Tech Support Forum - View Single Post - Having a problem, possibly malware in winlogon.exe

phrozenwind · 12-02-2006, 10:13 PM

Sorry for the delay, Panda scan took a long time and watched a movie with my girl. Here are the logs you requested:

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Chad Swanson\Application Data
CLASSPATH=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip
COLLECTIONID=COL8143
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=TOMATO
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HMSERVER=https://wwss1proa.cce.hp.com/wuss/servlet/WUSSServlet
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Chad Swanson
ITEMID=dj-22741-15
LANG=1033
LOGONSERVER=\\TOMATO
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
OSVER=winXPH
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Bonjour\;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0905
ProgramFiles=C:\Program Files
PROMPT=$
QTJAVA=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip
SAFEBOOT_OPTION=NETWORK
SESSIONID=1130435536811htx605612eb04e:10769e2f4eb:4eaf
SESSIONNAME=Console
SWUTVER=1.0.1.1
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp
TIMEOUT=0
TMP=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp
TOOLPATH=/C:\Program%20Files\Hewlett-Packard\HP%20Software%20Update\install.htm
UPDATEDIR=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp\rad9E5A3.tmp
USERDOMAIN=TOMATO
USERNAME=Chad Swanson
USERPROFILE=C:\Documents and Settings\Chad Swanson
VERSION=3.0.5.001
windir=C:\WINDOWS
~NT2~
path REG_EXPAND_SZ %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Bonjour\;C:\Program Files\QuickTime\QTSystem\
path REG_EXPAND_SZ %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Bonjour\;C:\Program Files\QuickTime\QTSystem\
ComSpec REG_EXPAND_SZ %SystemRoot%\system32\cmd.exe
~PreRun~
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Chad Swanson\Application Data
CLASSPATH=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip
COLLECTIONID=COL8143
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=TOMATO
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HMSERVER=https://wwss1proa.cce.hp.com/wuss/servlet/WUSSServlet
home=C:\sUBs
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Chad Swanson
ITEMID=dj-22741-15
LANG=1033
LOGONSERVER=\\TOMATO
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
OSVER=winXPH
Path=C:\sUBs\TSF;C:\WINDOWS\system32
path1="C:\Documents and Settings\Chad Swanson\Desktop"
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0905
ProgramFiles=C:\Program Files
PROMPT=$
QTJAVA=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip
SAFEBOOT_OPTION=NETWORK
SESSIONID=1130435536811htx605612eb04e:10769e2f4eb:4eaf
SESSIONNAME=Console
SWUTVER=1.0.1.1
System=C:\WINDOWS\system32
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp
TIMEOUT=0
TMP=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp
TOOLPATH=/C:\Program%20Files\Hewlett-Packard\HP%20Software%20Update\install.htm
UPDATEDIR=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp\rad9E5A3.tmp
USERDOMAIN=TOMATO
USERNAME=Chad Swanson
USERPROFILE=C:\Documents and Settings\Chad Swanson
VERSION=06-12-01W-BetaE
windir=C:\WINDOWS
C:\sUBs\region.reg
C:\sUBs\findcombo.vbs
C:\sUBs\executables
C:\sUBs\whitedir
C:\sUBs\dll_whitelist
C:\sUBs\net_svc.txt
C:\sUBs\def_safeboot
