Thanks Dan, I appreciate all the help I can get. Here is my Combofix and Hijackthis logs
ComboFix 08-03-05.1 - Owner 2008-03-05 19:35:45.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.349 [GMT -6:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility
C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility.log
c:\Program Files\Cox\Applications\App\start .exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\PoivY.com\PoivY\PoivY .exe
C:\Program Files\PoivY.com\PoivY\PoivY.exe
C:\Program Files\Router
C:\Program Files\Spruce
C:\Program Files\Spruce\Spruce.dll.intermediate.manifest
C:\Program Files\Spruce\Spruce.original
C:\Program Files\Spruce\SpruceRg.dll
C:\Program Files\Spruce\un_SpruceSetup_17737.exe
C:\Program Files\Spruce\un_SpruceSetup_17737.txt
C:\Program Files\Temporary
C:\Program Files\Temporary\kernInst.exe
C:\Program Files\ThreatFire\TFTray .exe
C:\Program Files\ThreatFire\TFTray .exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\web buying
C:\Program Files\web buying\v1.8.6\wbuninst.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\ymante~1
C:\Program Files\ymante~1\?ymantec\
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\cookies.ini
C:\WINDOWS\IA
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\awyhnvww.ini
C:\WINDOWS\system32\ecvwjpdm.ini
C:\WINDOWS\system32\hrxqfydr.ini
C:\WINDOWS\system32\jjjlm.ini
C:\WINDOWS\system32\jjjlm.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mljjj.dll
C:\WINDOWS\system32\mljjj.exe
C:\WINDOWS\system32\nyhtsyqu.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\sngqpbak.ini
C:\WINDOWS\system32\vdrfygri.ini
C:\WINDOWS\system32\windows
C:\WINDOWS\system32\wlqqrdlv.ini
C:\WINDOWS\system32\wnsapiicomsv.exe
C:\WINDOWS\system32\yvwpigkw.ini
C:\WINDOWS\uninst2.htm
C:\WINDOWS\unist1.htm
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_CMDSERVICE
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\DomainService
-------\Network Monitor
((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 )))))))))))))))))))))))))))))))
.
2008-03-05 19:23 . 2008-03-05 19:23 340,480 --a------ C:\WINDOWS\system32\RCX145.tmp
2008-03-05 17:41 . 2008-03-05 17:41 340,480 --a------ C:\WINDOWS\system32\RCX142.tmp
2008-03-05 13:26 . 2008-03-05 13:26 340,480 --a------ C:\WINDOWS\system32\RCX140.tmp
2008-03-05 00:54 . 2008-03-05 00:54 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 00:39 . 2008-03-05 00:39 340,480 --a------ C:\WINDOWS\system32\RCX13D.tmp
2008-03-04 22:53 . 2008-03-04 23:25 1,302,976 ---hs---- C:\WINDOWS\system32\xeoepbco.ini
2008-03-04 20:18 . 2008-03-04 20:18 340,480 --a------ C:\WINDOWS\system32\RCX13A.tmp
2008-03-04 17:47 . 2008-03-04 17:47 340,480 --a------ C:\WINDOWS\system32\RCX136.tmp
2008-03-03 20:33 . 2008-03-04 18:27 1,302,889 ---hs---- C:\WINDOWS\system32\vqlpigky.ini
2008-03-03 17:22 . 2008-03-03 17:22 1,302,442 ---hs---- C:\WINDOWS\system32\fdilkbpw.ini
2008-03-02 22:49 . 2008-03-02 22:49 340,480 --a------ C:\WINDOWS\system32\RCX121.tmp
2008-02-29 21:34 . 2008-02-29 21:34 340,480 --a------ C:\WINDOWS\system32\RCX114.tmp
2008-02-29 17:24 . 2008-02-29 17:24 340,480 --a------ C:\WINDOWS\system32\RCXFF.tmp
2008-02-27 13:14 . 2008-02-27 13:14 340,480 --a------ C:\WINDOWS\system32\RCXE5.tmp
2008-02-27 07:47 . 2008-02-27 07:47 340,480 --a------ C:\WINDOWS\system32\RCXD3.tmp
2008-02-26 21:19 . 2008-02-26 21:19 340,480 --a------ C:\WINDOWS\system32\RCXD1.tmp
2008-02-26 17:50 . 2008-02-26 17:50 340,480 --a------ C:\WINDOWS\system32\RCXCF.tmp
2008-02-22 12:38 . 2008-02-28 18:09 143 --a------ C:\WINDOWS\BMffb48e05.xml
2008-02-16 10:46 . 2008-02-16 10:46 340,480 --a------ C:\WINDOWS\system32\RCX66.tmp
2008-02-14 21:47 . 2008-02-14 21:47 340,480 --a------ C:\WINDOWS\system32\RCX44.tmp
