Hi Neal,
It’s scary how powerful this Vundu is. Thanks for all your help. Here are the logs:
ComboFix 09-10-12.02 - jnathan 10/12/2009 21:35.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.450 [GMT -4:00]
Running from: c:\documents and settings\jnathan\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\jnathan\Desktop\CFScript.txt
AV: Symantec AntiVirus *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FILE ::
"c:\windows\system32\gomuliwe.dll"
"c:\windows\system32\misahavu.dll"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\gomuliwe.dll
.
((((((((((((((((((((((((( Files Created from 2009-09-13 to 2009-10-13 )))))))))))))))))))))))))))))))
.
2009-10-09 02:27 . 2009-10-09 02:27 -------- d-----w- c:\program files\Trend Micro
2009-10-09 01:18 . 2009-10-09 01:18 -------- d-----w- c:\documents and settings\jnathan\Application Data\Malwarebytes
2009-10-09 00:14 . 2009-10-09 00:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-10-09 00:14 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-09 00:14 . 2009-10-09 00:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-09 00:14 . 2009-10-09 00:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-09 00:14 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-08 22:58 . 2009-10-08 22:58 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-10-08 20:27 . 2009-10-08 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-08 20:27 . 2009-10-08 20:37 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-08 20:27 . 2009-10-08 20:27 -------- d-----w- c:\documents and settings\jnathan\Application Data\SUPERAntiSpyware.com
2009-10-08 20:22 . 2009-10-08 20:22 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-10-13 01:32 . 2007-07-26 22:14 -------- d-----w- c:\program files\Symantec AntiVirus
2009-10-12 19:18 . 2008-05-17 00:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-20 12:11 . 2007-07-25 15:49 64368 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((( SnapShot@2009-10-12_19.42.52 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-08-23 12:00 . 2009-10-12 19:22 67622 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2009-10-13 01:28 67622 c:\windows\system32\perfc009.dat
+ 2009-10-08 19:20 . 2009-10-12 19:53 1858 c:\windows\SoftwareDistribution\EventCache\{FFD566 F1-8717-4909-B735-EAA0A6313856}.bin
+ 2001-08-23 12:00 . 2009-10-13 01:28 431064 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2009-10-12 19:22 431064 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\Ca chedFileOverlayIcon]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2008-06-26 20:54 155648 ----a-w- c:\program files\GuardianEdge\GuardianEdge Clients\RSShellExCachedFileOverlayIcon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\My OverlayIcon]
@="{0FADB634-82AE-4F25-976A-F44DFB1ED11F}"
[HKEY_CLASSES_ROOT\CLSID\{0FADB634-82AE-4F25-976A-F44DFB1ED11F}]
2008-06-26 20:54 151552 ----a-w- c:\program files\GuardianEdge\GuardianEdge Clients\RSShellExEncryptedFileOverlayIcon.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2008-05-17 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-12-20 125632]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-31 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-31 162584]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2007-03-31 138008]
"EAFRCliStart"="c:\program files\GuardianEdge\GuardianEdge Clients\Client Console\EAFRCliStart.exe" [2008-06-30 405504]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]
"RunSimba"="Simba.exe" - c:\windows\system32\Simba.exe [2008-07-14 1246528]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSC lientMsiTrans\tscuinst.vbs" [2006-11-07 12451]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
VPN Client.lnk - c:\windows\Installer\{00CD55D6-EE5A-4570-9875-8A306628C032}\Icon3E5562ED7.ico [2008-5-12 6144]
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\aSinadin]
2008-07-14 13:30 582976 ----a-w- c:\windows\system32\Sinadin.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\EARSWlNotify]
2008-06-26 20:52 19968 ----a-w- c:\program files\GuardianEdge\GuardianEdge Clients\EARSWlNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GEWinlogonNotify]
2008-06-30 17:31 73728 ----a-w- c:\windows\system32\GENotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-1301757911-1839964613-4090028354-8633\Scripts\Logon\0\0]
"Script"=setdesktopbackground.vbs
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\SP]
@="Driver Group"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R0 Diego;Diego;c:\windows\system32\drivers\Diego.sys [7/14/2008 9:30 AM 56768]
R0 EAFSPROT;EAFSPROT;c:\windows\system32\drivers\eafs prot.sys [6/5/2008 10:53 AM 13440]
R0 EPHDXLAT;PC Guardian Encryption Filter;c:\windows\system32\drivers\ephdxlat.sys [6/5/2008 10:53 AM 83584]
R0 GEFilter;GEFilter;c:\windows\system32\drivers\EARS Fltr.sys [6/23/2008 1:41 PM 114304]
R0 Sahara;Sahara;c:\windows\system32\drivers\Sahara.s ys [7/14/2008 9:30 AM 138432]
R0 Salvador;Salvador;c:\windows\system32\drivers\Salv ador.sys [7/14/2008 9:30 AM 107584]
R0 Scarlet;Scarlet;c:\windows\system32\drivers\Scarle t.sys [7/14/2008 9:30 AM 39104]
R0 Sidney;Sidney;c:\windows\system32\drivers\Sidney.s ys [7/14/2008 9:30 AM 116160]
R1 Santa;Santa;c:\windows\system32\drivers\Santa.sys [7/14/2008 9:30 AM 55744]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/15/2009 11:42 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/15/2009 11:42 AM 74480]
R2 EAFRCliManager;EAFRCliManager;c:\program files\GuardianEdge\GuardianEdge Clients\EAFRCliManager.exe [6/30/2008 1:26 PM 221184]
R2 GuardianEdgeDCS;GuardianEdge Device Control;c:\windows\system32\SProtector.exe [7/14/2008 9:30 AM 206144]
R2 RemovableStorageService;Removable Storage Service;c:\program files\GuardianEdge\GuardianEdge Clients\RemovableStorageService.exe [6/26/2008 4:52 PM 1159168]
R2 RSMgmtSrvc;Removable Storage Mgmt Service;c:\program files\GuardianEdge\GuardianEdge Clients\RemovableStorageMgmtService.exe [6/26/2008 4:53 PM 6656]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/28/2009 8:02 PM 102448]
R3 Shlos;Shlos;c:\windows\system32\drivers\Shlos.sys [7/14/2008 9:30 AM 22208]
R3 Sofia;Safend Protector Network Filter Driver;c:\windows\system32\drivers\Sofia.sys [7/14/2008 9:30 AM 55104]
R3 Sofy;Sofy;c:\windows\system32\drivers\Sofy.sys [7/14/2008 9:30 AM 46272]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/15/2009 11:42 AM 7408]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [12/20/2006 2:29 PM 116928]
--- Other Services/Drivers In Memory ---
*Deregistered* - ephdlink
.
Contents of the 'Scheduled Tasks' folder
2009-10-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-17 13:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-12 21:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\ DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00 ,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00 ,5c,00,53,00,79,00,73,00,\
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"Installed"="1"
"NoChange"="1"
@=""
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1704)
c:\windows\system32\CSGina.dll
c:\windows\system32\EAFRCliGina.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAFRCliMgr.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAFRCliPwdUser.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EACaseConverter.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAFRCliSso.dll
c:\program files\GuardianEdge\GuardianEdge Clients\GENovell.dll
c:\windows\system32\EAFRCliDBWrapper.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAFRCliManagerPS.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAFRCliWinGUI.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAFRCliDB.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAFRCliUserManagement.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAECC.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EPCL32.DLL
c:\program files\GuardianEdge\GuardianEdge Clients\EAHDCliPwdUser.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EARSCliPwdUser.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAFREventLog.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAHDCliDBWrapper.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAHDCliXlat.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAHDCliSSO.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Sinadin.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EARSWlNotify.dll
c:\program files\GuardianEdge\GuardianEdge Clients\EAHDCliEAFS.dll
.
Completion time: 2009-10-13 21:41
ComboFix-quarantined-files.txt 2009-10-13 01:41
ComboFix2.txt 2009-10-12 19:45
Pre-Run: 70,072,885,248 bytes free
Post-Run: 70,034,636,800 bytes free
197 --- E O F --- 2009-03-17 13:28
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:45:04 PM, on 10/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\GuardianEdge\GuardianEdge Clients\EAFRCliManager.exe
C:\Program Files\GuardianEdge\GuardianEdge Clients\EAFRCliADSIComm.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\SProtector.exe
C:\Program Files\GuardianEdge\GuardianEdge Clients\RemovableStorageService.exe
C:\Program Files\GuardianEdge\GuardianEdge Clients\RemovableStorageMgmtService.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\GuardianEdge\GuardianEdge Clients\RSGUIProvider.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Simba.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
Bing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\s wg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [EAFRCliStart] C:\Program Files\GuardianEdge\GuardianEdge Clients\Client Console\EAFRCliStart.exe /p
O4 - HKLM\..\Run: [RunSimba] Simba.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.v bs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.v bs" (User 'Default user')
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/wind...?1185287506235
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: aSinadin - C:\WINDOWS\SYSTEM32\Sinadin.dll
O20 - Winlogon Notify: EARSWlNotify - EARSWlNotify.dll (file missing)
O20 - Winlogon Notify: GEWinlogonNotify - C:\WINDOWS\SYSTEM32\GENotify.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: EAFRCliManager - GuardianEdge Technologies, Inc. - C:\Program Files\GuardianEdge\GuardianEdge Clients\EAFRCliManager.exe
O23 - Service: GuardianEdge Device Control (GuardianEdgeDCS) - GuardianEdge Technologies Inc. - C:\WINDOWS\system32\SProtector.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Removable Storage Service (RemovableStorageService) - GuardianEdge Technologies, Inc. - C:\Program Files\GuardianEdge\GuardianEdge Clients\RemovableStorageService.exe
O23 - Service: Removable Storage Mgmt Service (RSMgmtSrvc) - GuardianEdge Technologies, Inc. - C:\Program Files\GuardianEdge\GuardianEdge Clients\RemovableStorageMgmtService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
--
End of file - 7799 bytes
. My friend told me to run SuperAntiSpyware and it did remove some items, but now I get:
