\Common Files\Logitech

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-21 14:46 . 2009-03-12 14:48 -------- d-----w- c:\program files\myfbtoolbar
2010-01-21 00:44 . 2008-05-29 02:47 -------- d-----w- c:\program files\Picasa2
2010-01-20 13:30 . 2008-06-04 12:55 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-20 04:30 . 2009-03-19 14:03 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-01-20 03:43 . 2008-10-17 17:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-19 02:46 . 2008-05-29 02:57 -------- d---a-w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-18 18:25 . 2008-06-04 18:46 -------- d-----w- c:\program files\pdf995
2010-01-18 16:44 . 2009-12-11 14:25 114308 ----a-w- c:\windows\system32\PGPlspRollback.reg
2010-01-10 02:12 . 2009-03-12 19:54 -------- d-----w- c:\documents and settings\Kevin\Application Data\Skype
2010-01-07 16:12 . 2008-06-04 18:27 -------- d-----w- c:\program files\MoneyTrax
2010-01-05 21:36 . 2008-07-25 21:21 -------- d-----w- c:\documents and settings\All Users\Application Data\PCPitstop
2010-01-04 17:36 . 2008-05-29 02:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-04 17:36 . 2010-01-04 17:36 -------- d-----w- c:\program files\Linksys
2010-01-04 17:26 . 2008-06-04 18:48 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-03 14:29 . 2010-01-03 14:29 839680 ----a-w- c:\documents and settings\Kevin\Application Data\Macromedia\Authorware Web Player\NP32ASW\webplr08\webplr.exe
2010-01-03 14:29 . 2010-01-03 14:29 28672 ----a-w- c:\documents and settings\Kevin\Application Data\Macromedia\Authorware Web Player\NP32ASW\webplr08\dvd.dll
2010-01-03 14:29 . 2010-01-03 14:29 169472 ----a-w- c:\documents and settings\Kevin\Application Data\Macromedia\Authorware Web Player\NP32ASW\webplr08\js32.dll
2010-01-03 14:15 . 2009-03-12 14:48 -------- d-----w- c:\documents and settings\Kevin\Application Data\myfbtoolbar
2010-01-01 20:56 . 2010-01-01 20:56 144160 ----a-w- c:\documents and settings\Kevin\Application Data\Move Networks\uninstall.exe
2010-01-01 20:56 . 2009-03-07 23:22 -------- d-----w- c:\documents and settings\Kevin\Application Data\Move Networks
2010-01-01 20:56 . 2009-12-07 01:22 5603776 ----a-w- c:\documents and settings\Kevin\Application Data\Move Networks\plugins\npqmp071705000014.dll
2009-12-30 23:19 . 2009-08-06 14:33 -------- d-----w- c:\documents and settings\Kevin\Application Data\Dropbox
2009-12-23 15:33 . 2009-12-10 16:40 -------- d---a-w- c:\documents and settings\All Users\Application Data\Logishrd
2009-12-21 19:14 . 2006-04-30 22:51 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-20 17:37 . 2008-05-29 02:52 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-12-19 13:26 . 2010-01-21 18:19 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100121.005\NAVEX32A.DLL
2009-12-19 13:26 . 2010-01-21 18:18 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100121.005\NAVENG.SYS
2009-12-19 13:26 . 2010-01-21 18:18 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100121.005\EECTRL.SYS
2009-12-19 13:26 . 2010-01-21 18:18 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100121.005\CCERASER.DLL
2009-12-19 13:26 . 2010-01-21 18:18 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100121.005\ECMSVR32.DLL
2009-12-19 13:26 . 2010-01-21 18:18 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100121.005\NAVENG32.DLL
2009-12-19 13:26 . 2010-01-21 18:18 1323568 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100121.005\NAVEX15.SYS
2009-12-19 13:26 . 2010-01-21 18:18 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100121.005\ERASER.SYS
2009-12-19 13:22 . 2009-12-16 16:41 -------- d---a-w- c:\documents and settings\All Users\Application Data\Norton
2009-12-19 13:21 . 2009-12-19 13:21 -------- d-----w- c:\program files\Symantec
2009-12-19 13:21 . 2009-12-19 13:21 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-12-19 13:21 . 2009-12-19 13:21 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-12-19 13:21 . 2009-12-19 13:21 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-12-19 13:21 . 2009-12-19 13:21 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-12-19 13:20 . 2009-12-19 13:19 -------- d-----w- c:\program files\Norton Internet Security
2009-12-19 13:20 . 2009-12-19 13:20 -------- d-----w- c:\program files\Windows Sidebar
2009-12-18 15:11 . 2008-05-29 02:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-12-18 15:06 . 2009-12-18 15:06 -------- d-----w- c:\documents and settings\All Users\Application Data\PCSettings
2009-12-18 15:06 . 2009-12-18 15:06 -------- d-----w- c:\program files\NortonInstaller
2009-12-18 15:06 . 2009-12-18 15:06 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-12-18 15:06 . 2009-11-07 01:09 88449496 ------w- c:\documents and settings\All Users\Application Data\Norton\{NIS_Production_94_17.1.0.19_NUC}\NIS10UPEN.exe
2009-12-17 22:01 . 2009-12-17 22:01 371320 ----a-w- c:\windows\system32\PGPdydbg.dll
2009-12-17 22:01 . 2009-12-17 22:01 13432 ----a-w- c:\windows\system32\drivers\PGPwdefs.sys
2009-12-17 22:01 . 2009-12-17 22:01 1018488 ----a-w- c:\windows\system32\PGPiconv.dll
2009-12-17 22:01 . 2009-12-17 22:01 82040 ----a-w- c:\windows\system32\PGPtcl11.dll
2009-12-17 22:01 . 2009-12-17 22:01 536184 ----a-w- c:\windows\system32\PGPdskUI.dll
2009-12-17 22:01 . 2009-12-17 22:01 3256952 ----a-w- c:\windows\system32\PGPsc.dll
2009-12-17 22:01 . 2009-12-17 22:01 458360 ----a-w- c:\windows\system32\PGPsdkNL.dll
2009-12-17 22:01 . 2009-12-17 22:01 275064 ----a-w- c:\windows\system32\pgpgw.dll
2009-12-17 22:01 . 2009-12-17 22:01 1799288 ----a-w- c:\windows\system32\PGPsdk.dll
2009-12-17 22:01 . 2009-12-17 22:01 136312 ----a-w- c:\windows\system32\drivers\PGPfsfd.sys
2009-12-17 22:01 . 2009-12-17 22:01 50808 ----a-w- c:\windows\system32\PGPhk.dll
2009-12-17 22:01 . 2009-12-17 22:01 415352 ----a-w- c:\windows\system32\PGPdskEn.dll
2009-12-17 22:01 . 2009-12-17 22:01 191096 ----a-w- c:\windows\system32\PGPdiskLib.dll
2009-12-17 20:37 . 2010-01-13 15:58 14912 ----a-w- c:\documents and settings\All Users\Application Data\Lenovo\MessageCenterPlus\LocalRepository\Messages\MCPToLTT_ROW\LTTCheck.exe
2009-12-17 14:44 . 2010-01-13 15:58 560624 ----a-w- c:\documents and settings\All Users\Application Data\Lenovo\MessageCenterPlus\LocalRepository\Messages\MCPToLTT_ROW\appupdater.exe
2009-12-14 19:15 . 2009-12-14 19:15 2146304 ----a-w- c:\windows\system32\GPhotos.scr
2009-12-11 14:52 . 2009-12-11 14:52 -------- d-----w- c:\documents and settings\Kevin\Application Data\PGP Corporation
2009-12-11 14:48 . 2009-12-11 14:48 -------- d-----w- c:\documents and settings\All Users\Application Data\PGP Corporation
2009-12-11 14:24 . 2009-12-11 14:24 -------- d-----w- c:\program files\Common Files\PGP Corporation
2009-12-11 02:29 . 2009-12-16 16:41 1782128 ------w- c:\documents and settings\All Users\Application Data\Norton\NUA.exe
2009-12-10 17:06 . 2009-12-10 16:39 -------- d-----w- c:\program files\Common Files\LogiShrd
2009-12-10 16:43 . 2009-12-10 16:43 127034 ------r- c:\windows\bwUnin-8.1.1.50-8876480SL.exe
2009-12-10 16:42 . 2009-12-10 16:39 -------- d-----w- c:\program files\Logitech
2009-12-10 16:39 . 2009-12-10 16:39 -------- d---a-w- c:\documents and settings\All Users\Application Data\Logitech
2009-12-08 21:26 . 2009-12-08 21:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\Carbonite
2009-12-08 21:26 . 2009-12-08 21:26 -------- d-----w- c:\program files\Carbonite
2009-12-07 01:22 . 2009-12-07 01:22 97216 ----a-w- c:\documents and settings\Kevin\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-12-05 04:54 . 2009-12-05 04:54 529456 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHDrvx86.sys
2009-12-05 04:54 . 2009-12-05 04:54 201616 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHRules.dll
2009-12-05 04:54 . 2009-12-05 04:54 1405840 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHEngine.dll
2009-12-05 04:54 . 2009-12-05 04:54 668720 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHDrvx64.sys
2009-12-05 04:54 . 2009-12-05 04:54 610704 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\bbRGen.dll
2009-11-21 15:51 . 2006-04-30 22:51 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-18 14:08 . 2009-11-24 23:03 554480 ------w- c:\documents and settings\All Users\Application Data\Lenovo\MessageCenterPlus\LocalRepository\Messages\MCPToLTT\appupdater32.exe
2009-11-18 14:08 . 2009-11-24 23:03 553968 ------w- c:\documents and settings\All Users\Application Data\Lenovo\MessageCenterPlus\LocalRepository\Messages\MCPToLTT\appupdater64.exe
2009-11-13 22:57 . 2009-11-13 22:57 922112 ------w- c:\windows\system32\imapi2fs.dll
2009-11-13 22:57 . 2009-11-13 22:57 426496 ------w- c:\windows\system32\imapi2.dll
2009-11-12 14:28 . 2009-11-24 23:03 13888 ------w- c:\documents and settings\All Users\Application Data\Lenovo\MessageCenterPlus\LocalRepository\Messages\MCPToLTT\LTTCheck.exe
2009-11-11 12:39 . 2008-05-29 03:02 70008 ------w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-09 19:38 . 2009-11-09 19:36 14248968 ------w- c:\documents and settings\Kevin\Application Data\E-Z Data\SODMInstallations\SmartOfficeUtilities.exe
2009-11-07 01:08 . 2009-12-19 13:20 893296 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\CLT\cltLMSx.dll
2009-10-29 02:31 . 2009-12-19 13:22 784752 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\coFFPlgn\components\coFFPlgn.dll
2009-05-19 19:59 . 2008-07-22 22:13 27976 ------w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-05-19 19:59 . 2008-07-22 22:13 126360 ------w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-05-19 20:00 . 2009-05-19 20:00 46408 ------w- c:\program files\mozilla firefox\plugins\atmccli.dll
2009-05-19 19:59 . 2009-05-19 19:59 98712 ------w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2009-09-19 02:09 574096 ------r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2009-09-19 02:09 574096 ------r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2009-09-19 02:09 574096 ------r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-06-27 03:02 77824 ------w- c:\documents and settings\Kevin\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-06-27 03:02 77824 ------w- c:\documents and settings\Kevin\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-06-27 03:02 77824 ------w- c:\documents and settings\Kevin\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHandlerAccessible]
@="{3DBF5F01-3287-46EB-82CF-45AA5C241162}"
[HKEY_CLASSES_ROOT\CLSID\{3DBF5F01-3287-46EB-82CF-45AA5C241162}]
2009-12-17 22:02 613496 ----a-w- c:\windows\system32\PGPfsshl.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaserAppUpdate"="c:\program files\Laser App Enterprise\laupdate.exe" [2009-05-27 1533720]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"TSMResident"="c:\program files\ThinkPad\Tablet Shortcut\TSMRESIDENT.EXE" [2007-10-29 45056]
"TrackPointSrv"="c:\program files\Lenovo\TrackPoint\tp4serv.exe" [2008-03-04 92960]