C:\sUBs\winlogondef.reg
C:\sUBs\ComboFix.exe
C:\sUBs\TSF\ERDNT.E_E
C:\sUBs\TSF\handle.exe
C:\sUBs\TSF\hive.cmd
C:\sUBs\TSF\LIST-C.bat
C:\sUBs\TSF\locate.com
C:\sUBs\TSF\Creg.reg
C:\sUBs\TSF\moveex.exe
C:\sUBs\TSF\nircmd.exe
C:\sUBs\TSF\NTP.EXE
C:\sUBs\TSF\Ntrights.exe
C:\sUBs\TSF\RestartIt.exe
C:\sUBs\TSF\swreg.exe
C:\sUBs\TSF\swxcacls.exe
C:\sUBs\TSF\swsc.exe
~Sys~
~DISCLAIM~
~Autoscan~
@set mydoc=C:\Documents and Settings\Chad Swanson\My Documents
@set Startup=C:\Documents and Settings\Chad Swanson\Start Menu\Programs\Startup
@set CommonStartup=C:\Documents and Settings\All Users\Start Menu\Programs\Startup
@set iecache=C:\Documents and Settings\Chad Swanson\Local Settings\Temporary Internet Files\Content.IE5
@set activex=C:\WINDOWS\Downloaded Program Files
@set CommonDesktop=C:\Documents and Settings\All Users\Desktop
@set desktop=C:\Documents and Settings\Chad Swanson\Desktop
@set favorites=C:\Documents and Settings\Chad Swanson\Favorites
@set template=C:\Documents and Settings\Chad Swanson\Templates
@set deftemplate=
@set allusertemplate=C:\Documents and Settings\All Users\Templates
@set alluserappdata=C:\Documents and Settings\All Users\Application Data
~L2mChk~
~SskChk~
~QooChk~
~MiscFix~
~List-C~
Starting /wow section .......18:51:59.85
File/Folder deletions ....... 18:53:13.63
d:\autorun.inf
Access is denied.
End /wow section ....... 18:53:15.16
~HaxChk~
~NTP~
~PreRun~
ALLUSERSPROFILE=C:\Documents and Settings\All Users
CLASSPATH=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip
COLLECTIONID=COL8143
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=TOMATO
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HMSERVER=https://wwss1proa.cce.hp.com/wuss/servlet/WUSSServlet
home=C:\sUBs
ITEMID=dj-22741-15
LANG=1033
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
OSVER=winXPH
Path=C:\sUBs\TSF;C:\WINDOWS\system32
path1="C:\sUBs"
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0905
ProgramFiles=C:\Program Files
PROMPT=$
QTJAVA=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip
SAFEBOOT_OPTION=NETWORK
SESSIONID=1130435536811htx605612eb04e:10769e2f4eb:4eaf
SWUTVER=1.0.1.1
System=C:\WINDOWS\system32
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\WINDOWS\TEMP
TIMEOUT=0
TMP=C:\WINDOWS\TEMP
TOOLPATH=/C:\Program%20Files\Hewlett-Packard\HP%20Software%20Update\install.htm
UPDATEDIR=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp\rad9E5A3.tmp
USERPROFILE=C:\Documents and Settings\LocalService
VERSION=06-12-01W-BetaE
windir=C:\WINDOWS
C:\sUBs\region.reg
C:\sUBs\executables
C:\sUBs\whitedir
C:\sUBs\dll_whitelist
C:\sUBs\def_safeboot
C:\sUBs\net_svc.txt
C:\sUBs\winlogondef.reg
C:\sUBs\ComboFix.exe
C:\sUBs\SafeOk
C:\sUBs\regedit.com
C:\sUBs\ComboFix.txt
C:\sUBs\setpath.bat
C:\sUBs\as-l2m_names
C:\sUBs\as-l2m_notify
C:\sUBs\borlander_file.txt
C:\sUBs\borlander_folder.txt
C:\sUBs\LSPFIX.bat
C:\sUBs\zhSvc.txt
C:\sUBs\d-del2A
C:\sUBs\ComboFix.cmd
C:\sUBs\temp00
C:\sUBs\findcombo.vbs
C:\sUBs\TSF\LIST-C.bat
C:\sUBs\TSF\handle.exe
C:\sUBs\TSF\hive.cmd
C:\sUBs\TSF\ERDNT.E_E
C:\sUBs\TSF\Creg.reg
C:\sUBs\TSF\locate.com
C:\sUBs\TSF\moveex.exe
C:\sUBs\TSF\nircmd.exe
C:\sUBs\TSF\NTP.EXE
C:\sUBs\TSF\Ntrights.exe
C:\sUBs\TSF\RestartIt.exe
C:\sUBs\TSF\swreg.exe
C:\sUBs\TSF\swxcacls.exe
C:\sUBs\TSF\swsc.exe
~Sys~
~PreFix~
~Wowcraft~

Here's the next one:

Incident Status Location

Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@888[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@ad.yieldmanager[1].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@ads.pointroll[2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@adultfriendfinder[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@advertising[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@atwola[1].txt
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@azjmp[1].txt
Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@cassava[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@com[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@doubleclick[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@drivecleaner[1].txt
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@entrepreneur[1].txt
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@errorsafe[1].txt
Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@fe.lea.lycos[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@ig.com[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@mediaplex[1].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@statcounter[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@stats.drivecleaner[2].txt
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@stats1.reliablestats[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@www.drivecleaner[1].txt
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@www.errorsafe[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@ad.yieldmanager[2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@adultfriendfinder[2].txt
Spyware:Cookie/NewMedia Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@anm.co[1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@atwola[2].txt
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@azjmp[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@belnk[1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@burstnet[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@com[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@dist.belnk[2].txt
Spyware:Cookie/Paypopup Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@paypopup[1].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@www.burstbeacon[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@xiti[1].txt
Hacktool:HackTool/IpHide Not disinfected C:\Program Files\Hide IP Platinum\hideippla.exe
Here's the new Hijack This log:

Logfile of HijackThis v1.99.1
Scan saved at 23:02, on 06-12-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.progressiveboink.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshiba.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE /Logon
O4 - HKLM\..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE /Service
O4 - HKLM\..\Run: [TMEEJME.EXE] C:\Program Files\TOSHIBA\TME3\TMEEJME.EXE
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [DpUtil] C:\Program Files\TOSHIBA\DualPointUtility\TEDTray.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [NDSTray.exe] "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 25
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [DriverMagicLogon] "C:\Program Files\SymplisIT\DriverMagic\dmschedule.exe" /boot
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [combofix] C:\sUBs\combofix.cmd
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O8 - Extra context menu item: Copy to Semagic - C:\Program Files\Semagic\copy.htm
O8 - Extra context menu item: Semagic - C:\Program Files\Semagic\link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126118806598
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing)
O23 - Service: Tmesrv3 (Tmesrv) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe" /Service (file missing)

Thanks again!

12-02-2006, 10:13 PM	#7 (permalink)
phrozenwind Registered User Join Date: Dec 2006 Posts: 18 OS: XP	Sorry for the delay, Panda scan took a long time and watched a movie with my girl. Here are the logs you requested: ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Chad Swanson\Application Data CLASSPATH=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip COLLECTIONID=COL8143 CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=TOMATO ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HMSERVER=https://wwss1proa.cce.hp.com/wuss/servlet/WUSSServlet HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Chad Swanson ITEMID=dj-22741-15 LANG=1033 LOGONSERVER=\\TOMATO NUMBER_OF_PROCESSORS=1 OS=Windows_NT OSVER=winXPH Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Bonjour\;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0905 ProgramFiles=C:\Program Files PROMPT=$ QTJAVA=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip SAFEBOOT_OPTION=NETWORK SESSIONID=1130435536811htx605612eb04e:10769e2f4eb:4eaf SESSIONNAME=Console SWUTVER=1.0.1.1 SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp TIMEOUT=0 TMP=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp TOOLPATH=/C:\Program%20Files\Hewlett-Packard\HP%20Software%20Update\install.htm UPDATEDIR=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp\rad9E5A3.tmp USERDOMAIN=TOMATO USERNAME=Chad Swanson USERPROFILE=C:\Documents and Settings\Chad Swanson VERSION=3.0.5.001 windir=C:\WINDOWS ~NT2~ path REG_EXPAND_SZ %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Bonjour\;C:\Program Files\QuickTime\QTSystem\ path REG_EXPAND_SZ %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Bonjour\;C:\Program Files\QuickTime\QTSystem\ ComSpec REG_EXPAND_SZ %SystemRoot%\system32\cmd.exe ~PreRun~ ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Chad Swanson\Application Data CLASSPATH=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip COLLECTIONID=COL8143 CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=TOMATO ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HMSERVER=https://wwss1proa.cce.hp.com/wuss/servlet/WUSSServlet home=C:\sUBs HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Chad Swanson ITEMID=dj-22741-15 LANG=1033 LOGONSERVER=\\TOMATO NUMBER_OF_PROCESSORS=1 OS=Windows_NT OSVER=winXPH Path=C:\sUBs\TSF;C:\WINDOWS\system32 path1="C:\Documents and Settings\Chad Swanson\Desktop" PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0905 ProgramFiles=C:\Program Files PROMPT=$ QTJAVA=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip SAFEBOOT_OPTION=NETWORK SESSIONID=1130435536811htx605612eb04e:10769e2f4eb:4eaf SESSIONNAME=Console SWUTVER=1.0.1.1 System=C:\WINDOWS\system32 SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp TIMEOUT=0 TMP=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp TOOLPATH=/C:\Program%20Files\Hewlett-Packard\HP%20Software%20Update\install.htm UPDATEDIR=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp\rad9E5A3.tmp USERDOMAIN=TOMATO USERNAME=Chad Swanson USERPROFILE=C:\Documents and Settings\Chad Swanson VERSION=06-12-01W-BetaE windir=C:\WINDOWS C:\sUBs\region.reg C:\sUBs\findcombo.vbs C:\sUBs\executables C:\sUBs\whitedir C:\sUBs\dll_whitelist C:\sUBs\net_svc.txt C:\sUBs\def_safeboot C:\sUBs\winlogondef.reg C:\sUBs\ComboFix.exe C:\sUBs\TSF\ERDNT.E_E C:\sUBs\TSF\handle.exe C:\sUBs\TSF\hive.cmd C:\sUBs\TSF\LIST-C.bat C:\sUBs\TSF\locate.com C:\sUBs\TSF\Creg.reg C:\sUBs\TSF\moveex.exe C:\sUBs\TSF\nircmd.exe C:\sUBs\TSF\NTP.EXE C:\sUBs\TSF\Ntrights.exe C:\sUBs\TSF\RestartIt.exe C:\sUBs\TSF\swreg.exe C:\sUBs\TSF\swxcacls.exe C:\sUBs\TSF\swsc.exe ~Sys~ ~DISCLAIM~ ~Autoscan~ @set mydoc=C:\Documents and Settings\Chad Swanson\My Documents @set Startup=C:\Documents and Settings\Chad Swanson\Start Menu\Programs\Startup @set CommonStartup=C:\Documents and Settings\All Users\Start Menu\Programs\Startup @set iecache=C:\Documents and Settings\Chad Swanson\Local Settings\Temporary Internet Files\Content.IE5 @set activex=C:\WINDOWS\Downloaded Program Files @set CommonDesktop=C:\Documents and Settings\All Users\Desktop @set desktop=C:\Documents and Settings\Chad Swanson\Desktop @set favorites=C:\Documents and Settings\Chad Swanson\Favorites @set template=C:\Documents and Settings\Chad Swanson\Templates @set deftemplate= @set allusertemplate=C:\Documents and Settings\All Users\Templates @set alluserappdata=C:\Documents and Settings\All Users\Application Data ~L2mChk~ ~SskChk~ ~QooChk~ ~MiscFix~ ~List-C~ Starting /wow section .......18:51:59.85 File/Folder deletions ....... 18:53:13.63 d:\autorun.inf Access is denied. End /wow section ....... 18:53:15.16 ~HaxChk~ ~NTP~ ~PreRun~ ALLUSERSPROFILE=C:\Documents and Settings\All Users CLASSPATH=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip COLLECTIONID=COL8143 CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=TOMATO ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HMSERVER=https://wwss1proa.cce.hp.com/wuss/servlet/WUSSServlet home=C:\sUBs ITEMID=dj-22741-15 LANG=1033 NUMBER_OF_PROCESSORS=1 OS=Windows_NT OSVER=winXPH Path=C:\sUBs\TSF;C:\WINDOWS\system32 path1="C:\sUBs" PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0905 ProgramFiles=C:\Program Files PROMPT=$ QTJAVA=C:\Program Files\Java\jre1.5.0_04\lib\ext\QTJava.zip SAFEBOOT_OPTION=NETWORK SESSIONID=1130435536811htx605612eb04e:10769e2f4eb:4eaf SWUTVER=1.0.1.1 System=C:\WINDOWS\system32 SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\WINDOWS\TEMP TIMEOUT=0 TMP=C:\WINDOWS\TEMP TOOLPATH=/C:\Program%20Files\Hewlett-Packard\HP%20Software%20Update\install.htm UPDATEDIR=C:\DOCUME~1\CHADSW~1\LOCALS~1\Temp\rad9E5A3.tmp USERPROFILE=C:\Documents and Settings\LocalService VERSION=06-12-01W-BetaE windir=C:\WINDOWS C:\sUBs\region.reg C:\sUBs\executables C:\sUBs\whitedir C:\sUBs\dll_whitelist C:\sUBs\def_safeboot C:\sUBs\net_svc.txt C:\sUBs\winlogondef.reg C:\sUBs\ComboFix.exe C:\sUBs\SafeOk C:\sUBs\regedit.com C:\sUBs\ComboFix.txt C:\sUBs\setpath.bat C:\sUBs\as-l2m_names C:\sUBs\as-l2m_notify C:\sUBs\borlander_file.txt C:\sUBs\borlander_folder.txt C:\sUBs\LSPFIX.bat C:\sUBs\zhSvc.txt C:\sUBs\d-del2A C:\sUBs\ComboFix.cmd C:\sUBs\temp00 C:\sUBs\findcombo.vbs C:\sUBs\TSF\LIST-C.bat C:\sUBs\TSF\handle.exe C:\sUBs\TSF\hive.cmd C:\sUBs\TSF\ERDNT.E_E C:\sUBs\TSF\Creg.reg C:\sUBs\TSF\locate.com C:\sUBs\TSF\moveex.exe C:\sUBs\TSF\nircmd.exe C:\sUBs\TSF\NTP.EXE C:\sUBs\TSF\Ntrights.exe C:\sUBs\TSF\RestartIt.exe C:\sUBs\TSF\swreg.exe C:\sUBs\TSF\swxcacls.exe C:\sUBs\TSF\swsc.exe ~Sys~ ~PreFix~ ~Wowcraft~ Here's the next one: Incident Status Location Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@888[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@ad.yieldmanager[1].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@ads.pointroll[2].txt Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@adultfriendfinder[2].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@advertising[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@atwola[1].txt Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@azjmp[1].txt Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@cassava[1].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@com[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@doubleclick[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@drivecleaner[1].txt Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@entrepreneur[1].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@errorsafe[1].txt Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@fe.lea.lycos[1].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@ig.com[1].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@mediaplex[1].txt Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@statcounter[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@stats.drivecleaner[2].txt Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@stats1.reliablestats[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@www.drivecleaner[1].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Chad Swanson\Cookies\chad swanson@www.errorsafe[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@ad.yieldmanager[2].txt Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@adultfriendfinder[2].txt Spyware:Cookie/NewMedia Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@anm.co[1].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@atwola[2].txt Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@azjmp[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@belnk[1].txt Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@burstnet[2].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@com[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@dist.belnk[2].txt Spyware:Cookie/Paypopup Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@paypopup[1].txt Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@www.burstbeacon[1].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Chad Swanson\Local Settings\Temp\Cookies\chad swanson@xiti[1].txt Hacktool:HackTool/IpHide Not disinfected C:\Program Files\Hide IP Platinum\hideippla.exe Here's the new Hijack This log: Logfile of HijackThis v1.99.1 Scan saved at 23:02, on 06-12-02 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.progressiveboink.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshiba.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local., O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe O4 - HKLM\..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE /Logon O4 - HKLM\..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE /Service O4 - HKLM\..\Run: [TMEEJME.EXE] C:\Program Files\TOSHIBA\TME3\TMEEJME.EXE O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client O4 - HKLM\..\Run: [DpUtil] C:\Program Files\TOSHIBA\DualPointUtility\TEDTray.exe O4 - HKLM\..\Run: [TFNF5] TFNF5.exe O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" O4 - HKLM\..\Run: [NDSTray.exe] "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe" O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 25 O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [DriverMagicLogon] "C:\Program Files\SymplisIT\DriverMagic\dmschedule.exe" /boot O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [combofix] C:\sUBs\combofix.cmd O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe O8 - Extra context menu item: Copy to Semagic - C:\Program Files\Semagic\copy.htm O8 - Extra context menu item: Semagic - C:\Program Files\Semagic\link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126118806598 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing) O23 - Service: Tmesrv3 (Tmesrv) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe" /Service (file missing) Thanks again!