ie7 hijacked

Had my ie7 hijacked twice this week from 2 different machines. Downloaded Malwarebyte's Anti-Malware and scanned both times, coming up with nada. Sent machine 1 off for OS reinstallation.

Hijackthis log from machine 2, after upgrading to ie8 (which isn't hijacked!) and the recommended MS/Java/Adobe updates.
**********************************************************************
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:26 AM, on 3/4/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Intel\WiFi\bin\WLKeeper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\cgrogan\Application Data\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\JavaSoft\JRE\1.3.1_13\bin\npjava131_13.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\JavaSoft\JRE\1.3.1_13\bin\npjava131_13.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190323415140
O16 - DPF: {983D8326-C602-11D5-9EAB-00055DF0DDE4} (Sp2tc Control) - file://oma-fs1/apps/MBD%20install/MBD_Websphere%20Version%205/sp2tc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = integriguard.org
O17 - HKLM\Software\..\Telephony: DomainName = integriguard.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = integriguard.org
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Intel PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Iap - Dell Inc. - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\WLKeeper.exe

--
End of file - 7024 bytes
**********************************************************************
Can you tell if the install of ie8 managed to get rid of the malware from this log? I would really like to know it's gone. Those random porn pop-ups at work are rather embarrassing.

Thanks much,
Chris

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

That was fast - thanks! After I removed the checked line via Hijackthis, I uninstalled MBAM and reinstalled from your link above, including updates. I just completed the Quick Scan, and no infected files were found. Log is below.
**********************************************************
Malwarebytes' Anti-Malware 1.44
Database version: 3825
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3/4/2010 5:03:40 PM
mbam-log-2010-03-04 (17-03-40).txt

Scan type: Quick Scan
Objects scanned: 183979
Time elapsed: 10 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
***********************************************************
Merci,
Chris

Hello.

Download OTL by OldTimer to your Desktop.

• Close all windows and double click OTL.exe
  
• Click Run Scan and let the program run uninterrupted
  
• It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
  
• You may need to use two posts to get it all.
  

OT log file:
*************************************************************
OTL logfile created on: 3/5/2010 10:30:13 AM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\cgrogan\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 74.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.79 Gb Total Space | 65.70 Gb Free Space | 58.77% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BKB3QH1
Current User Name: cgrogan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/03/05 10:29:32 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\cgrogan\Desktop\OTL.exe
PRC - [2010/03/05 10:28:13 | 001,035,032 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgupd.exe
PRC - [2010/02/25 13:11:38 | 001,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/02/25 13:11:37 | 000,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/02/25 13:11:37 | 000,503,576 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/02/25 13:11:36 | 000,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/02/25 13:11:35 | 002,033,432 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/02/25 13:11:33 | 000,827,160 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgam.exe
PRC - [2010/02/25 13:11:31 | 000,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2008/08/20 17:38:30 | 000,860,160 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe
PRC - [2008/08/20 17:28:34 | 000,348,160 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe
PRC - [2008/08/20 17:18:34 | 000,905,216 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
PRC - [2008/08/20 17:09:12 | 001,191,936 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
PRC - [2008/08/20 17:08:02 | 000,466,944 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/02 04:15:50 | 000,075,520 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe
PRC - [2007/05/02 04:15:49 | 000,251,648 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.5.0_12\bin\jucheck.exe
PRC - [2007/02/19 14:27:16 | 000,090,112 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
PRC - [2007/01/19 22:14:54 | 000,239,864 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\OpenManage\Client\Iap.exe
PRC - [2004/06/15 14:29:42 | 000,380,928 | ---- | M] (RealVNC Ltd.) -- C:\Program Files\RealVNC\VNC4\winvnc4.exe
PRC - [2001/08/17 21:36:38 | 000,032,256 | ---- | M] (Brother Industries, Ltd.) -- C:\WINDOWS\system32\BrmfRsmg.exe


========== Modules (SafeList) ==========

MOD - [2010/03/05 10:29:32 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\cgrogan\Desktop\OTL.exe


========== Win32 Services (SafeList) ==========

SRV - [2010/02/25 13:11:31 | 000,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2008/08/20 17:38:30 | 000,860,160 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008/08/20 17:28:34 | 000,348,160 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe -- (WLANKEEPER) Intel(R)
SRV - [2008/08/20 17:18:34 | 000,905,216 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe -- (S24EventMonitor)
SRV - [2008/08/20 17:08:02 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2007/02/19 14:27:16 | 000,090,112 | ---- | M] (SigmaTel, Inc.) [Auto | Running] -- C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe -- (STacSV)
SRV - [2007/01/19 22:14:54 | 000,239,864 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\OpenManage\Client\Iap.exe -- (Iap)
SRV - [2006/08/25 13:00:38 | 002,528,960 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE -- (LiveUpdate)
SRV - [2004/06/15 14:29:42 | 000,380,928 | ---- | M] (RealVNC Ltd.) [Auto | Running] -- C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- (WinVNC4)


========== Driver Services (SafeList) ==========

DRV - [2010/02/25 13:12:13 | 000,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/02/25 13:12:13 | 000,161,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\System32\Drivers\avgrkx86.sys -- (AvgRkx86)
DRV - [2010/02/25 13:12:09 | 000,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/02/25 13:12:03 | 000,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2008/10/24 19:00:32 | 001,287,552 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2008/08/29 00:34:30 | 003,632,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel(R)
DRV - [2008/08/04 12:32:26 | 000,011,904 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2008/04/13 13:36:41 | 000,063,744 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mf.sys -- (mf)
DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/02/22 06:46:00 | 006,658,592 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2007/05/16 18:14:58 | 005,707,744 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2007/03/13 14:26:06 | 000,160,256 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2007/02/23 15:47:34 | 000,056,576 | ---- | M] (O2Micro) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\oz776.sys -- (guardian2)
DRV - [2007/02/19 14:27:34 | 001,228,296 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2006/11/02 18:47:36 | 000,989,696 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2006/11/02 18:47:00 | 000,209,152 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2006/11/02 18:46:56 | 000,730,112 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2006/10/27 09:26:18 | 000,019,968 | R--- | M] (Dell Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)
DRV - [2001/08/17 12:12:22 | 000,010,368 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrUsbScn.sys -- (BrUsbScn)
DRV - [2001/08/17 12:12:20 | 000,060,416 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrSerWdm.sys -- (BrSerWDM)
DRV - [2001/08/17 12:12:20 | 000,011,008 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrUsbMdm.sys -- (BrUsbMdm)
DRV - [2001/08/17 12:12:12 | 000,002,944 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrFilt.sys -- (brfilt)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E2 6D A2 AC B5 BB CA 01 [binary data]
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/03 15:48:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/04 10:32:53 | 000,000,000 | ---D | M]

[2010/03/03 15:48:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\cgrogan\Application Data\Mozilla\Extensions
[2010/03/03 15:49:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\cgrogan\Application Data\Mozilla\Firefox\Profiles\1bwmsk1j.default\extensions
[2010/03/03 15:49:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\cgrogan\Application Data\Mozilla\Firefox\Profiles\1bwmsk1j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/03 15:48:11 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2006/02/28 07:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\System32\WLTRAY.exe File not found
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe (Sun Microsystems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O15 - HKCU\..Trusted Domains: internet ([]about in Local intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190323415140 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-1_5_0_12-windows-i586.cab (Java Plug-in 1.5.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {983D8326-C602-11D5-9EAB-00055DF0DDE4} file://oma-fs1/apps/MBD%20install/MBD_Websphere%20Version%205/sp2tc.cab (Sp2tc Control)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_12-windows-i586.cab (Java Plug-in 1.5.0_12)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 198.6.100.25 12.127.17.71
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = integriguard.org
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (IWPDGINA.DLL) - C:\WINDOWS\System32\IWPDGINA.dll (Intel(R) Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\ppeclt: DllName - PPEClt.dll - C:\WINDOWS\System32\PPEClt.dll (ANIXIS)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/09/20 15:24:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/05 10:29:31 | 000,553,984 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\cgrogan\Desktop\OTL.exe
[2010/03/04 16:52:01 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/04 16:52:00 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/04 16:51:59 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/04 16:49:33 | 005,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\cgrogan\Application Data\mbam-setup.exe
[2010/03/04 16:48:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\backups
[2010/03/04 11:15:05 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\cgrogan\IECompatCache
[2010/03/04 11:13:50 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\cgrogan\PrivacIE
[2010/03/04 11:10:10 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\cgrogan\IETldCache
[2010/03/04 10:45:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/03/04 10:41:57 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/03/04 10:32:23 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2010/03/04 10:31:34 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/03/04 10:05:46 | 000,050,504 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys
[2010/03/04 10:05:45 | 000,024,368 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys
[2010/03/03 15:50:49 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\cgrogan\Application Data\HijackThis.exe
[2010/03/03 15:48:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\Mozilla
[2010/03/03 15:45:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\My Documents\Downloads
[2010/03/03 15:44:37 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010/03/03 15:42:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\Mozilla
[2010/03/03 14:36:49 | 008,327,264 | ---- | C] (Mozilla) -- C:\Documents and Settings\cgrogan\Desktop\Firefox Setup 3.6.exe
[2010/03/02 14:27:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\My Documents\Updater5
[2010/03/02 05:24:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\Malwarebytes
[2010/03/01 15:27:35 | 027,386,256 | ---- | C] ( ) -- C:\Documents and Settings\cgrogan\Application Data\AdbeRdr930_en_US.exe
[2010/03/01 15:19:19 | 016,372,000 | ---- | C] (Sun Microsystems, Inc.) -- C:\Documents and Settings\cgrogan\Application Data\jre-6u18-windows-x64.exe
[2010/03/01 14:59:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\Sun
[2010/03/01 14:50:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/03/01 13:21:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\My Documents\My SAS Files
[2010/03/01 13:21:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\SAS
[2010/03/01 11:54:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2010/03/01 11:53:08 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\odbctl32.dll
[2010/03/01 11:53:07 | 000,119,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\SQLSTR.DLL
[2010/03/01 11:53:07 | 000,028,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dbmsvinn.dll
[2010/03/01 11:53:06 | 000,089,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\VB5DB.DLL
[2010/03/01 11:53:06 | 000,033,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dbmsspxn.dll
[2010/03/01 11:53:06 | 000,033,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dbmsshrn.dll
[2010/03/01 11:53:06 | 000,033,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dbmsadsn.dll
[2010/03/01 11:53:06 | 000,028,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dbmssocn.dll
[2010/03/01 11:53:02 | 001,238,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msjt4jlt.dll
[2010/03/01 11:53:02 | 001,050,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msjet35.dll
[2010/03/01 11:53:02 | 000,344,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msexch35.dll
[2010/03/01 11:53:02 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msxbse35.dll
[2010/03/01 11:53:02 | 000,262,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msrd2x35.dll
[2010/03/01 11:53:02 | 000,252,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msexcl35.dll
[2010/03/01 11:53:02 | 000,250,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mspdox35.dll
[2010/03/01 11:53:02 | 000,168,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msltus35.dll
[2010/03/01 11:53:02 | 000,166,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mstext35.dll
[2010/03/01 11:53:02 | 000,123,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msjint35.dll
[2010/03/01 11:53:01 | 000,415,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msrepl35.dll
[2010/03/01 11:53:01 | 000,368,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\VBAR332.DLL
[2010/03/01 11:53:01 | 000,044,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msrpfs35.dll
[2010/03/01 11:53:01 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\JETCOMP.exe
[2010/03/01 11:53:01 | 000,024,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msjter35.dll
[2010/03/01 11:23:23 | 000,127,078 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/03/01 11:23:23 | 000,053,346 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/03/01 11:23:22 | 000,049,248 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/03/01 11:22:18 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2010/03/01 11:22:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE
[2010/03/01 11:21:48 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc70.dll
[2010/03/01 11:21:48 | 000,964,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc70u.dll
[2010/03/01 11:21:48 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvci70.dll
[2010/03/01 11:21:47 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\gdiplus.dll
[2010/03/01 11:21:47 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\atl70.dll
[2010/03/01 11:21:24 | 000,000,000 | ---D | C] -- C:\Program Files\SAS
[2010/02/25 15:28:53 | 000,000,000 | ---D | C] -- C:\SAS Software Depot
[2010/02/25 15:26:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SAS
[2010/02/25 15:25:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\SAS
[2010/02/25 13:36:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\ICAClient
[2010/02/25 13:12:26 | 000,000,000 | -H-D | C] -- C:\$AVG
[2010/02/25 13:12:14 | 000,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/02/25 13:12:13 | 000,360,584 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/02/25 13:12:13 | 000,161,800 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgrkx86.sys
[2010/02/25 13:12:09 | 000,333,192 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/02/25 13:12:03 | 000,028,424 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/02/25 13:11:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\Avg
[2010/02/25 13:11:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/02/25 13:11:30 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2010/02/25 13:11:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/02/25 13:10:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/02/25 13:10:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/02/25 13:10:28 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/02/25 13:10:28 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/02/25 12:40:18 | 000,891,192 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\cgrogan\My Documents\avg_avwt_stb_all_9_40.exe
[2010/02/25 12:36:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\Adobe
[2010/02/25 12:36:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\Macromedia
[2010/02/25 12:36:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\Adobe
[2010/02/25 12:27:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\Identities
[2010/02/25 12:27:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\cgrogan\My Documents\My Pictures
[2010/02/25 12:27:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\cgrogan\My Documents\My Music
[2010/02/25 12:27:37 | 000,000,000 | --SD | C] -- C:\Documents and Settings\cgrogan\Application Data\Microsoft
[2010/02/25 12:27:37 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\cgrogan\Application Data
[2010/02/25 12:27:37 | 000,000,000 | R--D | C] -- C:\Documents and Settings\cgrogan\Favorites
[2010/02/25 12:27:37 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\cgrogan\Cookies
[2010/02/25 12:27:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\Symantec
[2010/02/25 12:27:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\Microsoft
[2010/02/25 12:27:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Application Data\Intel
[2010/02/25 12:27:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\cgrogan\Desktop
[2010/02/25 12:27:36 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\cgrogan\SendTo
[2010/02/25 12:27:36 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\cgrogan\Recent
[2010/02/25 12:27:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\cgrogan\Start Menu
[2010/02/25 12:27:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\cgrogan\My Documents
[2010/02/25 12:27:36 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\cgrogan\Templates
[2010/02/25 12:27:36 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\cgrogan\PrintHood
[2010/02/25 12:27:36 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\cgrogan\NetHood
[2010/02/25 12:27:36 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\cgrogan\Local Settings
[2009/07/16 13:33:30 | 000,157,696 | ---- | C] (The RaProducts Team: Paul McLain and Fred de Vries) -- C:\Documents and Settings\cgrogan\Application Data\JavaRa.exe
[2008/11/17 12:36:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Intel
[2008/11/17 12:36:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Intel
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/05 10:31:19 | 000,242,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/03/05 10:31:15 | 000,029,512 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/03/05 10:31:15 | 000,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll.prepare
[2010/03/05 10:31:00 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/03/05 10:30:54 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgrkx86.sys
[2010/03/05 10:29:32 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\cgrogan\Desktop\OTL.exe
[2010/03/05 10:27:02 | 000,528,468 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/05 10:27:02 | 000,446,510 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/05 10:27:02 | 000,072,882 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/05 10:26:21 | 056,719,170 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/03/05 10:23:50 | 001,572,864 | -H-- | M] () -- C:\Documents and Settings\cgrogan\NTUSER.DAT
[2010/03/05 10:23:50 | 000,242,589 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
[2010/03/05 10:23:50 | 000,169,472 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/03/05 10:23:48 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/05 10:22:55 | 000,002,652 | ---- | M] () -- C:\WINDOWS\BRMFBIDI.INI
[2010/03/05 10:22:41 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/05 10:22:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/04 18:05:34 | 000,242,589 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat
[2010/03/04 16:52:04 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/04 16:49:33 | 005,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\cgrogan\Application Data\mbam-setup.exe
[2010/03/04 11:10:08 | 000,318,208 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/03/04 11:07:48 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\cgrogan\ntuser.ini
[2010/03/04 10:46:15 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/03/04 10:32:53 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/04 10:05:46 | 000,050,504 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys
[2010/03/04 10:05:45 | 000,024,368 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys
[2010/03/04 10:05:35 | 000,000,050 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/03/03 15:50:50 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\cgrogan\Application Data\HijackThis.exe
[2010/03/03 15:48:14 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/03 15:42:21 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2010/03/02 17:25:50 | 004,299,780 | -H-- | M] () -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\IconCache.db
[2010/03/02 12:10:41 | 000,006,589 | ---- | M] () -- C:\Documents and Settings\cgrogan\pgm.asv
[2010/03/02 06:23:11 | 000,011,030 | -HS- | M] () -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\MYhtd
[2010/03/01 15:27:38 | 027,386,256 | ---- | M] ( ) -- C:\Documents and Settings\cgrogan\Application Data\AdbeRdr930_en_US.exe
[2010/03/01 15:19:19 | 016,372,000 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\cgrogan\Application Data\jre-6u18-windows-x64.exe
[2010/03/01 14:10:57 | 000,079,344 | ---- | M] () -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/03/01 12:29:10 | 000,000,837 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2010/03/01 11:53:15 | 000,004,346 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2010/02/25 13:12:14 | 000,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/02/25 13:12:14 | 000,001,507 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 9.0.lnk
[2010/02/25 13:12:03 | 000,113,461 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010/02/25 13:11:51 | 006,061,540 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2010/02/25 13:11:51 | 000,492,629 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2010/02/25 13:11:51 | 000,142,495 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2010/02/25 12:40:22 | 000,891,192 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\cgrogan\My Documents\avg_avwt_stb_all_9_40.exe
[2010/02/25 12:27:46 | 000,000,782 | ---- | M] () -- C:\Documents and Settings\cgrogan\Desktop\Windows Media Player.lnk
[2010/02/23 16:40:56 | 008,327,264 | ---- | M] (Mozilla) -- C:\Documents and Settings\cgrogan\Desktop\Firefox Setup 3.6.exe
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/04 16:52:04 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/04 10:32:53 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/04 10:20:33 | 000,007,025 | ---- | C] () -- C:\Documents and Settings\cgrogan\Application Data\hijackthis.log
[2010/03/04 10:05:35 | 000,000,050 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/03/03 15:48:14 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/03 15:42:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/03/02 12:10:41 | 000,006,589 | ---- | C] () -- C:\Documents and Settings\cgrogan\pgm.asv
[2010/03/01 14:10:53 | 000,011,030 | -HS- | C] () -- C:\Documents and Settings\cgrogan\Local Settings\Application Data\MYhtd
[2010/03/01 11:53:08 | 000,046,517 | ---- | C] () -- C:\WINDOWS\System32\msorcl32.hlp
[2010/03/01 11:53:08 | 000,001,731 | ---- | C] () -- C:\WINDOWS\System32\msorcl32.cnt
[2010/03/01 11:53:07 | 000,015,922 | ---- | C] () -- C:\WINDOWS\System32\SQLSODBC.HLP
[2010/03/01 11:53:06 | 000,030,376 | ---- | C] () -- C:\WINDOWS\System32\cliconf.hlp
[2010/03/01 11:53:03 | 000,037,062 | ---- | C] () -- C:\WINDOWS\System32\odbcinst.hlp
[2010/03/01 11:53:03 | 000,000,324 | ---- | C] () -- C:\WINDOWS\System32\odbcinst.cnt
[2010/03/01 11:53:02 | 000,170,865 | ---- | C] () -- C:\WINDOWS\System32\Odbcjet.hlp
[2010/03/01 11:53:02 | 000,006,902 | ---- | C] () -- C:\WINDOWS\System32\Odbcjet.cnt
[2010/03/01 11:27:14 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\sasperf.dll
[2010/02/25 13:12:14 | 000,001,507 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 9.0.lnk
[2010/02/25 13:12:03 | 000,113,461 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010/02/25 13:11:51 | 056,719,170 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/02/25 13:11:51 | 006,061,540 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2010/02/25 13:11:51 | 000,492,629 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2010/02/25 13:11:51 | 000,142,495 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2010/02/25 12:27:46 | 000,000,782 | ---- | C] () -- C:\Documents and Settings\cgrogan\Desktop\Windows Media Player.lnk
[2010/02/25 12:27:39 | 000,000,178 | -HS- | C] () -- C:\Documents and Settings\cgrogan\ntuser.ini
[2010/02/25 12:27:36 | 001,572,864 | -H-- | C] () -- C:\Documents and Settings\cgrogan\NTUSER.DAT
[2009/05/22 21:53:16 | 000,245,103 | ---- | C] () -- C:\Documents and Settings\cgrogan\Application Data\JavaRa.def
[2009/03/11 11:05:14 | 000,002,652 | ---- | C] () -- C:\WINDOWS\BRMFBIDI.INI
[2008/11/17 12:31:16 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/11/17 12:31:16 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/11/17 12:31:15 | 001,482,752 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/11/17 12:31:15 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/06/19 16:29:32 | 000,017,987 | ---- | C] () -- C:\Documents and Settings\cgrogan\Application Data\gpl-2.0.txt
[2007/12/19 10:08:35 | 000,036,972 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll
[2007/12/19 09:47:38 | 000,000,184 | ---- | C] () -- C:\WINDOWS\hpbafd.ini
[2007/11/02 09:02:46 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2007/11/02 08:49:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2007/09/28 16:13:27 | 000,000,837 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/09/20 16:18:49 | 000,910,304 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll
[2007/09/20 16:18:49 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4831.dll
[2005/07/26 17:19:22 | 000,051,392 | ---- | C] () -- C:\WINDOWS\System32\drivers\atnt40k.sys
[2003/11/10 13:56:55 | 000,556,544 | ---- | C] () -- C:\WINDOWS\System32\mtaud410.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/02/27 10:41:28 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v50.dll
[2002/02/27 10:41:26 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v50.dll
[2002/02/27 10:41:26 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v50.dll
< End of report >