"TpShocks"="TpShocks.exe" [2008-06-06 181536]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2007-01-09 868352]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-03-24 68464]
"TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-14 271872]
"Snippet"="c:\program files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" [2005-02-25 68296]
"SKDaemon.exe"="c:\program files\Lenovo\Productivity Keyboard\SKDaemon.exe" [2007-02-09 262144]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2008-06-10 311296]
"PC Booster"="c:\program files\inKline Global\PC Booster\pcbooster.exe" [2003-10-27 5541957]
"Mouse Suite 98 Daemon"="ICO.EXE" [2004-07-14 57344]
"Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976]
"LPManager"="c:\progra~1\THINKV~2\PrdCtr\LPMGR.exe" [2008-01-11 144728]
"LPMailChecker"="c:\progra~1\THINKV~2\PrdCtr\LPMLCHK.exe" [2008-01-11 124248]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-07 141848]
"IBMTBCTL"="c:\program files\ThinkPad\Tablet Shortcut\IBMTBCTL.EXE" [2007-10-29 782336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-07 162328]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-06-05 242976]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2008-06-14 3073336]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2009-09-19 670864]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2008-06-10 208896]
"AwaySch"="c:\program files\Lenovo\AwayTask\AwaySch.EXE" [2006-11-07 91688]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2008-03-14 126976]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2008-03-14 425984]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-12-10 66864]
PGPtray.exe.lnk - c:\windows\Installer\{28E0F0A8-E555-4077-A6E1-63DBF2B29D32}\Icon6560581611.exe [2010-1-18 55296]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 ------w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-08-14 20:54 89600 ------w- c:\windows\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 10:41 11776 ------w- c:\windows\system32\tabbtnwl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 07:37 34344 ------w- c:\program files\Lenovo\HOTKEY\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 ------w- c:\windows\system32\tpgwlnot.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-03-17 21:02 34080 ------w- c:\program files\Lenovo\HOTKEY\tphklock.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd PGPpwflt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Kevin^Start Menu^Programs^Startup^Adobe Media Player.lnk]
path=c:\documents and settings\Kevin\Start Menu\Programs\Startup\Adobe Media Player.lnk
backup=c:\windows\pss\Adobe Media Player.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 17:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 09:45 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-11-06 20:12 133104 -----tw- c:\documents and settings\Kevin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GzSnd]
2006-09-12 02:25 237568 ------w- c:\program files\Gunze\GZTP_Pack\GzSnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2008-08-04 21:22 160800 ------w- c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2008-02-13 19:06 2196240 ------w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-09-07 01:27 137752 ------w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TabletWizard]
2008-04-14 00:12 16384 ------w- c:\windows\Help\splshwrp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Upromise Tray]
2009-10-10 22:43 167936 ------w- c:\program files\Upromise\UpromiseTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Upromise Update]
2009-10-07 22:18 81920 ------w- c:\program files\Upromise\dca-ua.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-19 01:05 204288 ------w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WPC600NSvc"=2 (0x2)
"WMPNetworkSvc"=2 (0x2)
"wlidsvc"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"SeaPort"=2 (0x2)
"MSSQL$MSSMLBIZ"=3 (0x3)
"MSSQL$LBSOFFLINE"=2 (0x2)
"MSCamSvc"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"fsssvc"=3 (0x3)
"Cassini Web Server"=2 (0x2)
"wltrysvc"=2 (0x2)
"NIS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 pgpfs;PGP File Sharing;c:\windows\system32\drivers\PGPfsfd.sys [12/17/2009 4:01 PM 136312]
R0 Pgpwdefs;Pgpwdefs;c:\windows\system32\drivers\PGPwdefs.sys [12/17/2009 4:01 PM 13432]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1101000.013\SymDS.sys [12/19/2009 7:21 AM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1101000.013\SymEFA.sys [12/19/2009 7:21 AM 171056]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [5/14/2008 3:21 PM 19496]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHDrvx86.sys [12/4/2009 10:54 PM 529456]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1101000.013\cchpx86.sys [12/19/2009 7:21 AM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1101000.013\Ironx86.sys [12/19/2009 7:21 AM 114736]
R1 TSMSMI;Lenovo System Interface Driver;c:\windows\system32\drivers\tsmsmi32.sys [5/28/2008 8:31 PM 6656]
R1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [12/5/2007 3:42 PM 46144]
R2 ASRSVC;ASR Service;c:\program files\ThinkPad\Tablet Shortcut\ASR\ASRSVC.exe [7/28/2008 5:15 PM 73728]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [9/24/2009 12:32 PM 54752]
R2 MSSQL$PTPROFESSIONAL41;SQL Server (PTPROFESSIONAL41);c:\program files\The Monticello Corporation\MSSQL.3\MSSQL\Binn\sqlservr.exe [5/27/2009 2:27 AM 29262680]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe [12/19/2009 7:20 AM 126392]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.exe [7/28/2008 5:14 PM 94208]
R2 smihlp2;SMI Helper Driver (smihlp2);c:\program files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [8/14/2007 2:46 PM 10896]
R2 TabletSVC;TABLET Service;c:\program files\ThinkPad\Tablet Shortcut\TSMService.exe [7/28/2008 5:15 PM 69632]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [12/5/2007 4:17 PM 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [12/5/2007 3:42 PM 360448]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/21/2009 2:02 PM 102448]
R3 gwmdd;gwmdd;c:\windows\system32\drivers\gwmdd.sys [2/23/2005 6:13 AM 2560]
R3 GzTpHid;Touch Panel Filter Driver;c:\windows\system32\drivers\GzTpHid.sys [10/2/2007 1:26 AM 27008]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20100119.001\IDSXpx86.sys [1/20/2010 3:40 PM 329592]
R3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [5/10/2007 10:34 AM 22568]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [5/22/2007 4:59 PM 30336]
R3 wisdpen;Wacom Penabled MiniDriver;c:\windows\system32\drivers\wisdpen.sys [10/2/2007 1:26 AM 34736]
S3 MSHUSBVideo;NX6000/NX3000/VX5000/VX5500/VX7000 Filter Driver;c:\windows\system32\drivers\nx6000.sys [3/19/2009 7:46 AM 33808]
S3 WPC600N;Linksys Dual Band Wireless-N Notebook Adapter WPC600N;c:\windows\system32\drivers\WPC600N.SYS [1/4/2010 11:36 AM 822400]
S4 Cassini Web Server;Cassini Web Server;c:\program files\Living Balance Sheet Offline\bin\WebService.exe [9/10/2008 4:05 PM 9728]
S4 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 9:48 PM 704864]
S4 MSSQL$LBSOFFLINE;SQL Server (LBSOFFLINE);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [5/27/2009 2:27 AM 29262680]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [11/13/2009 5:31 AM 92008]
S4 WPC600NSvc;WPC600NSvc;c:\program files\Linksys\WPC600N\WLService.exe [1/4/2010 11:36 AM 65596]
.
Contents of the 'Scheduled Tasks' folder

2010-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3894222581-2102978085-3380156733-1008Core.job
- c:\documents and settings\Kevin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-06 20:12]

2010-01-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3894222581-2102978085-3380156733-1008UA.job
- c:\documents and settings\Kevin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-06 20:12]

2008-10-29 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2007-08-31 19:01]

2010-01-19 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Kevin.job
- c:\program files\Norton Internet Security\Engine\17.1.0.19\Navw32.exe [2009-12-19 00:56]

2010-01-22 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2008-05-29 06:40]

2010-01-22 c:\windows\Tasks\User_Feed_Synchronization-{995E72D6-009E-45B6-B27B-184483F81B8D}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\PGPlsp.dll
Trusted Zone: ez-data.com
Trusted Zone: ezdata.com
Trusted Zone: glic.com\www10
Trusted Zone: glic.com\www6
Trusted Zone: gliconline.com\w3
Trusted Zone: gliconline.com/java
Trusted Zone: guardianonline.com\www
Trusted Zone: smartofficeonline.com
TCP: {C5776AF4-0697-435A-A1CD-51129FF70B45} = 192.168.0.252,192.168.0.206
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {1FA44E01-A60B-4449-BF97-66CDAA200433} - hxxps://ezdata.gliconline.com/java/downloads/SOConfig6.cab
DPF: {21D817CE-B22E-11D2-B514-00C04F930B5E} - hxxp://w3.gliconline.com/Common/Scripts/GuardianDownload.CAB
DPF: {2E764AF3-8311-11D2-B4EC-00C04F930B5E} - hxxp://w3.gliconline.com/GuardianHelp/Scripts/ctlDownloadHelp_2.CAB
DPF: {2F01ABF9-0799-11D2-B771-00C04F930B5E} - hxxp://w3.gliconline.com/GuardianHelp/scripts/ctlshowHelp_3.CAB
DPF: {3E755E01-BB38-11D4-B44C-00105A0D610A} - hxxp://w3.gliconline.com/Common/Cabs/ctlCommonControls.CAB
DPF: {439AF17B-E5CF-41D4-963A-87F849576092} - hxxps://ezdata.gliconline.com/java/downloads/SOConfig32.cab
DPF: {465FAD36-B01B-40B7-836C-FA4B5AC6684E} - file:///D:/DL_Installer.cab
DPF: {8EB7A892-8135-11D1-842A-00A02495BC15} - hxxp://w3.gliconline.com/scripts/AppLauncher2.cab
DPF: {9C57F717-5659-4657-89B7-5BA6F0EB37E1} - hxxps://ezdata.gliconline.com/java/downloads/SmartOfficeLink.cab
DPF: {9E4A8277-58D1-11D4-8E62-00C04F6F3010} - hxxp://w3.gliconline.com/Common/Cabs/GDL_VbRuntime.CAB
DPF: {D22621D3-E219-4B03-AF3E-5E8AEF7CC70B} - hxxps://ezdata.gliconline.com/java/downloads/SmartOfficeLink6.cab
DPF: {E7DE712F-FC5D-11D4-B58B-00C04F584B78} - hxxps://www6.glic.com/gol/palinforcedownload/Scripts/Pal2AXControl.CAB
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{A057A204-BACC-4D26-8988-34A187E2698B} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-21 18:09
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.1.0.19\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{07D8F296-AA83-3A62-01DE-3BAC17CF0E0A}*\InprocServer32]
"{07D8F296-AA83-3A62-01DE-3BAC17CF0E0A}"=hex:79,05,a2,2c,04,9a,86,e8,d6,32,d9,
50,1e,59,e5,d4,05,ad,d8,77,a8,06,1a,45,79,05,a2,2c,04,9a,86,e8,79,05,a2,2c,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{1F6BB78D-F338-A91D-9F32-D4D6F83604D0}*\InprocServer32]
"{1F6BB78D-F338-A91D-9F32-D4D6F83604D0}"=hex:8c,5c,8a,36,fc,aa,2c,3d,87,22,49,
2b,96,9c,d4,67,4d,9e,33,88,db,2f,1e,c5,8c,5c,8a,36,fc,aa,2c,3d,8c,5c,8a,36,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{200BE4BB-4FC0-5AFA-C6D1-220BE978B08C}*\InprocServer32]
"{200BE4BB-4FC0-5AFA-C6D1-220BE978B08C}"=hex:f4,c8,57,8d,1b,c6,44,7b,de,33,d9,
9d,a1,c5,b3,a0,17,7a,b0,2d,3a,ca,6a,ee,f4,c8,57,8d,1b,c6,44,7b,f4,c8,57,8d,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{28D36FA1-81E5-905B-E1A5-69CE29BCC372}*\InprocServer32]
"{28D36FA1-81E5-905B-E1A5-69CE29BCC372}"=hex:5b,55,d0,05,62,6e,25,a5,52,7d,4e,
c0,82,a6,fb,fd,98,c1,d4,e8,3c,e1,56,c0,5b,55,d0,05,62,6e,25,a5,5b,55,d0,05,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{3967DD02-FF3D-133A-C2FC-117A1E62BD81}*\InprocServer32]
"{3967DD02-FF3D-133A-C2FC-117A1E62BD81}"=hex:a7,f7,69,e9,28,a3,f2,67,39,27,65,
ff,07,74,b6,a3,3c,e9,18,94,29,ab,7c,ee,a7,f7,69,e9,28,a3,f2,67,a7,f7,69,e9,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{5E683230-6E82-50E0-FDB1-FE0C00703A02}*\InprocServer32]
"{5E683230-6E82-50E0-FDB1-FE0C00703A02}"=hex:cc,2a,73,23,cb,68,44,37,ce,27,13,
fb,98,31,e0,e1,94,95,e9,54,84,66,ff,6a,cc,2a,73,23,cb,68,44,37,cc,2a,73,23,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{60219F0B-1195-E58A-8355-E98A127A0E14}*\InprocServer32]
"{60219F0B-1195-E58A-8355-E98A127A0E14}"=hex:99,20,f7,df,64,62,8c,92,bc,9d,0d,
3c,53,49,9e,d1,99,9d,15,70,1a,b7,86,e5,99,20,f7,df,64,62,8c,92,99,20,f7,df,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{6FD359DD-C2B2-3A5D-0C6E-064E11A5EF2E}*\InprocServer32]
"{6FD359DD-C2B2-3A5D-0C6E-064E11A5EF2E}"=hex:88,d0,8e,38,e5,ae,9f,4c,e3,7e,48,
0e,4c,62,c5,f6,1a,6c,06,64,43,01,27,ff,88,d0,8e,38,e5,ae,9f,4c,88,d0,8e,38,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{991DF09A-82D0-791A-660C-E577B22025C6}*\InprocServer32]
"{991DF09A-82D0-791A-660C-E577B22025C6}"=hex:9a,1f,08,0a,11,d6,63,ab,83,5b,c1,
53,a2,57,26,37,14,11,ad,ca,8e,e7,cf,bf,9a,1f,08,0a,11,d6,63,ab,9a,1f,08,0a,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{B0610F6E-A8F1-AA3D-AA5C-A177931C3DE8}*\InprocServer32]
"{B0610F6E-A8F1-AA3D-AA5C-A177931C3DE8}"=hex:3d,d6,66,31,69,01,cb,5a,17,a2,5d,
27,75,66,fe,b3,9a,e8,fa,1c,a3,c8,a7,a0,3d,d6,66,31,69,01,cb,5a,3d,d6,66,31,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{BD256A4A-195F-07E3-9422-847F9FF72412}*\InprocServer32]
"{BD256A4A-195F-07E3-9422-847F9FF72412}"=hex:a6,f3,bc,49,6b,fb,67,79,4d,bc,f8,
70,a4,dd,81,62,8c,e8,5a,19,52,14,40,57,a6,f3,bc,49,6b,fb,67,79,a6,f3,bc,49,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{C15C9FC1-AE76-3460-A970-2F45F939DBF9}*\InprocServer32]
"{C15C9FC1-AE76-3460-A970-2F45F939DBF9}"=hex:cf,fa,8f,0b,d9,2e,80,db,5c,58,ae,
50,15,2d,58,23,79,7c,80,77,65,1e,c3,21,cf,fa,8f,0b,d9,2e,80,db,cf,fa,8f,0b,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{C2FE951E-ADA0-DB2A-99BC-2EBC77FCECC6}*\InprocServer32]
"{C2FE951E-ADA0-DB2A-99BC-2EBC77FCECC6}"=hex:fd,bf,a6,c1,4e,72,55,45,7f,ec,e8,
aa,f9,f1,46,15,ed,f5,e1,14,6d,ee,6d,7d,fd,bf,a6,c1,4e,72,55,45,fd,bf,a6,c1,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{E0FF97F8-31D8-F6D0-D029-3E27B62781AA}*\InprocServer32]
"{E0FF97F8-31D8-F6D0-D029-3E27B62781AA}"=hex:fc,f8,5f,f5,b9,b0,a6,e0,50,3c,91,
27,8f,ab,75,b5,2c,95,44,0c,a0,1a,e0,ce,fc,f8,5f,f5,b9,b0,a6,e0,fc,f8,5f,f5,\

[HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{EB785DEB-C6F5-7AC2-5C32-075B1B789D0F}*\InprocServer32]
"{EB785DEB-C6F5-7AC2-5C32-075B1B789D0F}"=hex:fe,11,0d,8a,62,a0,48,84,36,de,58,
b1,09,55,7f,a6,50,e9,b8,c0,ac,b3,c7,74,fe,11,0d,8a,62,a0,48,84,fe,11,0d,8a,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(980)
c:\windows\system32\vrlogon.dll
c:\windows\system32\psqlpwd.dll
c:\program files\ThinkVantage Fingerprint Software\homefus2.dll
c:\program files\ThinkVantage Fingerprint Software\infra.dll
c:\program files\ThinkVantage Fingerprint Software\homepass.dll
c:\program files\ThinkVantage Fingerprint Software\bio.dll
c:\program files\ThinkVantage Fingerprint Software\ps2css.dll
c:\program files\ThinkVantage Fingerprint Software\remote.dll
c:\program files\ThinkVantage Fingerprint Software\pscssint.dll
c:\program files\Lenovo\HOTKEY\tphklock.dll
c:\program files\ThinkVantage Fingerprint Software\crypto.dll

- - - - - - - > 'lsass.exe'(1036)
c:\windows\system32\psqlpwd.dll
c:\program files\ThinkVantage Fingerprint Software\homefus2.dll
c:\program files\ThinkVantage Fingerprint Software\infra.dll

- - - - - - - > 'explorer.exe'(8824)
c:\windows\system32\WININET.dll
c:\windows\system32\PGPhk.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\program files\Lenovo\Client Security Solution\tvtpwm_windows_hook.dll
c:\program files\Lenovo\Client Security Solution\tvtpwm_interface.dll
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\documents and settings\Kevin\Application Data\Dropbox\bin\DropboxExt.3.dll
c:\windows\system32\PGPfsshl.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\program files\windows journal\nbmaptip.dll
c:\windows\IME\SPGRMR.DLL
c:\windows\system32\ieframe.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\System32\tabbtnu.exe
c:\windows\system32\IPSSVC.EXE
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Carbonite\Carbonite Backup\carboniteservice.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\notes\ntmulti.exe
c:\windows\system32\PGPserv.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Microsoft Shared\Ink\TCServer.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\System32\TPHDEXLG.exe
c:\windows\system32\TpKmpSVC.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Lenovo\Client Security Solution\tvttcsd.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\program files\Lenovo\Rescue and Recovery\ADM\IUService.exe
c:\program files\Common Files\Lenovo\Logger\logmon.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\TpShocks.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\windows\system32\rundll32.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
c:\program files\lenovo\system update\suservice.exe
c:\windows\system32\ICO.EXE
c:\windows\system32\FSRremoS.EXE
c:\program files\Microsoft IntelliPoint\dpupdchk.exe
c:\windows\system32\wscntfy.exe
c:\program files\PGP Corporation\PGP Desktop\PGPtray.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\program files\Lenovo\Client Security Solution\password_manager.exe
.
**************************************************************************
.
Completion time: 2010-01-21 18:14:57 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-22 00:14

Pre-Run: 100,999,491,584 bytes free
Post-Run: 102,045,396,992 bytes free

- - End Of File - - 57FDCFE33A4E6D7E38E4ACFEBD4BADA7

Hello.

1. Close any open browsers.
   
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
3. Open notepad and copy/paste the text in the quotebox below into it:
   

   
   Folder::
   c:\program files\myfbtoolbar
   
   RegLock::
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{07D8F296-AA83-3A62-01DE-3BAC17CF0E0A}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{1F6BB78D-F338-A91D-9F32-D4D6F83604D0}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{200BE4BB-4FC0-5AFA-C6D1-220BE978B08C}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{28D36FA1-81E5-905B-E1A5-69CE29BCC372}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{3967DD02-FF3D-133A-C2FC-117A1E62BD81}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{5E683230-6E82-50E0-FDB1-FE0C00703A02}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{60219F0B-1195-E58A-8355-E98A127A0E14}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{6FD359DD-C2B2-3A5D-0C6E-064E11A5EF2E}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{991DF09A-82D0-791A-660C-E577B22025C6}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{B0610F6E-A8F1-AA3D-AA5C-A177931C3DE8}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{BD256A4A-195F-07E3-9422-847F9FF72412}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{C15C9FC1-AE76-3460-A970-2F45F939DBF9}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{C2FE951E-ADA0-DB2A-99BC-2EBC77FCECC6}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{E0FF97F8-31D8-F6D0-D029-3E27B62781AA}*\InprocServer32]
   [HKEY_USERS\S-1-5-21-606747145-2025429265-682003330-500_Classes\Software\CLASSES\CLSID\{EB785DEB-C6F5-7AC2-5C32-075B1B789D0F}*\InprocServer32]
   

   
   
4. Save this as CFScript.txt, in the same location as ComboFix.exe
   
   
   
   
5. Referring to the picture above, drag CFScript into ComboFix.exe
   
6. When finished, it shall produce a log for you at C:\ComboFix.txt
   
7. Please post the contents of the log in your next reply.