Advertising Pop-Ups and Slowness

In the meantime, you can help me by addressing the following:

* Have you have posted this issue on another forum? If so, please provide a link to the topic.

* If you have disabled System Restore in an attempt to begin cleaning malware, please enable it now. We will flush System Restore when we are finished cleaning and we are sure that everything is running smoothly.

* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE.

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.  The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a partial list HERE.    

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures. Please follow all instructions in sequence. Do not, on your own, install/re-install any programs or run any fixes or scanners that you have not been instructed to use because this may cause conflicts with the tools that I am using. Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. It is understood by the trained analysts that once a helper replies to a log, he continues working with you until the issue is resolved.

* During the course of our cleanup please do not do any additional online work or surfing until we have verified that your system is clean.

* We may be using some specialized tools during our fix. Certain embedded files that are part of legitimate programs or specialized fix tools such as process.exe, restart.exe, SmiUpdate.exe, reboot.exe, ws2fix.exe, prcviewer.exe and nircmd.exe may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case. Such programs have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them.

We need to see some additional information about what is happening in your machine.

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explanation about the tool.
• Click Yes at the prompt for Optional Scan.
• When done, DDS will open two (2) logs

• 1. DDS.txt
  2. Attach.txt

• Save both reports to your desktop.
• Copy/paste both logs to your reply on the forum.
• Close the program window, and delete the program from your desktop.

• Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE.

  I look forward to your reply so we can begin cleaning.

  Instructions posted for this user are customized for this user only. The tools used may cause damage if used on a computer with different infections. If you think you have similar problems, please post a log at the top of this board to start a new forum topic.

   

Happy New Year and thanks again!

DDS (Ver_09-12-01.01) - NTFSx86 
Run by knoy001 at 10:26:19.53 on Mon 01/04/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.3070.2130 [GMT -5:00]

AV: McAfee VirusScan Enterprise *On-access scanning enabled* (Updated)   {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

============== Running Processes ===============

C:\Program Files\Novell\CASA\bin\micasad.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k eapsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k dot3svc
C:\Program Files\Novell\ZENworks\bin\ZenworksWindowsService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\Program Files\Novell\ZENworks\bin\nzrWinVNC.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Novell\Zenworks\bin\ZenNotifyIcon.exe
C:\Program Files\Novell\ZENworks\bin\ZenUserDaemon.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\WINDOWS\system32\iprntctl.exe
C:\WINDOWS\system32\iprntlgn.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Documents and Settings\knoy001\Application Data\Dropbox\bin\Dropbox.exe
C:\Documents and Settings\knoy001\Application Data\U3\0000181B3C639821\LaunchPad.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\knoy001\My Documents\Downloads\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://feeds.eng.fiu.edu/
mWinlogon: System=c:\program files\novell\zenworks\bin\preboot\ZISWIN.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptsn.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [uvc7jk640c] c:\docume~1\knoy001\locals~1\temp\c.exe
uRun: [ZagrebLand] c:\docume~1\knoy001\locals~1\temp\b.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [NWTRAY] NWTRAY.EXE
mRun: [ZenNotifyIcon] c:\program files\novell\zenworks\bin\ZenNotifyIcon.exe
mRun: [ZENWorksUserDaemon] c:\program files\novell\zenworks\bin\ZenUserDaemon.exe
mRun: [NalView] c:\program files\novell\zenworks\bin\nalview.exe
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\udaterui.exe" /StartedFromRunKey
mRun: [iPrint Tray] c:\windows\system32\iprntctl.exe TRAY_ICON
mRun: [iPrint Event Monitor] c:\windows\system32\iprntlgn.exe
mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe
StartupFolder: c:\docume~1\knoy001\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\knoy001\application data\dropbox\bin\Dropbox.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
mPolicies-system: CompatibleRUPSecurity = 1 (0x1)
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1254237067046
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: LCredMgr - c:\program files\novell\casa\bin\lcredmgr.dll
Notify: nzrNotifier - nzrNotifier.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: EIC Software Distribuition: {763370c4-268e-4308-a60c-d8da0342be32} - c:\program files\novell\zenworks\bin\NalShell.dll
LSA: Authentication Packages = msv1_0 nwv1_0
Hosts: 127.0.0.1    www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\knoy001\applic~1\mozilla\firefox\profiles\s27f5eiz.default\
FF - prefs.js: browser.startup.homepage - hxxp://feeds.eng.fiu.edu/
FF - component: c:\program files\mozilla firefox\components\Scriptff.dll
FF - plugin: c:\documents and settings\knoy001\application data\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\knoy001\application data\move networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\knoy001\application data\mozilla\firefox\profiles\s27f5eiz.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-9-29 340592]
R1 nipplpt2;Novell iCapture Lpt Redirector 2;c:\windows\system32\drivers\nipplpt.sys [2009-9-29 34592]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-9-29 12672]
R2 McAfeeEngineService;McAfee Engine Service;c:\program files\mcafee\virusscan enterprise\EngineServer.exe [2008-9-29 19456]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2009-3-10 103744]
R2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\Mcshield.exe [2008-9-29 143088]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2008-9-29 62800]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2009-9-29 67904]
R2 Novell Identity Store;Novell Identity Store;c:\program files\novell\casa\bin\micasad.exe [2009-6-24 245760]
R2 Novell ZENworks Agent Service;Novell ZENworks Agent Service;c:\program files\novell\zenworks\bin\ZenworksWindowsService.exe [2009-11-26 28672]
R2 nzwinvnc;Novell ZENworks Remote Management powered by VNC;c:\program files\novell\zenworks\bin\nzrWinVNC.exe [2009-11-20 2379776]
R2 WNTHW;WNTHW;c:\windows\system32\drivers\WNTHW.SYS [2009-9-29 9176]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2009-4-7 31896]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-9-29 90360]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-9-29 42424]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2009-9-29 64432]
S3 ZENPreAgent;Novell ZENworks Pre Agent;c:\windows\novell\zenworks\bin\ZENPreAgent.exe [2009-9-29 188416]

=============== Created Last 30 ================

2009-12-22 20:50:25    0    d-----w-    c:\program files\Trend Micro
2009-12-22 20:47:09    0    d-----w-    c:\program files\Spybot - Search & Destroy
2009-12-22 20:47:09    0    d-----w-    c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-12-22 20:40:43    0    d-----w-    c:\program files\CleanUp!
2009-12-22 20:40:22    0    d-----w-    c:\program files\CCleaner
2009-12-21 15:49:35    0    d-----w-    C:\Quarantine
2009-12-21 15:43:12    221184    ----a-w-    c:\windows\system32\wmpns.dll
2009-12-15 17:22:27    0    d-----w-    c:\program files\Paint.NET
2009-12-11 22:15:44    0    d-----w-    c:\docume~1\knoy001\applic~1\MozillaControl
2009-12-11 22:13:51    0    d-----w-    c:\program files\Mozilla ActiveX Control v1.7.12
2009-12-11 22:12:58    0    d-----w-    c:\program files\VideoLAN
2009-12-11 22:11:08    0    d-----w-    c:\program files\Graboid
2009-12-11 20:16:54    73728    ----a-w-    c:\windows\NalRedir.dll

==================== Find3M  ====================

2009-11-26 16:55:32    94208    ----a-w-    c:\windows\system32\ZenCCS.dll
2009-11-26 16:55:02    126976    ----a-w-    c:\windows\system32\ZenLgn.dll
2009-11-26 16:53:40    24576    ----a-w-    c:\windows\system32\ZenPol.dll
2009-11-20 12:36:02    57344    ----a-w-    c:\windows\system32\nzrNotifier.dll
2009-11-10 23:20:54    424960    ----a-w-    c:\windows\system32\NWGina.dll
2009-10-13 23:46:39    411368    ----a-w-    c:\windows\system32\deploytk.dll
2009-06-24 23:58:12    114688    ----a-w-    c:\program files\ad_ff.dll
2009-06-01 23:19:08    6253    ----a-w-    c:\program files\eula.rtf

============= FINISH: 10:27:21.62 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 9/28/2009 3:48:58 PM
System Uptime: 1/4/2010 8:08:58 AM (2 hours ago)

Motherboard: Dell Inc.           |  | 0M3918
Processor:               Intel(R) Pentium(R) 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 74 GiB total, 58.066 GiB free.
D: is CDROM ()
E: is CDROM (CDFS)
F: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP21: 10/13/2009 1:26:37 PM - System Checkpoint
RP22: 10/13/2009 7:46:28 PM - Installed Java(TM) 6 Update 16
RP23: 10/14/2009 8:07:39 PM - System Checkpoint
RP24: 10/15/2009 8:08:02 PM - System Checkpoint
RP25: 10/16/2009 8:43:40 PM - System Checkpoint
RP26: 10/17/2009 9:07:40 PM - System Checkpoint
RP27: 10/18/2009 9:55:40 PM - System Checkpoint
RP28: 10/19/2009 10:19:42 PM - System Checkpoint
RP29: 10/20/2009 10:31:40 PM - System Checkpoint
RP30: 10/21/2009 11:07:33 PM - System Checkpoint
RP31: 10/22/2009 11:19:33 PM - System Checkpoint
RP32: 10/24/2009 12:19:33 AM - System Checkpoint
RP33: 10/25/2009 1:52:28 AM - System Checkpoint
RP34: 10/26/2009 2:43:33 AM - System Checkpoint
RP35: 10/27/2009 3:07:33 AM - System Checkpoint
RP36: 10/28/2009 3:51:07 AM - System Checkpoint
RP37: 10/29/2009 4:31:33 AM - System Checkpoint
RP38: 10/30/2009 5:07:33 AM - System Checkpoint
RP39: 10/31/2009 6:07:33 AM - System Checkpoint
RP40: 11/1/2009 6:43:33 AM - System Checkpoint
RP41: 11/2/2009 7:44:19 AM - System Checkpoint
RP42: 11/3/2009 7:55:34 AM - System Checkpoint
RP43: 11/4/2009 8:10:03 AM - System Checkpoint
RP44: 11/5/2009 8:25:22 AM - System Checkpoint
RP45: 11/6/2009 9:25:22 AM - System Checkpoint
RP46: 11/7/2009 10:25:22 AM - System Checkpoint
RP47: 11/8/2009 10:25:22 AM - System Checkpoint
RP48: 11/9/2009 11:25:22 AM - System Checkpoint
RP49: 11/10/2009 1:03:58 PM - System Checkpoint
RP50: 11/11/2009 1:25:24 PM - System Checkpoint
RP51: 11/12/2009 2:25:17 PM - System Checkpoint
RP52: 11/13/2009 2:29:39 PM - System Checkpoint
RP53: 11/14/2009 3:25:17 PM - System Checkpoint
RP54: 11/15/2009 4:25:17 PM - System Checkpoint
RP55: 11/16/2009 4:39:49 PM - System Checkpoint
RP56: 11/17/2009 6:31:13 PM - System Checkpoint
RP57: 11/18/2009 7:13:29 PM - System Checkpoint
RP58: 11/19/2009 7:25:17 PM - System Checkpoint
RP59: 11/20/2009 8:25:18 PM - System Checkpoint
RP60: 11/21/2009 9:25:17 PM - System Checkpoint
RP61: 11/22/2009 10:12:03 PM - System Checkpoint
RP62: 11/23/2009 10:25:17 PM - System Checkpoint
RP63: 11/24/2009 11:25:17 PM - System Checkpoint
RP64: 11/25/2009 11:37:56 PM - System Checkpoint
RP65: 11/26/2009 11:49:17 PM - System Checkpoint
RP66: 11/30/2009 12:14:47 PM - System Checkpoint
RP67: 12/1/2009 12:44:54 PM - System Checkpoint
RP68: 12/2/2009 1:23:53 PM - System Checkpoint
RP69: 12/3/2009 2:12:23 PM - System Checkpoint
RP70: 12/4/2009 6:12:02 PM - System Checkpoint
RP71: 12/5/2009 6:12:23 PM - System Checkpoint
RP72: 12/6/2009 7:12:23 PM - System Checkpoint
RP73: 12/7/2009 8:50:55 PM - System Checkpoint
RP74: 12/8/2009 9:12:22 PM - System Checkpoint
RP75: 12/9/2009 10:12:22 PM - System Checkpoint
RP76: 12/10/2009 11:12:22 PM - System Checkpoint
RP77: 12/12/2009 12:12:22 AM - System Checkpoint
RP78: 12/13/2009 1:12:22 AM - System Checkpoint
RP79: 12/14/2009 2:12:22 AM - System Checkpoint
RP80: 12/15/2009 3:12:20 AM - System Checkpoint
RP81: 12/15/2009 12:22:27 PM - Paint.NET v3.5.1
RP82: 12/16/2009 12:23:31 PM - System Checkpoint
RP83: 12/17/2009 1:12:20 PM - System Checkpoint
RP84: 12/18/2009 1:15:03 PM - System Checkpoint
RP85: 12/19/2009 2:12:21 PM - System Checkpoint
RP86: 12/20/2009 3:12:23 PM - System Checkpoint
RP87: 12/21/2009 3:31:32 PM - System Checkpoint
RP88: 12/22/2009 6:01:38 PM - System Checkpoint
RP89: 1/4/2010 8:43:08 AM - System Checkpoint

==== Installed Programs ======================


Action Handler Resources
actions-langs
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.2
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
bundle-langs
CASA
CCleaner
CleanUp!
content-distribution-point-langs
CPUID CPU-Z 1.52.2
Dropbox
Graboid Video 1.65
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
hp deskjet 960c series
hp deskjet 960c series (Remove only)
Intel(R) PRO Network Adapters and Drivers
inventory-langs
Java(TM) 6 Update 16
McAfee Agent
McAfee VirusScan Enterprise
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.4
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Plus 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders  (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Move Media Player
Mozilla Firefox (3.5.5)
NICI (Shared) U.S./Worldwide (128 bit) (2.7.3-1)
NMAS Challenge Response Method
NMAS Client
Novell CASA Authentication Token Client
Novell Client for Windows
Novell iPrint Client v05.12.00
Novell ZENworks
Novell ZENworks Adaptive Agent Help
Novell ZENworks Remote Management
OGA Notifier 2.0.0048.0
Paint.NET v3.5.1
policy-langs
Policy Action Handler Resources
Policy Handler Resources
primary-agent-langs
remotemanagement-langs
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SoundMAX
Spybot - Search & Destroy
status-collection-point-langs
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office Outlook 2007 (KB969907)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb973514)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows XP (KB898461)
Update for Windows XP (KB943729)
Update for Windows XP (KB951978)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
usermanagement-langs
VideoLAN VLC media player 0.8.6d
WebFldrs XP
windows-desktop-langs
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live ID Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Player 11
Windows PowerShell(TM) 1.0
Windows PowerShell(TM) 1.0 MUI pack
Windows Search 4.0
WinProxy-langs
WinRAR archiver
zencore-agent-langs
zennotifyicon-langs
ZENworks Action Handlers
ZENworks Action Utilities
ZENworks Actions
ZENworks Agent Bundle Management
ZENworks Agent Core Modules
ZENworks Agent Inventory Management
ZENworks Agent Policy Management
ZENworks Agent System Update Module
ZENworks Agent WinProxy Module
ZENworks Content Distribution Point
ZENworks Extensions Libraries
ZENworks Image-Safe Data Agent
ZENworks Image Management
ZENworks Imaging Server
ZENworks Information Icon
ZENworks Policy Handlers
ZENworks Policy Libraries
ZENworks Primary Agent
ZENworks Remote Management
ZENworks Status Collection Point
ZENworks Uninstaller
ZENworks User Management
ZENworks Version Information
ZENworks Windows UI

==== End Of File ===========================

Hi John_Doe,

I usually close topics after a few days of inactivity. Two weeks have lapsed between your posts. Not only have I taken on new responsibilities, but since your original post, your original HijackThis log has become obsolete. Please post an updated HijackThis log and your recent DDS logs as a NEW MESSAGE on this forum so that one of the trained analysts can handle your malware problem. Thank you for your patience and understanding.