Extras:
*********************************************************
OTL Extras logfile created on: 3/5/2010 10:30:13 AM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\cgrogan\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 74.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.79 Gb Total Space | 65.70 Gb Free Space | 58.77% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BKB3QH1
Current User Name: cgrogan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG9\avgam.exe" = C:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgdiagex.exe" = C:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{23E5032B-56CA-4C19-A72E-B50161DB82CA}" = Shadow Copy Client
"{2624B680-02BC-4CBC-839C-DA20DF6EF6EC}" = Citrix Presentation Server Client
"{2A71E48E-F467-4257-8FF6-64CC56F49926}" = Password Policy Client 4.5
"{313C70AE-4317-4EA4-AFAC-AB6AC965BDE3}" = Phone List
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{408FDEBD-B996-4D61-A78D-24854E0C8652}" = SAS OnlineDoc 9.2 for Windows
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{52A7C6A6-6B88-47D1-922E-9F8A7E089E6A}" = Intel(R) PROSet/Wireless WiFi Software
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73F1BDB7-11E1-11D5-9DC6-00C04F2FC33B}" = OMCI
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-00D1-0409-0000-0000000FF1CE}" = Microsoft Office Access database engine 2007 (English)
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-0038-0409-0000-0000000FF1CE}" = Time Zone Data Update Tool for Microsoft Office Outlook
"{96A87333-A829-4225-9B1D-8288C591C2A6}" = SAS/GRAPH NV Workshop 2.1
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A873479E-D4C8-490C-955E-3008256D6754}" = SAS Universal Viewer 1.0
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{B62D9C20-01F0-4B5F-A8FD-B6ABBEC0E85F}" = SAS Enterprise Guide 4.2
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DC6E31A2-C594-4BF7-A127-B86B65D96FC5}" = DeployCRXIrelease2
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E7882D9F-9533-41B6-A68C-365C3871E423}" = SAS Stat Studio 3.1
"{EB767FDD-049B-48A6-9DBA-66A6021EFB2B}" = SAS Drivers for ODBC
"{F2AB2488-A0BF-4A9B-98A9-A88CF20FD2FF}" = Meeting Manager for Internet Explorer
"{F9390B82-786C-43CF-A970-D39E23EF0366}" = SAS 9.2
"0cb720d8b1f8db581667978db7c27210" = SAS Intelligence Platform Object Framework 9.2
"2ebaa88b7b64182e4af82897354182ce" = SAS Deployment Tester - Server 1.3
"36ac3ae4fcc511dab0f6f685d746a93a" = SAS/Graph Java Applets for 9.2
"4835c259d88f3adc046d62a97265ec17" = SAS Locale Setup Manager 2.1
"4b42c487363cf560348dfbac44e07a0a" = SAS Scalable Performance Data Server Plug-in 9.2 for SAS Management Console
"6ac75c7530cfebfc1fddd4df53dc3f56" = SAS Power and Sample Size 3.1
"AVG9Uninstall" = AVG 9.0
"c36effd50786536bc7c5e5402f910e57" = SAS Client Connection Profile Configuration 9.2
"ce2680d8fcce11da826c907caf147e85" = SAS XML Mapper 9.2
"Citrix ICA Client" = Citrix ICA Client
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"d512c678901db9d321c85ecf7c30ae2e" = SAS Deployment Tester - Client 1.3
"d8335e36fcc711dabe8198a08e29ad54" = SAS OnlineDoc 9.2 for the Web
"daf6f5b4d3e711daa10efbdcebaa7b67" = SAS Drivers for JDBC 9.2
"e0deb9bff1c91f7dfffd6ad7081cde67" = SAS/GRAPH ODS Graphics Editor 9.2
"e6d1697afcc611dab0f6f685d746a93a" = SAS Management Console 9.2
"f4455823dea0ac0f8dafa9940d5d90ee" = SAS Help Viewer for the Web
"febb569a337f725f5f8607711f665d3b" = SAS Versioned Jar Repository 9.2
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"LiveUpdate" = LiveUpdate 3.1 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"ProInst" = Intel PROSet Wireless
"RealVNC_is1" = VNC 4.0
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/2/2010 3:05:42 PM | Computer Name = BKB3QH1 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 3/3/2010 10:38:14 AM | Computer Name = BKB3QH1 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 3/3/2010 10:38:15 AM | Computer Name = BKB3QH1 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 3/3/2010 3:28:23 PM | Computer Name = BKB3QH1 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 3/3/2010 3:28:24 PM | Computer Name = BKB3QH1 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 3/4/2010 10:59:56 AM | Computer Name = BKB3QH1 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 3/4/2010 12:09:49 PM | Computer Name = BKB3QH1 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 3/4/2010 12:09:50 PM | Computer Name = BKB3QH1 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 3/5/2010 11:22:50 AM | Computer Name = BKB3QH1 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 3/5/2010 11:22:51 AM | Computer Name = BKB3QH1 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

[ System Events ]
Error - 3/4/2010 12:54:58 PM | Computer Name = BKB3QH1 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 60 minutes. NtpClient has no source of accurate
time.

Error - 3/4/2010 1:54:59 PM | Computer Name = BKB3QH1 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 120 minutes. NtpClient has no source of accurate
time.

Error - 3/4/2010 3:55:02 PM | Computer Name = BKB3QH1 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 240 minutes. NtpClient has no source of accurate
time.

Error - 3/4/2010 4:09:52 PM | Computer Name = BKB3QH1 | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain IG due to the following:
%%1311. Make sure that the computer is connected to the network and try again. If
the problem persists, please contact your domain administrator.

Error - 3/5/2010 11:22:51 AM | Computer Name = BKB3QH1 | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain IG due to the following:
%%1311. Make sure that the computer is connected to the network and try again. If
the problem persists, please contact your domain administrator.

Error - 3/5/2010 11:22:55 AM | Computer Name = BKB3QH1 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 3/5/2010 11:22:55 AM | Computer Name = BKB3QH1 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 3/5/2010 11:22:55 AM | Computer Name = BKB3QH1 | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 3/5/2010 11:22:55 AM | Computer Name = BKB3QH1 | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 3/5/2010 11:22:55 AM | Computer Name = BKB3QH1 | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.


< End of report >
************************************************************
During the scan (with everything closed) I got an AVG pop-up requesting reboot to install updates. I hit Esc.

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Hi Belazur - thanks again. Combofix.txt:

ComboFix 10-03-04.06 - cgrogan 03/05/2010 15:22:08.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1417 [GMT -5:00]
Running from: c:\documents and settings\cgrogan\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\EventSystem.log

.
((((((((((((((((((((((((( Files Created from 2010-02-05 to 2010-03-05 )))))))))))))))))))))))))))))))
.

2010-03-05 18:56 . 2010-03-05 18:56 -------- d-----w- c:\windows\LastGood
2010-03-05 18:55 . 2010-03-05 18:55 -------- d-----w- c:\documents and settings\cgrogan\Application Data\AVG9
2010-03-05 15:31 . 2010-03-05 15:31 360584 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-03-05 15:31 . 2010-03-05 15:31 333192 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
2010-03-05 15:31 . 2010-03-05 15:31 28424 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgmfx86.sys
2010-03-05 15:31 . 2010-03-05 15:31 161800 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgrkx86.sys
2010-03-05 15:31 . 2010-03-05 15:31 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-03-05 15:28 . 2010-02-25 18:11 1007896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-03-05 15:28 . 2010-02-25 18:11 800536 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2010-03-05 15:28 . 2010-02-25 18:11 613656 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2010-03-05 15:28 . 2010-02-25 18:11 1658136 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-03-04 21:52 . 2010-01-07 21:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-04 21:52 . 2010-01-07 21:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-04 21:51 . 2010-03-04 21:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-04 21:49 . 2010-03-04 21:49 5115824 ----a-w- c:\documents and settings\cgrogan\Application Data\mbam-setup.exe
2010-03-04 21:48 . 2010-03-04 21:48 -------- d-----w- c:\documents and settings\cgrogan\Application Data\backups
2010-03-04 16:15 . 2010-03-04 16:15 -------- d-sh--w- c:\documents and settings\cgrogan\IECompatCache
2010-03-04 16:13 . 2010-03-04 16:13 -------- d-sh--w- c:\documents and settings\cgrogan\PrivacIE
2010-03-04 16:10 . 2010-03-04 16:10 -------- d-sh--w- c:\documents and settings\cgrogan\IETldCache
2010-03-04 15:45 . 2010-03-05 18:57 -------- d-----w- c:\windows\ie8updates
2010-03-04 15:41 . 2010-03-04 15:44 -------- dc-h--w- c:\windows\ie8
2010-03-04 15:39 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-03-04 15:39 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-04 15:39 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-04 15:05 . 2010-03-04 15:05 50504 ----a-w- c:\windows\system32\drivers\pxrts.sys
2010-03-04 15:05 . 2010-03-04 15:05 24368 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2010-03-03 20:50 . 2010-03-03 20:50 401720 ----a-w- c:\documents and settings\cgrogan\Application Data\HijackThis.exe
2010-03-03 20:42 . 2010-03-03 20:42 0 ----a-w- c:\windows\nsreg.dat
2010-03-03 20:42 . 2010-03-03 20:42 -------- d-----w- c:\documents and settings\cgrogan\Local Settings\Application Data\Mozilla
2010-03-02 10:24 . 2010-03-02 10:24 -------- d-----w- c:\documents and settings\cgrogan\Application Data\Malwarebytes
2010-03-01 20:27 . 2010-03-01 20:27 27386256 ----a-w- c:\documents and settings\cgrogan\Application Data\AdbeRdr930_en_US.exe
2010-03-01 20:19 . 2010-03-01 20:19 16372000 ----a-w- c:\documents and settings\cgrogan\Application Data\jre-6u18-windows-x64.exe
2010-03-01 19:50 . 2010-03-01 19:50 -------- d-----w- c:\documents and settings\_dm1n1$tr_t0r\Application Data\Malwarebytes
2010-03-01 19:50 . 2010-03-01 19:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-01 18:21 . 2010-03-01 18:21 -------- d-----w- c:\documents and settings\cgrogan\Application Data\SAS
2010-03-01 17:08 . 2010-03-01 17:37 -------- d-----w- c:\documents and settings\_dm1n1$tr_t0r\Application Data\ICAClient
2010-03-01 16:54 . 2010-03-01 16:54 -------- d-----w- c:\windows\Sun
2010-03-01 16:34 . 2010-03-01 16:58 -------- d-----w- c:\documents and settings\_dm1n1$tr_t0r\Application Data\SAS
2010-03-01 16:27 . 2009-02-10 22:04 77824 ----a-w- c:\windows\system32\sasperf.dll
2010-03-01 16:22 . 2010-03-01 16:22 -------- d-----w- c:\documents and settings\_dm1n1$tr_t0r\Local Settings\Application Data\Sun
2010-03-01 16:22 . 2010-03-04 15:52 -------- d-----w- c:\program files\MSECache
2010-03-01 16:22 . 2010-03-01 16:22 -------- d-----w- c:\program files\Microsoft WSE
2010-03-01 16:21 . 2002-01-05 12:48 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-03-01 16:21 . 2002-01-05 12:36 964608 ----a-w- c:\windows\system32\mfc70u.dll
2010-03-01 16:21 . 2002-01-05 11:38 54784 ----a-w- c:\windows\system32\msvci70.dll
2010-03-01 16:21 . 2002-01-05 10:18 84992 ----a-w- c:\windows\system32\atl70.dll
2010-03-01 16:21 . 2001-09-06 01:00 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2010-03-01 16:21 . 2010-03-01 17:01 -------- d-----w- c:\program files\SAS
2010-03-01 16:20 . 2010-03-01 16:51 -------- d-----w- c:\temp\SAS Graph JAVA Applets
2010-03-01 16:09 . 2010-03-01 16:21 -------- d-----w- c:\documents and settings\_dm1n1$tr_t0r\Local Settings\Application Data\SAS
2010-02-26 15:44 . 2010-02-25 18:11 3777280 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-02-26 15:44 . 2010-02-25 18:11 1260800 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-02-26 13:04 . 2010-03-01 19:10 79344 ----a-w- c:\documents and settings\cgrogan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-25 20:28 . 2010-03-01 17:39 -------- d-----w- C:\SAS Software Depot
2010-02-25 20:26 . 2010-03-01 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\SAS
2010-02-25 20:25 . 2010-02-25 20:25 -------- d-----w- c:\documents and settings\cgrogan\Local Settings\Application Data\SAS
2010-02-25 19:22 . 2010-02-24 15:15 43775976 ----a-w- c:\temp\NHCAA Conf Material 11.20.09.zip
2010-02-25 19:14 . 2010-03-02 20:00 -------- d-----w- c:\temp\SNF
2010-02-25 19:14 . 2010-03-01 11:23 -------- d-----w- c:\temp\SCAM Phase 3
2010-02-25 19:14 . 2010-02-25 19:14 -------- d-----w- c:\temp\SAS Graph Examples
2010-02-25 19:14 . 2010-02-25 19:14 -------- d-----w- c:\temp\RAC
2010-02-25 19:08 . 2010-03-05 20:13 -------- d-----w- c:\temp\Miscellaneous
2010-02-25 19:08 . 2010-02-25 19:08 -------- d-----w- c:\temp\Medical Review
2010-02-25 18:59 . 2010-03-04 17:54 -------- d-----w- c:\temp\HHA
2010-02-25 18:59 . 2010-02-25 18:59 -------- d-----w- c:\temp\Before During After
2010-02-25 18:36 . 2010-02-25 22:32 -------- d-----w- c:\documents and settings\cgrogan\Application Data\ICAClient
2010-02-25 18:20 . 2009-11-25 18:02 1230080 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2010-02-25 18:12 . 2010-02-25 18:12 -------- d-----w- C:\$AVG
2010-02-25 18:12 . 2010-03-05 15:31 242696 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-02-25 18:12 . 2010-03-05 15:30 52872 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-02-25 18:12 . 2010-03-05 15:31 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-02-25 18:12 . 2010-03-05 15:31 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-02-25 18:11 . 2010-03-05 20:06 -------- d-----w- c:\windows\system32\drivers\Avg
2010-02-25 18:11 . 2010-03-04 16:13 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-02-25 18:11 . 2010-02-25 18:11 -------- d-----w- c:\program files\AVG
2010-02-25 18:11 . 2010-02-25 18:11 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-02-25 17:36 . 2010-03-04 15:34 -------- d-----w- c:\documents and settings\cgrogan\Local Settings\Application Data\Adobe
2010-02-25 17:24 . 2010-02-25 17:24 -------- d-----w- c:\documents and settings\_dm1n1$tr_t0r\Application Data\TeamViewer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 23:05 . 2008-11-17 17:31 242589 ----a-w- c:\windows\system32\nvModes.dat
2010-03-04 16:12 . 2007-11-02 13:50 -------- d-----w- c:\program files\Java
2010-03-04 15:32 . 2007-10-09 15:03 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-01 17:00 . 2007-11-01 16:15 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-25 17:44 . 2008-11-17 20:27 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-02-25 17:44 . 2008-11-17 20:28 -------- d-----w- c:\program files\Symantec
2010-02-25 17:43 . 2007-11-01 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-12-31 16:50 . 2006-02-28 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2007-09-20 20:20 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2006-02-28 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 05:53 . 2010-03-05 15:24 726528 ------w- c:\windows\system32\SET8.tmp
2009-12-08 19:26 . 2006-02-28 12:00 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2004-08-03 22:59 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 18:02 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-22 13508608]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2008-08-20 1191936]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_12\bin\jusched.exe" [2007-05-02 75520]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-05 15:31 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ppeclt]
2006-02-13 09:50 192512 ----a-w- c:\windows\system32\PPEClt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-515967899-436374069-854245398-4851\Scripts\Logon\0\0]
"Script"=AdvMedLogin.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-515967899-436374069-854245398-4880\Scripts\Logon\0\0]
"Script"=Desktop.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-515967899-436374069-854245398-4880\Scripts\Logon\0\1]
"Script"=HomePage.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-515967899-436374069-854245398-4880\Scripts\Logon\0\2]
"Script"=MTAUDIT.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-515967899-436374069-854245398-4880\Scripts\Logon\0\3]
"Script"=WindowsTour.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-515967899-436374069-854245398-4880\Scripts\Logon\1\0]
"Script"=Omaha_Login_Script.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-515967899-436374069-854245398-4959\Scripts\Logon\0\0]
"Script"=AdvMedLogin.bat

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Phone List.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Phone List.lnk
backup=c:\windows\pss\Phone List.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-12-10 01:29 49152 ------w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-05-16 21:50 162584 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-05-16 21:50 138008 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2008-08-20 22:09 1191936 ----a-w- c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2008-08-20 22:27 1368064 ----a-w- c:\program files\Intel\WiFi\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
2008-02-22 11:46 86016 ----a-w- c:\windows\system32\nvhotkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-02-22 11:46 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-02-22 11:46 1626112 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-05-16 21:50 138008 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2007-02-19 19:26 303104 ----a-w- c:\windows\stsystra.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2/25/2010 1:12 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/25/2010 1:12 PM 216200]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/25/2010 1:12 PM 242696]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/5/2010 10:31 AM 308064]
R3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\BrFilt.sys [3/11/2009 11:05 AM 2944]
R3 BrSerWDM;Brother Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [3/11/2009 11:05 AM 60416]
R3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\system32\drivers\BrUsbMdm.sys [3/11/2009 11:05 AM 11008]
R3 BrUsbScn;Brother MFC USB Scanner driver;c:\windows\system32\drivers\BrUsbScn.sys [3/11/2009 11:05 AM 10368]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {983D8326-C602-11D5-9EAB-00055DF0DDE4} - file://oma-fs1/apps/MBD%20install/MBD_Websphere%20Version%205/sp2tc.cab
FF - ProfilePath - c:\documents and settings\cgrogan\Application Data\Mozilla\Firefox\Profiles\1bwmsk1j.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Broadcom Wireless Manager UI - c:\windows\system32\WLTRAY.exe
Notify-NavLogon - (no file)
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\j2re1.4.2_12\bin\jusched.exe
MSConfigStartUp-vptray - c:\progra~1\SYMANT~1\VPTray.exe
AddRemove-Citrix ICA Client - c:\progra~1\Citrix\ICACLI~1\Uninst.isu



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(888)
c:\windows\system32\IWPDGINA.DLL
c:\program files\Intel\WiFi\bin\LangResources\ENU\SsoGnENU.dll
c:\windows\system32\ULAgent.dll
.
Completion time: 2010-03-05 15:26:56
ComboFix-quarantined-files.txt 2010-03-05 20:26

Pre-Run: 70,409,576,448 bytes free
Post-Run: 71,329,157,120 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 6751479E2E7E2550FD6E403D2D5659E0

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?

Running great (logged on through my home machine now.) I haven't had any pop-ups in the last 24 hours on the previously infected machine.

Thanks much,
Chris

Hello.
Have you tried to uninstall AVG and it didn't work? I see some AVG drivers, but not the main processes for AVG's guard.

No - I did not uninstall AVG. I temporarily disabled (as directed) before running Combofix. I re-enabled AVG afterward.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?

I ran the Combofix uninstall Saturday (3/6) AM. Machine is running great - no pop-ups over the weekend (including today,) everything running as it should.

Hello.

Run ESET Online Scan
Please do an online scan with ESET Online Scanner. Please use Internet Explorer as it uses ActiveX.

• Check (tick) this box: YES, I accept the Terms of Use.
  
• Click on the Start button next to it.
  
• When prompted to run ActiveX. click Yes.
  
• You will be asked to install an ActiveX. Click Install.
  
• Once installed, the scanner will be initialized.
  
• After the scanner is initialized, click Start.
  
• Check (tick) Remove found threats box.
  
• Check (tick) Scan unwanted applications.
  
• Click on Scan.
  
• It will start scanning. Please be patient.
  
• Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.
  

Just completed the scan and nothing was detected. I also have no log file.

Okay, this should be fine now then.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

Thanks for all your help Belahzur! Have positively reviewed, donated and am working my way through your recommended updates and articles. I don't want to be a repeat customer either - but am glad you're out here