2008-02-12 22:43 . 2006-08-21 03:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-02-12 22:43 . 2006-08-21 03:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-02-12 22:43 . 2006-08-21 06:21 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-02-12 22:42 . 2008-02-12 22:52 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-02-12 20:35 . 2008-02-12 20:35 340,480 --a------ C:\WINDOWS\system32\RCX19.tmp
2008-02-11 22:28 . 2007-02-28 03:10 2,180,352 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-02-11 22:28 . 2007-02-28 03:08 2,136,064 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-02-11 22:28 . 2007-02-28 02:38 2,057,600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-02-11 22:28 . 2007-02-28 02:38 2,015,744 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-02-11 22:27 . 2007-07-09 07:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-02-11 08:07 . 2007-10-25 21:36 8,454,656 -----c--- C:\WINDOWS\system32\dllcache\shell32.dll
2008-02-10 21:18 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-02-10 21:18 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-06 01:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-06 01:42 --------- d-----w C:\Program Files\ThreatFire
2008-03-03 02:20 --------- d-----w C:\Program Files\SealedMedia
2008-03-01 16:39 28,256 ----a-w C:\WINDOWS\system32\drivers\MxlW2k.sys
2008-02-15 17:21 41,280 ----a-w C:\WINDOWS\system32\drivers\TfSysMon.sys
2008-02-15 17:21 33,088 ----a-w C:\WINDOWS\system32\drivers\TfNetMon.sys
2008-02-15 17:21 12,608 ----a-w C:\WINDOWS\system32\drivers\TfKbMon.sys
2008-02-15 17:20 51,520 ----a-w C:\WINDOWS\system32\drivers\TfFsMon.sys
2008-02-14 05:33 --------- d-----w C:\Program Files\Common Files\RuleSpace
2008-02-14 05:32 --------- d-----w C:\Program Files\Common Files\Aluria
2008-02-14 05:24 --------- d-----w C:\Program Files\Common Files\Authentium Shared
2008-02-14 05:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-14 05:20 --------- d-----w C:\Program Files\McAfee
2008-02-14 05:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-08 06:14 --------- d-----w C:\Program Files\Google
2008-01-26 19:46 --------- d-----w C:\Documents and Settings\Owner\Application Data\SealedMedia
2008-01-26 03:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\PoivY
2008-01-26 03:42 --------- d-----w C:\Program Files\PoivY.com
2008-01-22 06:53 --------- d-----w C:\Program Files\a-squared Free
2008-01-18 03:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\Lavasoft
2008-01-18 03:54 --------- d-----w C:\Program Files\Lavasoft
2008-01-18 03:49 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-17 05:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Tools
2008-01-16 00:50 36,864 ----a-w C:\WINDOWS\mrofinu572.exe.tmp
2008-01-15 23:36 --------- d-----w C:\Program Files\MSN Messenger
2008-01-15 03:25 --------- d-----w C:\Program Files\Microsoft Picture It! 7
2008-01-12 20:28 --------- d-----w C:\Program Files\Quicken
2008-01-12 20:26 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-01-12 20:09 --------- d-----w C:\Program Files\Dot1XCfg
2008-01-11 04:11 10 ----a-w C:\Program Files\.autoreg
2008-01-10 05:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-10 05:02 --------- d-----w C:\Program Files\Symantec
2008-01-10 05:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-10 03:41 41,723 --sh--w C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
2008-01-09 05:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-09 02:15 3,720 --sha-r C:\WINDOWS\system32\drivers\HP_P8657E-ABA S6010V NA410_YC_Pres_QMXP411_E41NAheRED4_4_IGamila Giovani Neon series_SMICRO-STAR INTERNATIONAL CO., LTD_V030_B3.06_T031231_WXH1_L409_M632_J80_7Intel_8Celeron_92.5_1_N10EC8139_P_Z11C1044C_K_A808624C5_U808624C2.MRK
2008-01-06 04:35 --------- d-----w C:\Program Files\Enigma Software Group
2007-11-19 21:53 145,920 --sh--w C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
2007-07-07 02:10 456,192 --sh--r C:\WINDOWS\cnetmgr.exe
.
- Code: Select all
<pre>
----a-w 27,136 2007-12-30 00:56:21 C:\hp\bin\cloaker .exe
----a-w 61,440 2008-01-12 18:56:59 C:\hp\KBD\KBD .EXE
----a-w 151,597 2008-01-12 18:57:01 C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w 45,056 2008-01-12 18:56:59 C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
----a-w 70,816 2008-01-10 04:57:08 C:\Program Files\Common Files\Symantec Shared\ccApp .exe
----a-w 124,096 2008-01-10 04:57:10 C:\Program Files\Common Files\Symantec Shared\CfgWiz .exe
----a-w 61,440 2008-01-12 18:57:28 C:\Program Files\Dot1XCfg\Dot1XCfg .exe
----a-w 171,448 2008-03-06 01:23:25 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier .exe
----a-w 90,112 2008-01-12 18:56:57 C:\Program Files\HP\Digital Imaging\Unload\hpqcmon .exe
----a-w 2,185,800 2008-01-15 23:25:29 C:\Program Files\MSN Messenger\msnmsgr .exe
----a-w 212,992 2008-01-15 23:25:21 C:\WINDOWS\SMINST\RECGUARD .EXE
----a-w 52,736 2008-01-15 23:25:18 C:\WINDOWS\system\hpsysdrv .exe
----a-w 118,784 2008-01-21 03:11:35 C:\WINDOWS\system32\hkcmd .exe
----a-w 483,328 2008-01-15 23:25:21 C:\WINDOWS\system32\hphmon05 .exe
----a-w 155,648 2008-01-21 03:11:38 C:\WINDOWS\system32\igfxtray .exe
----a-w 81,920 2008-01-15 23:25:21 C:\WINDOWS\system32\ps2 .exe
----a-w 196,608 2008-01-15 23:25:23 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04 .exe
</pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{782899c9-b32e-41c1-8a3c-44878a6e9386}]
C:\WINDOWS\system32\ywhyregb.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"Dot1XCfg"="C:\Program Files\Dot1XCfg\Dot1XCfg.exe" [ ]
"Router"="C:\Program Files\Router\Router.exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
"PoivY"="C:\Program Files\PoivY.com\PoivY\PoivY .exe" [ ]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [ ]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [ ]
"KBD"="C:\HP\KBD\KBD.EXE" [ ]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [ ]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [ ]
"VTTimer"="VTTimer.exe" []
"LTMSG"="LTMSG.exe" [2003-07-14 18:52 40960 C:\WINDOWS\ltmsg.exe]
"PS2"="C:\WINDOWS\system32\ps2.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [ ]
"ThreatFire"="C:\Program Files\ThreatFire\TFTray .exe" [ ]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"fc87bd99"="C:\WINDOWS\system32\wrioablv.dll" [ ]
"ESP"="c:\Program Files\Cox\Applications\app\start.exe" [ ]
"sealmon"="C:\Program Files\SealedMedia\sealmon.exe" [ ]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"BMffb48e05"="C:\WINDOWS\system32\iptskiuk.dll" [ ]
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 07:35:01 557056]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R0 GRFILTER;Authentium NDIS Driver;C:\WINDOWS\system32\drivers\GRFILTER.sys [2007-05-09 13:41]
R0 TfFsMon;TfFsMon;C:\WINDOWS\system32\drivers\TfFsMon.sys [2008-02-15 11:20]
R0 TfSysMon;TfSysMon;C:\WINDOWS\system32\drivers\TfSysMon.sys [2008-02-15 11:21]
R2 GRTdiMon;Authentium TDI Mon;C:\WINDOWS\system32\Drivers\GRTdiMon.sys [2007-05-09 13:41]
R2 ThreatFire;ThreatFire;C:\Program Files\ThreatFire\TFService.exe service []
R3 TfNetMon;TfNetMon;C:\WINDOWS\System32\drivers\TfNetMon.sys [2008-02-15 11:21]
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 03:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 03:15]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-19 04:36:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2003-10-14 13:32:36 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-03-05 19:46:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\Program Files\Cox\Applications\App\syssvcnt.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Quicken\bagent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08\hpqtra08.exe
.
**************************************************************************
.
Completion time: 2008-03-05 19:50:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-06 01:50:50
.
2008-02-14 07:04:26 --- E O F ---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:56:03 PM, on 3/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Cox\Applications\App\syssvcnt.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\LTMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08\hpqtra08.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://srch-qus10.hpwis.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://srch-qus10.hpwis.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://qus10.hpwis.com/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AuthPopupBHO01.cBHO - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - c:\Program Files\Cox\Applications\App\popupbho01.dll
O2 - BHO: {6839e6a8-7844-c3a8-1c14-e23b9c998287} - {782899c9-b32e-41c1-8a3c-44878a6e9386} - C:\WINDOWS\system32\ywhyregb.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - c:\Program Files\Cox\Applications\App\popupbho01.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray .exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [fc87bd99] rundll32.exe "C:\WINDOWS\system32\wrioablv.dll",b
O4 - HKLM\..\Run: [ESP] c:\Program Files\Cox\Applications\app\start.exe
O4 - HKLM\..\Run: [sealmon] C:\Program Files\SealedMedia\sealmon.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [BMffb48e05] Rundll32.exe "C:\WINDOWS\system32\iptskiuk.dll",s
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PoivY] "C:\Program Files\PoivY.com\PoivY\PoivY .exe" -nosplash -minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsrngt.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) -
http://www3.authentium.com/cssrelease/bin/wizard.exeO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://www.update.microsoft.com/microso ... 2569293250O23 - Service: Cox High Speed Internet Security Suite System Service (AuthSysSvc) - Authentium, Inc. - c:\Program Files\Cox\Applications\App\syssvcnt.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe