Mysterious "Links" process running in Task Manager

Malwarebytes' Anti-Malware 1.40
Database version: 2565
Windows 5.1.2600 Service Pack 2
 
8/5/2009 2:58:05 PM
mbam-log-2009-08-05 (14-57-51).txt
 
Scan type: Full Scan (C:\|)
Objects scanned: 216804
Time elapsed: 51 minute(s), 16 second(s)
 
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
 
Memory Processes Infected:
(No malicious items detected)
 
Memory Modules Infected:
(No malicious items detected)
 
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Trojan.Agent) -> No action taken.
 
Registry Values Infected:
(No malicious items detected)
 
Registry Data Items Infected:
(No malicious items detected)
 
Folders Infected:
(No malicious items detected)
 
Files Infected:
C:\Setup.exe (Trojan.Agent) -> No action taken.
 
**************************************************************************
**************************************************************************
**************************************************************************
ComboFix 09-08-04.04 - MMulhern 08/05/2009 15:10.1.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.1022.664 [GMT -5:00]
Running from: t:\melissa\ComboFix.exe
AV: VirusScan Enterprise + AntiSpyware Enterprise *On-access scanning disabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\Installer\1db51275.msi
c:\windows\Installer\487a891.msp
c:\windows\Installer\WinRMSrv.msi
c:\windows\system32\drivers\fad.sys
 
.
(((((((((((((((((((((((((   Files Created from 2009-07-05 to 2009-08-05  )))))))))))))))))))))))))))))))
.
 
2009-08-05 18:52 . 2009-08-05 18:52	--------	d-----w-	c:\documents and settings\mmulhern.KNIGHTCORP\Application Data\Malwarebytes
2009-08-05 18:52 . 2009-08-03 18:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-05 18:52 . 2009-08-05 18:52	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-05 18:52 . 2009-08-05 18:52	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-05 18:52 . 2009-08-03 18:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 16:19 . 2004-11-30 15:42	--------	d-----w-	c:\program files\tvalue
2009-06-08 18:05 . 2009-06-08 18:04	--------	d-----w-	c:\program files\QuickTime
2009-06-08 18:04 . 2009-06-08 18:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple Computer
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 135168]
"ATIPTA"="c:\program files\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE" [2004-09-15 339968]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"hpbdfawep"="c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2006-07-12 626688]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_12\bin\jusched.exe" [2007-05-02 75520]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2009-01-28 111952]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2008-03-14 136512]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2006-11-07 12451]
 
c:\documents and settings\MMulhern\Start Menu\Programs\Startup\
Microsoft Outlook.lnk - c:\program files\Microsoft Office2k\OFFICE11\OUTLOOK.EXE [2008-1-30 199688]
 
c:\documents and settings\mmulhern.KNIGHTCORP\Start Menu\Programs\Startup\
Microsoft Outlook.lnk - c:\program files\Microsoft Office2k\OFFICE11\OUTLOOK.EXE [2008-1-30 199688]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Classic PhoneTools.lnk - c:\program files\Classic PhoneTools\Phontool.exe [2008-4-29 1019904]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-11-12 24576]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-7-11 61440]
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
 
R2 AfsImageVision;Afs Image Vision Service;c:\program files\Advanced Financial Solutions\Direct Merchant\ImageVisionService\ImageVisionService.exe [8/30/2006 3:21 PM 24576]
R3 TSUSB2;Driver for TellerScan Device;c:\windows\SYSTEM32\DRIVERS\TSUSB2.sys [7/22/2008 11:13 AM 54016]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
 
2009-08-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
- - - - ORPHANS REMOVED - - - -
 
HKU-Default-RunOnce-TSClientAXDisabler - c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat
Notify-dimsntfy - (no file)
 
 
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
DPF: {2CCFEB42-1C81-4191-807C-708F4043D179} - hxxps://odm.associatedbank.com/MerchantCaptureWebClient241/CaptureControlUtility.cab
DPF: {EF53EB97-8E0A-4DB6-ADF3-5B79B6E7A26B} - hxxps://odm.associatedbank.com/MerchantCaptureWebClient241/AfsDevice_TellerScan.cab
.
 
**************************************************************************
 
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-05 15:21
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ...  
 
scanning hidden autostart entries ... 
 
scanning hidden files ...  
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'explorer.exe'(1408)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\BAsfIpM.exe
c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\SYSTEM32\TCPSVCS.EXE
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\McAfee\Common Framework\Mctray.exe
c:\windows\SYSTEM32\rundll32.exe
c:\program files\WinZip\WZQKPICK.EXE
.
**************************************************************************
.
Completion time: 2009-08-05 15:23 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt  2009-08-05 20:23
 
Pre-Run: 57,348,452,352 bytes free
Post-Run: 58,421,157,888 bytes free
 
115	--- E O F ---	2009-03-06 23:55
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189: