trisport

Hi. My home laptop has some serious issues with a malware trojan.
My wife told me about it yesterday and I've been trying to remove it ever since (without success). She initially got infected with what looked like anti-virus software indicating that it found something malicious. Little did she know.

- Trouble booting, slow, search engines redirect to wrong links.
- Something is blocking Malwarebytes, and Spybot from opening. I finally got Malwarebytes to run after renaming it. I can't get spybot to run.
- I ran AVG 8.5 (in safe mode) and it found Trojan horse Dropper.Agent.NDQ and Win 32/Cryptor. This was found in several processes including svchost.exe (several), iexplore.exe and UAChgwjmoelnvpbptur.dll
- search engines redirect to the wrong links
- Malwarebytes comes up with uacinit.dll, but it always re-appears every time I run it after a reboot - see log.

- I was unable to run the gmer even after renaming it.

DDS Log:
DDS (Ver_09-05-14.01) - NTFSx86
Run by Laura Creagan at 2208.95 on Sat 06/20/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1086 [GMT -4:00]

AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\OEM02Mon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Fisher-Price\Computer Cool School\FPCCSMiddleware.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Garmin\gStart.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Safari\Safari.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Laura Creagan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6071119
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
uDefault_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=6071119
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hp\smart web printing\hpswp_framework.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: ST: {9394ede7-c8b5-483e-8773-474bf36af6e4} - c:\program files\msn apps\st\01.03.0000.1005\en-xu\stmain.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll
BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
uRun: [gStart] c:\garmin\gStart.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [DELL Webcam Manager] "c:\program files\dell\dell webcam manager\DellWMgr.exe" /s
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [KADxMain] c:\windows\system32\KADxMain.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [<NO NAME>]
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LVCOMSX] "c:\program files\common files\logishrd\lcommgr\LVComSX.exe"
mRun: [Omnipage] c:\program files\scansoft\omnipagese\opware32.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [FPCCSMiddleware] c:\program files\fisher-price\computer cool school\FPCCSMiddleware.exe
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\laurac~1\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pictur~2.lnk - c:\program files\sony corporation\picture package\picture package menu\SonyTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pictur~1.lnk - c:\program files\sony corporation\picture package\picture package applications\Residence.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\laurac~1\applic~1\mozilla\firefox\profiles\ppnq4px0.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPOJI610.dll

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-10-21 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-10-21 327688]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-1-17 27784]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-10-21 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-10-21 298776]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [2007-11-18 235520]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [2007-11-18 7424]
RUnknown wywsck;wywsck; [x]
S2 caqklqg;caqklqg;c:\windows\system32\drivers\umya.sys --> c:\windows\system32\drivers\umya.sys [?]

=============== Created Last 30 ================

2009-06-20 20:16 <DIR> --d----- c:\program files\CCleaner
2009-06-20 20:08 <DIR> --d----- c:\docume~1\laurac~1\applic~1\Malwarebytes
2009-06-19 13:29 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-19 13:29 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-06-19 13:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-06-19 13:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-06-11 09:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-06-10 14:43 <DIR> --d----- c:\program files\iPod
2009-05-26 17:18 90,112 a------- c:\windows\system32\QuickTimeVR.qtx
2009-05-26 17:18 57,344 a------- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2009-06-20 07:24 174,346 a------- c:\windows\system32\nvModes.dat
2009-06-11 09:29 327,688 a------- c:\windows\system32\drivers\avgldx86.sys
2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-06-05 11:42 39,424 a------- c:\windows\system32\drivers\usbaapl.sys
2009-05-17 13:57 95,168 a------- c:\docume~1\laurac~1\applic~1\GDIPFONTCACHEV1.DAT
2009-05-07 11:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-07 11:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-05-01 14:30 3,366,912 a------- c:\windows\system32\GPhotos.scr
2009-04-29 00:56 827,392 a------- c:\windows\system32\wininet.dll
2009-04-29 00:56 827,392 -------- c:\windows\system32\dllcache\wininet.dll
2009-04-29 00:56 233,472 -------- c:\windows\system32\dllcache\webcheck.dll
2009-04-29 00:56 44,544 a------- c:\windows\system32\dllcache\pngfilt.dll
2009-04-29 00:56 1,159,680 -------- c:\windows\system32\dllcache\urlmon.dll
2009-04-29 00:56 671,232 -------- c:\windows\system32\dllcache\mstime.dll
2009-04-29 00:56 105,984 -------- c:\windows\system32\dllcache\url.dll
2009-04-29 00:56 102,912 -------- c:\windows\system32\dllcache\occache.dll
2009-04-29 00:56 3,596,288 -------- c:\windows\system32\dllcache\mshtml.dll
2009-04-29 00:56 477,696 -------- c:\windows\system32\dllcache\mshtmled.dll
2009-04-29 00:56 193,024 -------- c:\windows\system32\dllcache\msrating.dll
2009-04-28 05:05 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2009-04-28 05:05 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2009-04-26 09:22 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-04-26 09:22 12,552 a------- c:\windows\system32\drivers\avgrkx86.sys
2009-04-26 09:22 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-04-25 01:27 636,088 -------- c:\windows\system32\dllcache\iexplore.exe
2009-04-25 01:26 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2009-04-18 08:39 72,996 a---h--- c:\windows\system32\mlfcache.dat
2009-04-17 08:26 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-17 08:26 1,847,168 -------- c:\windows\system32\dllcache\win32k.sys
2009-04-15 10:51 585,216 a------- c:\windows\system32\rpcrt4.dll
2009-04-15 10:51 585,216 -------- c:\windows\system32\dllcache\rpcrt4.dll
2007-12-26 19:50 284 a------- c:\docume~1\laurac~1\applic~1\ViewerApp.dat
2007-11-19 00:21 76 ---shr-- c:\windows\CT4CET.bin
2009-02-26 09:48 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009022620090227\index.dat

============= FINISH: 22:07:25.29 ===============

Malwarebytes Log:

Malwarebytes' Anti-Malware 1.38
Database version: 2317
Windows 5.1.2600 Service Pack 3

6/20/2009 8:26:13 PM
mbam-log-2009-06-20 (20-26-13).txt

Scan type: Quick Scan
Objects scanned: 112858
Time elapsed: 3 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system tool (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.

Attached Files

Attach.zip (2.3 KB, 0 views)

trisport

I read on a similar thread regarding uacinit.dll to run RootRepeal and post the report. Here it is:
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Time: 2009/06/20 21:53
Program Version: Version 1.3.0.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: bzany.sys
Image Path: C:\WINDOWS\system32\drivers\bzany.sys
Address: 0xB6DA3000 Size: 61440 File Visible: No Signed: -
Status: -

Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB6C5E000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBA61E000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB253A000 Size: 49152 File Visible: No Signed: -
Status: -

Name: UACldoniiyeypxucttsv.sys
Image Path: C:\WINDOWS\system32\drivers\UACldoniiyeypxucttsv.sys
Address: 0xB6FFA000 Size: 77824 File Visible: - Signed: -
Status: Hidden from Windows API!

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\UACdmylytaxexukuixdx.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACejjvaordqjbppptpe.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UAChgwjmoelnvwpbptvr.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACogddfevithmknxagt.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACoomnnaktxyvtsrhsc.log
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACrkylvjlkxpwjyoqrv.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACtoqdmlvunjbubfrky.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC96c7.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC9c51.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACb17e.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACc4f7.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACeafd.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACf4d1.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACfb59.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\UACldoniiyeypxucttsv.sys
Status: Invisible to the Windows API!

Path: c:\documents and settings\laura creagan\local settings\temp\~romfn_00000d4c
Status: Allocation size mismatch (API: 4096, Raw: 0)

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Gardens of Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Gecko on Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - In front of our lunch Restaurant in Boulbon, France - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Rich painted columns Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Rich painted columns Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France-2.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France-2.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France-3.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France-3.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - Statue at Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 2 - We're going the wrong way again... in Boulbon, France - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Ancient Roman Aquaduct Remains between Fontvielle and Arles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Ancient Roman Aquaduct Remains between Fontvielle and Arles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Ancient Roman Spring Fed Well - Ancient Roman & Greek City of Glanum near St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Approaching Ancient Roman City of Glanum near St. Remy de Provence - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Approaching Ancient Roman City of Glanum near St. Remy de Provence - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Climbing up to Les Baux de Provence - In the Alpilles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Enroute to Les Baux de Provence - Alpilles Mountains - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Laura - Arc de Triomphe from 20 AD - reliefs illustrate Caesars conquest of Gaul - Ancient Roman City of Glanum near St. Remy de Provence, Franc.jpg
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Laura in front of Arc de Triomphe from 20 AD - reliefs illustrate Caesars conquest of Gaul - Ancient Roman City of Glanum near St. Remy de Prove.jpg
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - Catalan Flag, Provence Flag and France Flag - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - Catalan Flag, Provence Flag and France Flag - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - Near 14th Century Tour-du-Brau - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - Tourist Attractions on the street - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Les Baux de Provence - Tourist Attractions on the street - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - More Beautiful Flowers - Alpilles Mountains in back - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Original Plaster still remains on walls - Ancient Roman & Greek City of Glanum near St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Original Plaster still remains on walls - Ancient Roman & Greek City of Glanum near St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Partially reconstructed Temple - Ancient Roman & Greek City of Glanum near St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Partially reconstructed Temple angle 2 - Ancient Roman & Greek City of Glanum near St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Partially reconstructed Temple angle 2 - Ancient Roman & Greek City of Glanum near St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Arc de Triomphe from 20 AD - reliefs illustrate Caesars conquest of Gaul - Ancient Roman City of Glanum near St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Arc de Triomphe from 20 AD - reliefs illustrate Caesars conquest of Gaul - Ancient Roman City of Glanum near St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - More Spectacular Countryside - In the Alpilles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Tour of Olive Mill - Modern Olive Press - Moulin a Huile du Mas Saint Jean - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Tour of Olive Mill - Modern Olive Press - Moulin a Huile du Mas Saint Jean - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Tour of Olive Mill - Laura in front of Moulin a Huile du Mas Saint Jean - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Tour of Olive Mill - Laura in front of Moulin a Huile du Mas Saint Jean - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Tour of Olive Mill - Sean in front of Moulin a Huile du Mas Saint Jean - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 3 - Tour of Olive Mill - Sean in front of Moulin a Huile du Mas Saint Jean - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 4 - Paintings inside - Saint Trophime Cathedral - 12 and 15th Century Church - Place de la Republic Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 4 - Saint Trophime Cathedral - 12 and 15th Century Church - Romanesque Facade - Place de la Republic Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 4 - Tapestries - Saint Trophime Cathedral - 12 and 15th Century Church - Place de la Republic Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 6 - 1 of 70 Antique Watermills used to press grain and oil on Sorgue River - Isle Sur La Sorgue, in Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 6 - 1 of 70 Antique Watermills used to press grain and oil on Sorgue River - Isle Sur La Sorgue, in Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 4 - 3 Euro for a Coca-Cola with a view in St. Remy de Provence - Biking 55 KM back to Avignon from Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 4 - Laura finally found a petite chat in St. Remy de Provence - Biking 55 KM back to Avignon from Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\France Spain Trip 2004\Day 4 - Stained Glass - Saint Trophime Cathedral - 12 and 15th Century Church - Place de la Republic Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Sean at Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Former mint 1619 - bears arms of Cardinal Borghese on top - now Conservatoire de Musique-Avignon, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Beautiful Wrought Iron in Boulbon, France - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Behind Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Chateau Barbentane, Barbentane, France - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Gardens of Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Gardens of Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Gecko on Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - In front of our lunch Restaurant in Boulbon, France - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - In front of our lunch Restaurant in Boulbon, France - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Leaving - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Rich painted columns Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Rue Antique de Arles - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Rue Antique de Arles - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Sean - Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France-2.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France-2.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France-3.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France-3.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Small Church 1858 - Abbaye de St. Michel de Frigolet - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - Statue at Italianate Chateau Barbentane 1674 - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - We're going the wrong way again... in Boulbon, France - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 2 - We're going the wrong way again... in Boulbon, France - 60 KM Loop Bike Ride from St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Ancient Roman Aquaduct Remains between Fontvielle and Arles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Ancient Roman Aquaduct Remains between Fontvielle and Arles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Ancient Roman Spring Fed Well - Ancient Roman & Greek City of Glanum near St. Remy de Provence, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Ancient Roman Spring Fed Well - Ancient Roman & Greek City of Glanum near St. Remy de Provence, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Arc de Triomphe from 20 AD - reliefs illustrate Caesars conquest of Gaul - Ancient Roman City of Glanum near St. Remy de Provence, France.jpg
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Climbing up to Les Baux de Provence - In the Alpilles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Climbing up to Les Baux de Provence - In the Alpilles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Locked to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Climbing up to Les Baux de Provence - In the Alpilles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:Q30lsldxJoudresxAaaqpcawXc
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Laura Creagan\My Documents\My Pictures\summer 2008\105NIKON\Spain and France bike trip 2004\Day 3 - Climbing up to Les Baux de Provence - In the Alpilles - 60 KM Ride from St. Remy de Provence to Arles, France.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Invisible to the Windows API!

Path: C:\Stealth Objects
-------------------
Object: Hidden Module [Name: UACejjvaordqjbppptpe.dll]
Process: svchost.exe (PID: 1012) Address: 0x02ab0000 Size: 53248

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: svchost.exe (PID: 1012) Address: 0x02e90000 Size: 45056

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: svchost.exe (PID: 1012) Address: 0x02f30000 Size: 49152

Object: Hidden Module [Name: UACc4f7.tmpvjlkxpwjyoqrv.dll]
Process: svchost.exe (PID: 1012) Address: 0x10000000 Size: 69632

Object: Hidden Module [Name: CFScan.dll]
Process: QBCFMonitorService.exe (PID: 504) Address: 0x00ae0000 Size: 45056

Object: Hidden Module [Name: sprtmessage.dll]
Process: sprtcmd.exe (PID: 3928) Address: 0x031b0000 Size: 77824

Object: Hidden Module [Name: SupportSoft.Agent.Sprocket.SupportMessage.dll]
Process: sprtcmd.exe (PID: 3928) Address: 0x041b0000 Size: 45056

Object: Hidden Module [Name: SupportSoft.Agent.Sprocket.dll]
Process: sprtcmd.exe (PID: 3928) Address: 0x048d0000 Size: 28672

Object: Hidden Handle [Index: 5176, Type: Mutant]
Process: Safari.exe (PID: 4736) Address: 0x879d7d48 Size: -

Object: Hidden Handle [Index: 5180, Type: Mutant]
Process: Safari.exe (PID: 4736) Address: 0x879cb9c0 Size: -

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: vssvc.exe (PID: 3300) Address: 0x00700000 Size: 49152

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: vssvc.exe (PID: 3300) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: dllhost.exe (PID: 5240) Address: 0x00700000 Size: 49152

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: dllhost.exe (PID: 5240) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: dllhost.exe (PID: 4164) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: dllhost.exe (PID: 4164) Address: 0x00700000 Size: 49152

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: msdtc.exe (PID: 5528) Address: 0x007a0000 Size: 49152

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: msdtc.exe (PID: 5528) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: Iexplore.exe (PID: 3896) Address: 0x00b50000 Size: 49152

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: Iexplore.exe (PID: 3896) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: hpswp_clipbook.exe (PID: 3088) Address: 0x00aa0000 Size: 49152

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: hpswp_clipbook.exe (PID: 3088) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: WLLoginProxy.exe (PID: 4712) Address: 0x00960000 Size: 49152

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: WLLoginProxy.exe (PID: 4712) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACogddfevithmknxagt.dll]
Process: RootRepeal.exe (PID: 3116) Address: 0x00ef0000 Size: 49152

Object: Hidden Module [Name: UACtoqdmlvunjbubfrky.dll]
Process: RootRepeal.exe (PID: 3116) Address: 0x10000000 Size: 45056

Hidden Services
-------------------
Service Name: UACd.sys
Image Path: C:\WINDOWS\system32\drivers\UACldoniiyeypxucttsv.sys

==EOF==

trisport

I couldn't wait much longer. I'm worried that my data might have been compromised. I read this may be a backdoor trojan. Is that true?
I see that people with similar problems have been asked to run ComboFix. So I downloaded it, saved as Combo-Fix.exe and followed all the directions for disabling anti-virus and anti-spyware.
It ran successfully and appears to have removed some files.
Before I ran that I was able to run a partial gmer scan (see ark.txt attached).

Here's the ComboFix log: What else do I need to do?? No I need to reformat?

ComboFix 09-06-20.04 - Laura Creagan 06/21/2009 22:36.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1577 [GMT -4:00]
Running from: c:\documents and settings\Laura Creagan\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\UACldoniiyeypxucttsv.sys
c:\windows\system32\UACdmylytaxexukuixdx.dat
c:\windows\system32\UACejjvaordqjbppptpe.dll
c:\windows\system32\UAChgwjmoelnvwpbptvr.dll
c:\windows\system32\UACogddfevithmknxagt.dll
c:\windows\system32\UACoomnnaktxyvtsrhsc.log
c:\windows\system32\UACrkylvjlkxpwjyoqrv.dll
c:\windows\system32\UACtoqdmlvunjbubfrky.dll
c:\windows\system32\UACvsipefyxumuspouqu.log
c:\windows\system32\UACymyetceatawkqcsuc.log
c:\program files\hp\digital imaging\bin\hpqddcmn.dll
c:\windows\system32\AutoRun.inf
c:\windows\system32\drivers\UACldoniiyeypxucttsv.sys
c:\windows\system32\UACdmylytaxexukuixdx.dat
c:\windows\system32\UACejjvaordqjbppptpe.dll
c:\windows\system32\UAChgwjmoelnvwpbptvr.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACogddfevithmknxagt.dll
c:\windows\system32\UACoomnnaktxyvtsrhsc.log
c:\windows\system32\UACrkylvjlkxpwjyoqrv.dll
c:\windows\system32\UACtoqdmlvunjbubfrky.dll
c:\windows\system32\UACvsipefyxumuspouqu.log
c:\windows\system32\UACymyetceatawkqcsuc.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-05-22 to 2009-06-22 )))))))))))))))))))))))))))))))
.

2009-06-21 00:16 . 2009-06-21 00:16 -------- d-----w- c:\program files\CCleaner
2009-06-21 00:08 . 2009-06-21 00:08 -------- d-----w- c:\documents and settings\Laura Creagan\Application Data\Malwarebytes
2009-06-20 23:44 . 2009-06-20 23:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-20 15:39 . 2009-06-20 15:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar
2009-06-20 13:21 . 2009-06-16 13:42 2052888 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-06-20 11:30 . 2009-06-20 11:30 -------- d-----w- c:\documents and settings\Sean Creagan\Application Data\Apple Computer
2009-06-20 11:28 . 2009-06-20 11:28 -------- d-----w- c:\documents and settings\Sean Creagan\Local Settings\Application Data\AVG Security Toolbar
2009-06-19 20:46 . 2009-06-19 20:46 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-06-19 17:29 . 2009-06-17 15:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-19 17:29 . 2009-06-21 00:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-19 17:29 . 2009-06-19 17:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-19 17:29 . 2009-06-17 15:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 13:42 . 2009-06-11 13:29 3298072 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-06-16 13:42 . 2009-06-11 13:29 1261344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll
2009-06-16 13:42 . 2009-06-11 13:29 829208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcfgx.dll
2009-06-11 17:16 . 2009-06-11 17:16 -------- d-----w- c:\documents and settings\Laura Creagan\Local Settings\Application Data\AVG Security Toolbar
2009-06-11 13:30 . 2009-06-11 13:29 826344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\AVGToolbarInstall.exe
2009-06-11 13:29 . 2009-06-11 13:29 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-06-11 13:29 . 2009-06-11 13:29 -------- d-----w- c:\documents and settings\LocalService\Application Data\AVGTOOLBAR
2009-06-11 13:29 . 2009-06-11 13:29 1452312 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-06-10 18:43 . 2009-06-10 18:43 -------- d-----w- c:\program files\iPod
2009-06-10 18:32 . 2009-06-10 18:32 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-22 02:11 . 2008-10-21 12:04 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-06-21 00:45 . 2007-11-30 22:46 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-20 12:16 . 2008-07-15 19:24 -------- d-----w- c:\program files\Bonjour
2009-06-20 11:53 . 2007-11-30 22:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-20 11:24 . 2007-11-19 04:01 174346 ----a-w- c:\windows\system32\nvModes.dat
2009-06-19 21:45 . 2007-11-30 23:05 -------- d-----w- c:\program files\SpywareBlaster
2009-06-19 17:00 . 2007-11-30 23:25 -------- d-----w- c:\program files\SpywareGuard
2009-06-16 13:42 . 2008-01-17 15:49 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-11 13:29 . 2008-10-21 12:04 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-10 18:43 . 2008-02-26 21:43 -------- d-----w- c:\program files\iTunes
2009-06-10 18:43 . 2007-11-29 19:17 -------- d-----w- c:\program files\Common Files\Apple
2009-06-10 18:40 . 2008-02-26 21:41 -------- d-----w- c:\program files\QuickTime
2009-06-10 18:37 . 2007-11-29 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-06-10 18:28 . 2008-04-10 16:43 -------- d-----w- c:\program files\Safari
2009-06-05 15:42 . 2009-04-14 18:08 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-06-05 15:42 . 2007-11-29 19:17 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-08 16:45 . 2008-01-10 18:54 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-05-07 15:32 . 2004-08-11 23:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w- c:\windows\system32\GPhotos.scr
2009-04-29 04:56 . 2004-08-11 23:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-11 23:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-28 17:36 . 2008-10-21 12:04 -------- d-----w- c:\documents and settings\Laura Creagan\Application Data\AVGTOOLBAR
2009-04-26 13:22 . 2008-10-21 12:04 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-04-26 13:22 . 2008-10-21 12:04 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-04-26 13:22 . 2008-10-21 12:04 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-18 12:39 . 2008-10-04 23:38 72996 ---ha-w- c:\windows\system32\mlfcache.dat
2009-04-17 12:26 . 2004-08-11 23:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-11 23:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-13 00:59 . 2009-04-13 00:57 29805040 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2008\Update\US66017101lupd.exe
2009-03-31 13:51 . 2009-03-31 13:51 10134 ----a-r- c:\documents and settings\Laura Creagan\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe
2007-12-05 19:16 . 2007-12-05 19:16 135680 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2007-11-19 04:21 . 2007-11-19 04:21 76 --sh--r- c:\windows\CT4CET.bin
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2009-01-09 20:13 583312 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2009-01-09 20:13 583312 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2009-01-09 20:13 583312 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-28 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 851968]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-06 8429568]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-08-28 36864]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"KADxMain"="c:\windows\system32\KADxMain.exe" [2006-11-02 282624]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-04-16 184320]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-12-05 1838592]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-24 17920]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-01-12 488984]
"LVCOMSX"="c:\program files\Common Files\LogiShrd\LComMgr\LVComSX.exe" [2007-01-12 244512]
"Omnipage"="c:\program files\ScanSoft\OmniPageSE\opware32.exe" [2002-02-21 49152]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-11 1948440]
"FPCCSMiddleware"="c:\program files\Fisher-Price\Computer Cool School\FPCCSMiddleware.exe" [2008-10-10 538432]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2009-01-09 669840]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-06-06 1626112]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2007-06-06 67584]
"NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2007-06-06 81920]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2007-06-06 405504]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-01-23 101136]

c:\documents and settings\Laura Creagan\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-5-17 568176]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-11-19 50688]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-29 67128]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-11-29 688128]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Picture Package Menu.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2007-12-26 151552]
Picture Package VCD Maker.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2007-12-26 106496]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2007-9-11 972064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-26 13:22 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [10/21/2008 8:04 AM 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [10/21/2008 8:04 AM 327688]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [10/21/2008 8:04 AM 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [10/21/2008 8:04 AM 298776]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [11/18/2007 11:54 PM 235520]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [11/18/2007 11:54 PM 7424]
S2 caqklqg;caqklqg;c:\windows\system32\drivers\umya.sys --> c:\windows\system32\drivers\umya.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-06-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]

2009-06-22 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 02:18]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6071119
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-21 22:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(5464)
c:\windows\system32\nview.dll
c:\program files\ScanSoft\OmniPageSE\ophook32.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Carbonite\Carbonite Backup\CarboniteService.exe
c:\windows\system32\Crypserv.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Logitech\khalshared\KHALMNPR.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
.
**************************************************************************
.
Completion time: 2009-06-22 22:53 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-22 02:52

Pre-Run: 20,037,746,688 bytes free
Post-Run: 20,670,513,152 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

299 --- E O F --- 2009-06-20 13:11

Attached Files

ark.txt (8.5 KB, 0 views)

trisport

BUMP, please