Active Fake antivirus, computer instability.

[Active] Fake antivirus, computer instability.

First things first, I will say this... I really need to learn to follow things through.

DDS would not run.

I am getting alot of fake antivirus messages and some windows security messages with Continue Blocking and Unblock options unclickable. When I restart my computer, my desktop is the Restore Active Desktop thing. Avast will not start, nor will MBAM and (I know I am not supposed to run it on my own) Combofix. The virus attack was sudden and forced my computer to restart. I remember avast detected something about figaro.sys.

And if Broni could help with this one, itd be awesome. Weve worked together before.

 

Well ****. I figured I would listen to some music while I wait for it to be resolved, and I get something about bad directsound driver (I am running WinAmp)
Looks like this goes deeper than I thought.

 

Neither Combofix or HJT would run. Their processes are running but nothing happens.

 

Combofix is warning me that avast is running, even though it isnt. If I try to start avast, I get some rpc error.

What is ERU? It is running with combofix.

 

Im afraid combofix may not give me a log report, its been preparing the report for 15 minutes. I keep getting popups from various stuff, including the "Protection System" fake antivirus.

 

Scratch that, heres the log.
ComboFix 09-09-04.01 - Compaq_Owner 09/05/2009 0:22.8.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.3070.2685 [GMT -5:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\c87rty43.exe
AV: avast! antivirus 4.8.1335 [VPS 090904-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Desktop\nudetube.com.lnk
c:\documents and settings\All Users\Desktop\pornotube.com.lnk
c:\documents and settings\All Users\Desktop\youporn.com.lnk
What is a good virus without some **** adware spamming? I saw this after the virus started causing problems.
C:\fyblb.exe
c:\windows\Installer\109eada6.msi
c:\windows\Installer\5ac37.msi
c:\windows\Installer\e10660e.msi
c:\windows\system32\~.exe
c:\windows\system32\bodihovi.dll
c:\windows\system32\braviax.exe
c:\windows\system32\drivers\UACtdrmyqlxqo.sys
c:\windows\system32\hatafizu.dll
c:\windows\system32\pobeziwo.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACjoaioevvbx.dll
c:\windows\system32\UACmbapvvonir.dll
c:\windows\system32\UACmybwvesjbh.dll
c:\windows\system32\UACodfqxaoljv.dll
c:\windows\system32\UACuoaanfagau.dat
c:\windows\system32\wewegije.dll
c:\windows\system32\wisdstr.exe
c:\windows\system32\wscsvc32.exe
c:\windows\system32\yofiyajo.dll

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
Restored copy from - c:\windows\system32\dllcache\eventlog.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys
-------\Legacy_UACd.sys
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}


((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
.

2009-09-05 04:07 . 2009-09-05 04:07 31232 ----a-w- c:\windows\system32\wingenocx.dll
2009-09-05 04:06 . 2009-09-05 04:07 -------- d-----w- c:\program files\Protection System
2009-09-05 03:33 . 2009-09-05 03:33 22016 ----a-w- C:\emxtqjit.exe
2009-09-05 03:33 . 2009-09-05 03:33 51712 ----a-w- C:\hpbyv.exe
2009-09-03 20:34 . 2009-09-03 20:34 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Rainmeter
2009-09-03 20:34 . 2009-09-03 20:34 -------- d-----w- c:\program files\Rainmeter
2009-08-27 22:41 . 2009-08-27 22:46 -------- d-----w- c:\program files\RocketDock
2009-08-25 03:00 . 2009-08-25 03:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2009-08-25 02:58 . 2009-09-02 08:08 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-08-25 01:48 . 2009-08-25 01:48 -------- d-----w- c:\program files\Microsoft SQL Server
2009-08-25 01:48 . 2009-08-25 01:48 -------- d-----w- c:\program files\Microsoft Synchronization Services
2009-08-25 01:48 . 2009-08-25 01:48 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-08-25 01:44 . 2009-08-25 01:48 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
2009-08-25 01:43 . 2009-08-25 01:43 -------- d-----w- c:\program files\Microsoft SDKs
2009-08-21 03:40 . 2009-08-21 03:40 -------- d-----w- c:\program files\NavNetApp
2009-08-18 21:27 . 2009-08-18 21:27 -------- d-----w- c:\program files\Microsoft XNA
2009-08-18 21:26 . 2009-08-24 20:39 -------- d-----w- c:\program files\Zachtronics Industries
2009-08-18 03:01 . 2009-08-18 03:01 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-18 03:01 . 2009-08-18 03:01 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-18 03:01 . 2009-08-18 03:01 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\SUPERAntiSpyware.com
2009-08-17 06:12 . 2009-08-17 06:12 -------- d-----w- C:\Nexon
2009-08-17 04:52 . 2009-08-17 05:54 1284710929 ----a-w- c:\program files\MSSetupv74.exe
2009-08-17 04:49 . 2009-08-20 01:14 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\PMB Files
2009-08-17 04:49 . 2009-08-17 04:50 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2009-08-17 04:48 . 2009-08-17 04:48 -------- d-----w- c:\program files\Pando Networks
2009-08-16 21:36 . 2009-08-16 21:36 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\GarageGames
2009-08-14 02:47 . 2009-08-14 02:47 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\GameSpy
2009-08-14 02:35 . 2009-08-14 02:35 -------- d-----w- c:\program files\GameSpy
2009-08-14 02:33 . 2009-08-14 02:33 669184 ----a-w- c:\windows\system32\pbsvc.exe
2009-08-12 08:02 . 2009-08-12 08:02 -------- d-----w- c:\windows\ServicePackFiles
2009-08-12 05:53 . 2009-08-12 05:53 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\.minecraft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 05:15 . 2009-02-05 03:47 55808 ----a-w- c:\windows\system32\eventlog.dll
2009-09-05 04:30 . 2009-01-12 02:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-04 20:14 . 2007-12-24 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-09-04 19:30 . 2006-09-26 02:43 -------- d-----w- c:\program files\Google
2009-09-01 06:32 . 2008-01-06 22:29 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\gtk-2.0
2009-08-25 02:52 . 2008-04-08 21:29 -------- d-----w- c:\program files\Electronic Arts
2009-08-25 02:02 . 2008-06-08 03:22 -------- d-----w- c:\program files\Wallbusters
2009-08-25 01:48 . 2008-01-25 05:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-21 03:37 . 2009-02-24 06:07 -------- d-----w- c:\program files\NavNet
2009-08-20 03:19 . 2009-07-23 01:49 -------- d-----w- c:\program files\axhslt
2009-08-18 03:00 . 2007-11-28 16:44 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-17 03:41 . 2008-07-19 19:17 34 ----a-w- c:\documents and settings\Compaq_Owner\jagex_runescape_preferences.dat
2009-08-14 06:32 . 2008-06-11 01:27 -------- d-----w- c:\program files\Corcrop
2009-08-14 02:59 . 2009-06-10 03:40 -------- d-----w- c:\program files\ManyCam 2.4
2009-08-14 02:59 . 2008-07-30 00:05 -------- d-----w- c:\program files\MagicISO
2009-08-14 02:59 . 2007-08-27 04:19 -------- d-----w- c:\program files\LimeWire
2009-08-14 02:59 . 2008-06-08 17:49 -------- d-----w- c:\program files\Modulobe
2009-08-14 02:59 . 2008-05-26 15:53 -------- d-----w- c:\program files\Wake up News
2009-08-14 02:59 . 2006-08-01 18:50 -------- d-----w- c:\program files\Microsoft Works
2009-08-14 02:59 . 2006-11-30 22:48 -------- d-----w- c:\program files\ShortKeys2
2009-08-14 02:58 . 2008-07-31 01:51 -------- d-----w- c:\program files\YouTube Downloader
2009-08-14 02:45 . 2006-09-25 03:17 66288 ----a-w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-14 02:34 . 2009-08-14 02:34 22328 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\PnkBstrK.sys
2009-08-14 02:34 . 2007-12-25 23:28 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-08-14 02:33 . 2007-12-25 23:27 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-08-14 02:33 . 2007-12-25 23:26 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-08-14 01:41 . 2007-05-13 03:07 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Azureus
2009-08-13 01:20 . 2009-06-13 05:49 -------- d-----w- c:\program files\Hotspot Shield
2009-08-12 22:05 . 2009-03-24 22:25 -------- d-----w- c:\program files\AIMTunes
2009-08-12 04:50 . 2008-08-27 22:01 -------- d-----w- c:\program files\RegCure
2009-08-11 21:36 . 2007-05-13 03:06 -------- d-----w- c:\program files\Azureus
2009-08-11 19:15 . 2009-08-01 22:52 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Mumble
2009-08-08 18:58 . 2008-01-08 04:35 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-05 09:11 . 2009-02-05 03:47 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 18:36 . 2009-01-12 02:18 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 18:36 . 2009-01-12 02:18 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-01 22:52 . 2009-08-01 22:52 -------- d-----w- c:\program files\Mumble
2009-07-30 02:00 . 2007-01-12 04:40 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Viewpoint
2009-07-30 02:00 . 2006-09-25 02:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-30 02:00 . 2006-09-25 02:17 -------- d-----w- c:\program files\Viewpoint
2009-07-30 01:56 . 2009-05-24 17:31 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-30 01:56 . 2009-07-30 01:56 -------- d-----w- c:\program files\Java
2009-07-29 13:51 . 2008-12-22 22:45 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\renamed
2009-07-26 23:54 . 2007-08-20 23:04 -------- d-----w- c:\program files\MSN Messenger
2009-07-26 23:54 . 2008-08-10 03:48 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-24 03:24 . 2009-07-24 03:24 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\CBL-Electronics
2009-07-24 03:22 . 2009-07-24 03:22 -------- d-----w- c:\documents and settings\All Users\Application Data\CBL-Electronics
2009-07-24 03:22 . 2009-07-24 03:22 -------- d-----w- c:\program files\Common Files\cbl electronics shared
2009-07-24 03:22 . 2009-07-24 03:22 -------- d-----w- c:\program files\cbl electronics inc
2009-07-24 03:21 . 2009-07-24 03:21 -------- d-----w- c:\program files\DS-MP3 Source
2009-07-24 03:17 . 2009-07-24 03:17 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-07-24 03:16 . 2009-07-24 03:16 -------- d-----w- c:\program files\AVS4YOU
2009-07-24 03:16 . 2009-07-24 03:16 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-24 03:16 . 2009-07-24 03:16 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\AVS4YOU
2009-07-23 23:48 . 2009-07-21 03:45 -------- d-----w- c:\program files\Operation Cleaner 2
2009-07-23 20:43 . 2008-06-12 23:15 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Winamp
2009-07-23 17:25 . 2009-06-04 17:01 -------- d-----w- c:\program files\mIRC
2009-07-22 06:03 . 2009-07-22 06:02 -------- d-----w- c:\program files\Universe Sandbox
2009-07-22 05:55 . 2009-07-22 05:55 -------- d-----w- c:\program files\RocketScientists.dk
2009-07-22 01:52 . 2008-11-09 06:49 -------- d-----w- c:\program files\Gaia Online Toolbar
2009-07-22 01:52 . 2009-01-19 20:03 -------- d-----w- c:\program files\AGEIA Technologies
2009-07-21 23:36 . 2008-09-05 04:47 -------- d-----w- c:\program files\DivX
2009-07-21 23:36 . 2009-06-02 15:43 -------- d-----w- c:\program files\Chains
2009-07-21 23:36 . 2007-07-22 18:42 -------- d-----w- c:\program files\BitZip
2009-07-21 23:36 . 2006-08-01 19:02 -------- d-----w- c:\program files\PC-Doctor 5 for Windows
2009-07-21 23:35 . 2009-05-29 19:14 -------- d-----w- c:\program files\Windows Media Connect 2
2009-07-17 18:55 . 2009-02-05 03:48 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2004-08-04 11:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 09:28 . 2008-06-11 21:30 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\mIRC
2009-07-09 06:16 . 2007-02-01 22:34 -------- d-----w- c:\program files\AIM6
2009-07-09 05:13 . 2009-01-13 08:05 -------- d-----w- c:\program files\trend micro
2009-07-08 03:05 . 2006-12-08 23:25 -------- d-----w- c:\program files\QuickTime
2009-07-08 03:05 . 2008-05-11 05:44 -------- d-----w- c:\program files\Common Files\Apple
2009-06-25 08:44 . 2009-02-05 03:47 298496 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:44 . 2009-02-05 03:47 56320 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2009-02-05 03:46 59392 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2009-02-05 03:46 724480 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2009-02-05 03:46 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:44 . 2009-02-05 03:46 168448 ----a-w- c:\windows\system32\schannel.dll
2009-06-22 11:34 . 2009-02-05 03:46 92544 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 23:24 . 2009-06-16 23:24 108 ----a-w- c:\documents and settings\All Users\Application Data\1bd1132a.dat
2009-06-16 14:55 . 2009-02-05 03:47 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2009-02-05 03:47 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 11:50 . 2009-02-05 03:47 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:21 . 2009-02-05 03:48 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:32 . 2009-02-05 03:46 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-09 21:25 . 2009-06-09 21:25 11861 ----a-w- c:\windows\system32\drivers\mdc8021x.sys
2008-06-20 21:19 . 2008-06-20 21:19 124821 ----a-w- c:\program files\Crates.rar
2008-05-08 21:32 . 2008-05-08 21:32 390 ----a-w- c:\program files\Shortcut to Program Files.lnk
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-31 07:03 . 2009-03-24 22:27 172 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\bci.png

2008-08-31 07:03 . 2009-03-24 22:27 195 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\bcir.png

2008-08-31 07:03 . 2009-03-24 22:27 350 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\cswall.png

2008-08-31 07:03 . 2009-03-24 22:27 6078 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\Dshield.png

2008-08-31 07:03 . 2009-03-24 22:27 255 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\heal2.png

2008-08-31 07:03 . 2009-03-24 22:27 236 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\mbtsfall.png

2008-08-31 07:03 . 2009-03-24 22:27 5758 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\mirrors.png

2008-08-31 07:03 . 2009-03-24 22:27 12320 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\thick4.png

2008-08-31 07:03 . 2009-03-24 22:27 1749 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\whirl1.png

2007-05-15 02:16 . 2007-12-04 13:00 79224 c:\program files\Alwil Software\Avast4\bak\ashDisp.exe
2007-05-15 02:16 . 2009-02-05 20:08 81000 c:\program files\Alwil Software\Avast4\ashDisp.exe

2005-02-17 13:11 . 2005-02-17 13:11 49152 c:\program files\HP\HP Software Update\bak\HPwuSchd2.exe

2007-06-13 20:21 . 2005-06-08 23:24 458752 c:\program files\Logitech\Video\bak\ISStart.exe

2007-06-13 20:21 . 2005-06-08 23:14 217088 c:\program files\Logitech\Video\bak\LogiTray.exe

2007-06-13 20:21 . 2005-06-08 22:44 196608 c:\program files\Logitech\Video\bak\ManifestEngine.exe

2006-12-08 23:25 . 2008-01-27 07:32 385024 c:\program files\QuickTime\bak\qttask.exe

2006-08-01 18:51 . 2004-12-14 09:23 663552 c:\windows\CREATOR\bak\Remind_XP.exe

2006-08-01 18:51 . 2005-07-23 05:14 237568 c:\windows\SMINST\bak\RECGUARD.EXE

2005-07-20 01:32 . 2005-07-20 01:32 221184 c:\windows\system32\bak\LVCOMSX.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B3535C18-0E70-4D4B-B36B-BBFE139BB144} "= "c:\program files\Gaia Online Toolbar\Toolbar.dll" [2008-11-09 1241088]

[HKEY_CLASSES_ROOT\clsid\{b3535c18-0e70-4d4b-b36b-bbfe139bb144}]
[HKEY_CLASSES_ROOT\FCTB000000108.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{8518B5E9-EDF5-4BDA-B5D3-4AA044EC072D}]
[HKEY_CLASSES_ROOT\FCTB000000108.IEToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{B3535C18-0E70-4D4B-B36B-BBFE139BB144} "= "c:\program files\Gaia Online Toolbar\Toolbar.dll" [2008-11-09 1241088]

[HKEY_CLASSES_ROOT\clsid\{b3535c18-0e70-4d4b-b36b-bbfe139bb144}]
[HKEY_CLASSES_ROOT\FCTB000000108.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{8518B5E9-EDF5-4BDA-B5D3-4AA044EC072D}]
[HKEY_CLASSES_ROOT\FCTB000000108.IEToolbar]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@= "{C5994560-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@= "{C5994561-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@= "{C5994562-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@= "{C5994563-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@= "{C5994564-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@= "{C5994565-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@= "{C5994566-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@= "{C5994567-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@= "{C5994568-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6 "= "c:\program files\AIM6\aim6.exe" [2007-10-04 50528]
"msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"DAEMON Tools Lite "= "c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-21 486856]
"Steam "= "c:\steam\steam.exe" [2009-06-12 1217784]
"ManyCam "= "c:\program files\ManyCam 2.4\ManyCam.exe" [2009-04-17 1824040]
"Comrade.exe "= "c:\program files\GameSpy\Comrade\Comrade.exe" [2007-06-29 36864]
"RocketDock "= "c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Protection System "= "c:\program files\Protection System\psystem.exe" [2009-09-05 2535424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2008-07-26 86016]
"D-Link AirPlus XtremeG "= "c:\program files\D-Link\AirPlus XtremeG\AirPlusCFG.exe" [2005-03-28 1011712]
"ANIWZCS2Service "= "c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 49152]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2008-07-26 13570048]
"jewofobaga "= "c:\windows\system32\wewegije.dll" [N/A]
"redirapew "= "c:\windows\system32\yofiyajo.dll" [N/A]
"PCDrProfiler "=" " [N/A]
"Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-07-21 16261632]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-1 27136]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "
path=
backup=

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe "=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\bf2_w32ded.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe "=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Keys Server\\sntlkeyssrvr.exe "=
"c:\\Program Files\\Xfire\\xfire.exe "=
"c:\\Program Files\\Azureus\\Azureus.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
"c:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\TortoiseSVN\\bin\\TortoiseMerge.exe "=
"c:\\Program Files\\TortoiseSVN\\bin\\TortoiseIDiff.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\IEPro\\MiniDM.exe "=
"c:\\Program Files\\mIRC\\mirc.exe "=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe "=
"c:\\Steam\\steamapps\\smithno13\\garrysmod\\hl2.exe "=
"c:\\Steam\\steamapps\\smithno13\\team fortress 2\\hl2.exe "=
"c:\\Steam\\steamapps\\smithno13\\half-life 2 deathmatch\\hl2.exe "=
"c:\\Steam\\Steam.exe "=
"c:\\Program Files\\AIM6\\aim6.exe "=
"c:\\Documents and Settings\\Compaq_Owner\\My Documents\\OpenLieroX_0.57_beta8.win32\\OpenLieroX\\OpenLieroX.exe "=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe "=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe "=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe "=
"c:\\Soldat\\Soldat.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Steam\\steamapps\\smithno13\\counter-strike source\\hl2.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe "=
"c:\\WINDOWS\\system32\\dpvsetup.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Steam\\steamapps\\smithno13\\synergy\\hl2.exe "=
"c:\\WINDOWS\\system32\\PnkBstrA.exe "=
"c:\\WINDOWS\\system32\\PnkBstrB.exe "=
"c:\\Program Files\\GameSpy\\Comrade\\Comrade.exe "=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe "=
"c:\\Program Files\\Zachtronics Industries\\Infiniminer2\\InfiniminerServer.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56182:TCP "= 56182:TCPando Media Booster
"56182:UDP "= 56182:UDPando Media Booster

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1/12/2009 9:03 PM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/12/2009 9:03 PM 20560]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [4/27/2007 2:00 AM 316992]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [3/22/2005 7:17 PM 450400]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 5:06 AM 21632]
S2 gupdate1c99b99b8455d68;Google Update Service (gupdate1c99b99b8455d68);c:\program files\Google\Update\GoogleUpdate.exe [3/2/2009 7:48 PM 133104]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [1/11/2009 9:18 PM 38160]
S3 Revolution1;Revolution1;\??\c:\documents and settings\Compaq_Owner\My Documents\Program Files\SHAK3.sys --> c:\documents and settings\Compaq_Owner\My Documents\Program Files\SHAK3.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408]
S3 XDva288;XDva288;\??\c:\windows\system32\XDva288.sys --> c:\windows\system32\XDva288.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-09-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2009-09-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 23:36]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 00:47]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 00:47]

2009-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3118088493-1253333802-4265547694-1008Core.job
- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-11 13:51]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3118088493-1253333802-4265547694-1008UA.job
- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-11 13:51]

2009-09-05 c:\windows\Tasks\HP Usg Daily FY04.job
- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped06.exe [2008-08-31 05:09]

2009-09-04 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]

2009-09-05 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]

2009-09-03 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
- - - - ORPHANS REMOVED - - - -

BHO-{e034bd20-a18d-4bae-ba3f-ae458a524a8f} - c:\windows\system32\pobeziwo.dll
SharedTaskScheduler-{d44d5b14-2e6f-40b1-90f6-d4c67f347d93} - c:\windows\system32\yofiyajo.dll
SSODL-nelabuduf-{d44d5b14-2e6f-40b1-90f6-d4c67f347d93} - c:\windows\system32\yofiyajo.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
Handler: navnet - {AD6E5643-7B0C-46AA-95AD-9773FF2A857A} - c:\program files\NavNetApp\ComUtilities.dll
DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://202.213.247.128/kxhcm10.ocx
DPF: {377FF862-62E0-4F33-B6E5-F58E0BC0F209} - hxxp://login.hanbiton.com/cab/NLSnSSO.cab
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} - hxxp://www.yoyogames.com/downloads/activex/YoYo.cab
DPF: {C4F22FDF-697D-4925-A566-FC9CD1CEBD37} - hxxp://www.magnificentgizmosandgadgets.com/ActiveX/methodloader.cab
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\ob6msbu7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - gaiaonline.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\ob6msbu7.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft Silverlight\3.0.40723.0\npctrl.1.0.21115.0.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 00:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3118088493-1253333802-4265547694-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?? "=hex:65,a0,f0,03,fa,d2,c9,64,d2,bd,d6,3f,e1,8d,b5,f8,4f,9c,18,c4,43,56,64,
51,de,56,ac,33,a8,15,4c,91,b4,1b,da,37,d8,ef,d4,3f,94,c3,1a,25,ad,a4,d7,94,\
"?? "=hex:3f,eb,b2,a8,d5,51,4b,c2,1b,01,ec,08,0f,18,11,95

[HKEY_USERS\S-1-5-21-3118088493-1253333802-4265547694-1008\Software\SecuROM\License information*]
"datasecu "=hex:9e,14,98,85,c3,f0,e5,6c,ad,42,2c,67,00,38,2d,61,14,e6,0b,21,00,
c0,95,14,70,38,48,ef,7c,72,9e,0d,d4,7e,de,24,31,ab,d4,0a,b3,fe,1a,9b,ee,e6,\
"rkeysecu "=hex:3c,94,65,d3,99,03,c4,f4,c1,34,7a,38,01,8c,68,cd
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(644)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(2312)
c:\program files\RocketDock\RocketDock.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\ImgUtil.dll
c:\windows\system32\pngfilt.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Microsoft Office\Office10\msohev.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\program files\AIM6\aolsoftware.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2009-09-05 1:26 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-05 06:26
ComboFix2.txt 2009-07-29 03:59

Pre-Run: 13,255,843,840 bytes free
Post-Run: 13,779,558,400 bytes free

471 --- E O F --- 2009-09-04 08:00

 

ComboFix 09-09-04.02 - Compaq_Owner 09/05/2009 13:01.9.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.3070.2423 [GMT -5:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\c87rty43.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090904-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"c:\documents and settings\All Users\Application Data\1bd1132a.dat "
"C:\emxtqjit.exe "
"C:\hpbyv.exe "
"c:\windows\system32\wingenocx.dll "
"c:\windows\system32\XDva288.sys "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\COMPAQ~1\LOCALS~1\Temp\detectlib1604.dll
c:\documents and settings\All Users\Application Data\1bd1132a.dat
c:\documents and settings\Compaq_Owner\Local Settings\temp\detectlib1604.dll
C:\emxtqjit.exe
C:\hpbyv.exe
c:\program files\Protection System
c:\program files\Protection System\blacklist.cga
c:\program files\Protection System\core.cga
c:\program files\Protection System\coreext.dll
c:\program files\Protection System\firewall.dll
c:\program files\Protection System\help.ico
c:\program files\Protection System\psystem.exe
c:\program files\Protection System\Thumbs.db
c:\program files\Protection System\uninstall.exe
c:\windows\system32\wingenocx.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_XDVA288
-------\Service_XDva288


((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
.

2009-09-03 20:34 . 2009-09-03 20:34 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Rainmeter
2009-09-03 20:34 . 2009-09-03 20:34 -------- d-----w- c:\program files\Rainmeter
2009-08-27 22:41 . 2009-08-27 22:46 -------- d-----w- c:\program files\RocketDock
2009-08-25 03:00 . 2009-08-25 03:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2009-08-25 02:58 . 2009-09-02 08:08 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-08-25 01:48 . 2009-08-25 01:48 -------- d-----w- c:\program files\Microsoft SQL Server
2009-08-25 01:48 . 2009-08-25 01:48 -------- d-----w- c:\program files\Microsoft Synchronization Services
2009-08-25 01:48 . 2009-08-25 01:48 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-08-25 01:44 . 2009-08-25 01:48 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
2009-08-25 01:43 . 2009-08-25 01:43 -------- d-----w- c:\program files\Microsoft SDKs
2009-08-21 03:40 . 2009-08-21 03:40 -------- d-----w- c:\program files\NavNetApp
2009-08-18 21:27 . 2009-08-18 21:27 -------- d-----w- c:\program files\Microsoft XNA
2009-08-18 21:26 . 2009-08-24 20:39 -------- d-----w- c:\program files\Zachtronics Industries
2009-08-18 03:01 . 2009-08-18 03:01 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-18 03:01 . 2009-08-18 03:01 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-18 03:01 . 2009-08-18 03:01 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\SUPERAntiSpyware.com
2009-08-17 06:12 . 2009-08-17 06:12 -------- d-----w- C:\Nexon
2009-08-17 04:52 . 2009-08-17 05:54 1284710929 ----a-w- c:\program files\MSSetupv74.exe
2009-08-17 04:49 . 2009-08-20 01:14 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\PMB Files
2009-08-17 04:49 . 2009-08-17 04:50 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2009-08-17 04:48 . 2009-08-17 04:48 -------- d-----w- c:\program files\Pando Networks
2009-08-16 21:36 . 2009-08-16 21:36 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\GarageGames
2009-08-14 02:47 . 2009-08-14 02:47 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\GameSpy
2009-08-14 02:35 . 2009-08-14 02:35 -------- d-----w- c:\program files\GameSpy
2009-08-14 02:33 . 2009-08-14 02:33 669184 ----a-w- c:\windows\system32\pbsvc.exe
2009-08-12 08:02 . 2009-08-12 08:02 -------- d-----w- c:\windows\ServicePackFiles
2009-08-12 05:53 . 2009-08-12 05:53 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\.minecraft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 05:15 . 2009-02-05 03:47 55808 ------w- c:\windows\system32\eventlog.dll
2009-09-05 04:30 . 2009-01-12 02:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-04 20:14 . 2007-12-24 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-09-04 19:30 . 2006-09-26 02:43 -------- d-----w- c:\program files\Google
2009-09-01 06:32 . 2008-01-06 22:29 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\gtk-2.0
2009-08-25 02:52 . 2008-04-08 21:29 -------- d-----w- c:\program files\Electronic Arts
2009-08-25 02:02 . 2008-06-08 03:22 -------- d-----w- c:\program files\Wallbusters
2009-08-25 01:48 . 2008-01-25 05:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-21 03:37 . 2009-02-24 06:07 -------- d-----w- c:\program files\NavNet
2009-08-20 03:19 . 2009-07-23 01:49 -------- d-----w- c:\program files\axhslt
2009-08-18 03:00 . 2007-11-28 16:44 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-17 03:41 . 2008-07-19 19:17 34 ----a-w- c:\documents and settings\Compaq_Owner\jagex_runescape_preferences.dat
2009-08-14 06:32 . 2008-06-11 01:27 -------- d-----w- c:\program files\Corcrop
2009-08-14 02:59 . 2009-06-10 03:40 -------- d-----w- c:\program files\ManyCam 2.4
2009-08-14 02:59 . 2008-07-30 00:05 -------- d-----w- c:\program files\MagicISO
2009-08-14 02:59 . 2007-08-27 04:19 -------- d-----w- c:\program files\LimeWire
2009-08-14 02:59 . 2008-06-08 17:49 -------- d-----w- c:\program files\Modulobe
2009-08-14 02:59 . 2008-05-26 15:53 -------- d-----w- c:\program files\Wake up News
2009-08-14 02:59 . 2006-08-01 18:50 -------- d-----w- c:\program files\Microsoft Works
2009-08-14 02:59 . 2006-11-30 22:48 -------- d-----w- c:\program files\ShortKeys2
2009-08-14 02:58 . 2008-07-31 01:51 -------- d-----w- c:\program files\YouTube Downloader
2009-08-14 02:45 . 2006-09-25 03:17 66288 ----a-w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-14 02:34 . 2009-08-14 02:34 22328 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\PnkBstrK.sys
2009-08-14 02:34 . 2007-12-25 23:28 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-08-14 02:33 . 2007-12-25 23:27 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-08-14 02:33 . 2007-12-25 23:26 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-08-14 01:41 . 2007-05-13 03:07 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Azureus
2009-08-13 01:20 . 2009-06-13 05:49 -------- d-----w- c:\program files\Hotspot Shield
2009-08-12 22:05 . 2009-03-24 22:25 -------- d-----w- c:\program files\AIMTunes
2009-08-12 04:50 . 2008-08-27 22:01 -------- d-----w- c:\program files\RegCure
2009-08-11 21:36 . 2007-05-13 03:06 -------- d-----w- c:\program files\Azureus
2009-08-11 19:15 . 2009-08-01 22:52 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Mumble
2009-08-08 18:58 . 2008-01-08 04:35 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-05 09:11 . 2009-02-05 03:47 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 18:36 . 2009-01-12 02:18 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 18:36 . 2009-01-12 02:18 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-01 22:52 . 2009-08-01 22:52 -------- d-----w- c:\program files\Mumble
2009-07-30 02:00 . 2007-01-12 04:40 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Viewpoint
2009-07-30 02:00 . 2006-09-25 02:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-30 02:00 . 2006-09-25 02:17 -------- d-----w- c:\program files\Viewpoint
2009-07-30 01:56 . 2009-05-24 17:31 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-30 01:56 . 2009-07-30 01:56 -------- d-----w- c:\program files\Java
2009-07-29 13:51 . 2008-12-22 22:45 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\renamed
2009-07-26 23:54 . 2007-08-20 23:04 -------- d-----w- c:\program files\MSN Messenger
2009-07-26 23:54 . 2008-08-10 03:48 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-24 03:24 . 2009-07-24 03:24 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\CBL-Electronics
2009-07-24 03:22 . 2009-07-24 03:22 -------- d-----w- c:\documents and settings\All Users\Application Data\CBL-Electronics
2009-07-24 03:22 . 2009-07-24 03:22 -------- d-----w- c:\program files\Common Files\cbl electronics shared
2009-07-24 03:22 . 2009-07-24 03:22 -------- d-----w- c:\program files\cbl electronics inc
2009-07-24 03:21 . 2009-07-24 03:21 -------- d-----w- c:\program files\DS-MP3 Source
2009-07-24 03:17 . 2009-07-24 03:17 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-07-24 03:16 . 2009-07-24 03:16 -------- d-----w- c:\program files\AVS4YOU
2009-07-24 03:16 . 2009-07-24 03:16 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-24 03:16 . 2009-07-24 03:16 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\AVS4YOU
2009-07-23 23:48 . 2009-07-21 03:45 -------- d-----w- c:\program files\Operation Cleaner 2
2009-07-23 20:43 . 2008-06-12 23:15 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Winamp
2009-07-23 17:25 . 2009-06-04 17:01 -------- d-----w- c:\program files\mIRC
2009-07-22 06:03 . 2009-07-22 06:02 -------- d-----w- c:\program files\Universe Sandbox
2009-07-22 05:55 . 2009-07-22 05:55 -------- d-----w- c:\program files\RocketScientists.dk
2009-07-22 01:52 . 2008-11-09 06:49 -------- d-----w- c:\program files\Gaia Online Toolbar
2009-07-22 01:52 . 2009-01-19 20:03 -------- d-----w- c:\program files\AGEIA Technologies
2009-07-21 23:36 . 2008-09-05 04:47 -------- d-----w- c:\program files\DivX
2009-07-21 23:36 . 2009-06-02 15:43 -------- d-----w- c:\program files\Chains
2009-07-21 23:36 . 2007-07-22 18:42 -------- d-----w- c:\program files\BitZip
2009-07-21 23:36 . 2006-08-01 19:02 -------- d-----w- c:\program files\PC-Doctor 5 for Windows
2009-07-21 23:35 . 2009-05-29 19:14 -------- d-----w- c:\program files\Windows Media Connect 2
2009-07-17 18:55 . 2009-02-05 03:48 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2004-08-04 11:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 09:28 . 2008-06-11 21:30 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\mIRC
2009-07-09 06:16 . 2007-02-01 22:34 -------- d-----w- c:\program files\AIM6
2009-07-09 05:13 . 2009-01-13 08:05 -------- d-----w- c:\program files\trend micro
2009-07-08 03:05 . 2006-12-08 23:25 -------- d-----w- c:\program files\QuickTime
2009-07-08 03:05 . 2008-05-11 05:44 -------- d-----w- c:\program files\Common Files\Apple
2009-06-25 08:44 . 2009-02-05 03:47 298496 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:44 . 2009-02-05 03:47 56320 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2009-02-05 03:46 59392 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2009-02-05 03:46 724480 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2009-02-05 03:46 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:44 . 2009-02-05 03:46 168448 ----a-w- c:\windows\system32\schannel.dll
2009-06-22 11:34 . 2009-02-05 03:46 92544 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:55 . 2009-02-05 03:47 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2009-02-05 03:47 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 11:50 . 2009-02-05 03:47 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:21 . 2009-02-05 03:48 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:32 . 2009-02-05 03:46 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-09 21:25 . 2009-06-09 21:25 11861 ----a-w- c:\windows\system32\drivers\mdc8021x.sys
2008-06-20 21:19 . 2008-06-20 21:19 124821 ----a-w- c:\program files\Crates.rar
2008-05-08 21:32 . 2008-05-08 21:32 390 ----a-w- c:\program files\Shortcut to Program Files.lnk
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-05_05.48.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-05 18:17 . 2009-09-05 18:17 16384 c:\windows\Temp\Perflib_Perfdata_10c.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-31 07:03 . 2009-03-24 22:27 172 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\bci.png

2008-08-31 07:03 . 2009-03-24 22:27 195 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\bcir.png

2008-08-31 07:03 . 2009-03-24 22:27 350 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\cswall.png

2008-08-31 07:03 . 2009-03-24 22:27 6078 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\Dshield.png

2008-08-31 07:03 . 2009-03-24 22:27 255 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\heal2.png

2008-08-31 07:03 . 2009-03-24 22:27 236 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\mbtsfall.png

2008-08-31 07:03 . 2009-03-24 22:27 5758 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\mirrors.png

2008-08-31 07:03 . 2009-03-24 22:27 12320 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\thick4.png

2008-08-31 07:03 . 2009-03-24 22:27 1749 c:\documents and settings\Compaq_Owner\My Documents\OpenLieroX_0.57_beta8.win32\OpenLieroX\NarutoNT-1.26\gfx\bak\whirl1.png

2007-05-15 02:16 . 2007-12-04 13:00 79224 c:\program files\Alwil Software\Avast4\bak\ashDisp.exe
2007-05-15 02:16 . 2009-02-05 20:08 81000 c:\program files\Alwil Software\Avast4\ashDisp.exe

2005-02-17 13:11 . 2005-02-17 13:11 49152 c:\program files\HP\HP Software Update\bak\HPwuSchd2.exe

2007-06-13 20:21 . 2005-06-08 23:24 458752 c:\program files\Logitech\Video\bak\ISStart.exe

2007-06-13 20:21 . 2005-06-08 23:14 217088 c:\program files\Logitech\Video\bak\LogiTray.exe

2007-06-13 20:21 . 2005-06-08 22:44 196608 c:\program files\Logitech\Video\bak\ManifestEngine.exe

2006-12-08 23:25 . 2008-01-27 07:32 385024 c:\program files\QuickTime\bak\qttask.exe

2006-08-01 18:51 . 2004-12-14 09:23 663552 c:\windows\CREATOR\bak\Remind_XP.exe

2006-08-01 18:51 . 2005-07-23 05:14 237568 c:\windows\SMINST\bak\RECGUARD.EXE

2005-07-20 01:32 . 2005-07-20 01:32 221184 c:\windows\system32\bak\LVCOMSX.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B3535C18-0E70-4D4B-B36B-BBFE139BB144} "= "c:\program files\Gaia Online Toolbar\Toolbar.dll" [2008-11-09 1241088]

[HKEY_CLASSES_ROOT\clsid\{b3535c18-0e70-4d4b-b36b-bbfe139bb144}]
[HKEY_CLASSES_ROOT\FCTB000000108.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{8518B5E9-EDF5-4BDA-B5D3-4AA044EC072D}]
[HKEY_CLASSES_ROOT\FCTB000000108.IEToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{B3535C18-0E70-4D4B-B36B-BBFE139BB144} "= "c:\program files\Gaia Online Toolbar\Toolbar.dll" [2008-11-09 1241088]

[HKEY_CLASSES_ROOT\clsid\{b3535c18-0e70-4d4b-b36b-bbfe139bb144}]
[HKEY_CLASSES_ROOT\FCTB000000108.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{8518B5E9-EDF5-4BDA-B5D3-4AA044EC072D}]
[HKEY_CLASSES_ROOT\FCTB000000108.IEToolbar]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@= "{C5994560-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@= "{C5994561-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@= "{C5994562-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@= "{C5994563-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@= "{C5994564-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@= "{C5994565-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@= "{C5994566-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@= "{C5994567-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@= "{C5994568-53D9-4125-87C9-F193FC689CB2} "
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 22:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6 "= "c:\program files\AIM6\aim6.exe" [2007-10-04 50528]
"msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"DAEMON Tools Lite "= "c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-21 486856]
"Steam "= "c:\steam\steam.exe" [2009-06-12 1217784]
"ManyCam "= "c:\program files\ManyCam 2.4\ManyCam.exe" [2009-04-17 1824040]
"Comrade.exe "= "c:\program files\GameSpy\Comrade\Comrade.exe" [2007-06-29 36864]
"RocketDock "= "c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2008-07-26 86016]
"D-Link AirPlus XtremeG "= "c:\program files\D-Link\AirPlus XtremeG\AirPlusCFG.exe" [2005-03-28 1011712]
"ANIWZCS2Service "= "c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 49152]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2008-07-26 13570048]
"PCDrProfiler "=" " [N/A]
"Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]
"RTHDCPL "= "RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-07-21 16261632]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-1 27136]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "
path=
backup=

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe "=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\bf2_w32ded.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe "=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Keys Server\\sntlkeyssrvr.exe "=
"c:\\Program Files\\Xfire\\xfire.exe "=
"c:\\Program Files\\Azureus\\Azureus.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
"c:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\TortoiseSVN\\bin\\TortoiseMerge.exe "=
"c:\\Program Files\\TortoiseSVN\\bin\\TortoiseIDiff.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\IEPro\\MiniDM.exe "=
"c:\\Program Files\\mIRC\\mirc.exe "=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe "=
"c:\\Steam\\steamapps\\smithno13\\garrysmod\\hl2.exe "=
"c:\\Steam\\steamapps\\smithno13\\team fortress 2\\hl2.exe "=
"c:\\Steam\\steamapps\\smithno13\\half-life 2 deathmatch\\hl2.exe "=
"c:\\Steam\\Steam.exe "=
"c:\\Program Files\\AIM6\\aim6.exe "=
"c:\\Documents and Settings\\Compaq_Owner\\My Documents\\OpenLieroX_0.57_beta8.win32\\OpenLieroX\\OpenLieroX.exe "=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe "=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe "=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe "=
"c:\\Soldat\\Soldat.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Steam\\steamapps\\smithno13\\counter-strike source\\hl2.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe "=
"c:\\WINDOWS\\system32\\dpvsetup.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Steam\\steamapps\\smithno13\\synergy\\hl2.exe "=
"c:\\WINDOWS\\system32\\PnkBstrA.exe "=
"c:\\WINDOWS\\system32\\PnkBstrB.exe "=
"c:\\Program Files\\GameSpy\\Comrade\\Comrade.exe "=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe "=
"c:\\Program Files\\Zachtronics Industries\\Infiniminer2\\InfiniminerServer.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56182:TCP "= 56182:TCPando Media Booster
"56182:UDP "= 56182:UDPando Media Booster

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1/12/2009 9:03 PM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/12/2009 9:03 PM 20560]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [4/27/2007 2:00 AM 316992]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [3/22/2005 7:17 PM 450400]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 5:06 AM 21632]
S2 gupdate1c99b99b8455d68;Google Update Service (gupdate1c99b99b8455d68);c:\program files\Google\Update\GoogleUpdate.exe [3/2/2009 7:48 PM 133104]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [1/11/2009 9:18 PM 38160]
S3 Revolution1;Revolution1;\??\c:\documents and settings\Compaq_Owner\My Documents\Program Files\SHAK3.sys --> c:\documents and settings\Compaq_Owner\My Documents\Program Files\SHAK3.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-09-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2009-09-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 23:36]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 00:47]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 00:47]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3118088493-1253333802-4265547694-1008Core.job
- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-11 13:51]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3118088493-1253333802-4265547694-1008UA.job
- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-11 13:51]

2009-09-05 c:\windows\Tasks\HP Usg Daily FY04.job
- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped06.exe [2008-08-31 05:09]

2009-09-05 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]

2009-09-05 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]

2009-09-03 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
Handler: navnet - {AD6E5643-7B0C-46AA-95AD-9773FF2A857A} - c:\program files\NavNetApp\ComUtilities.dll
DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://202.213.247.128/kxhcm10.ocx
DPF: {377FF862-62E0-4F33-B6E5-F58E0BC0F209} - hxxp://login.hanbiton.com/cab/NLSnSSO.cab
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} - hxxp://www.yoyogames.com/downloads/activex/YoYo.cab
DPF: {C4F22FDF-697D-4925-A566-FC9CD1CEBD37} - hxxp://www.magnificentgizmosandgadgets.com/ActiveX/methodloader.cab
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\ob6msbu7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - gaiaonline.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 13:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3118088493-1253333802-4265547694-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?? "=hex:65,a0,f0,03,fa,d2,c9,64,d2,bd,d6,3f,e1,8d,b5,f8,4f,9c,18,c4,43,56,64,
51,de,56,ac,33,a8,15,4c,91,b4,1b,da,37,d8,ef,d4,3f,94,c3,1a,25,ad,a4,d7,94,\
"?? "=hex:3f,eb,b2,a8,d5,51,4b,c2,1b,01,ec,08,0f,18,11,95

[HKEY_USERS\S-1-5-21-3118088493-1253333802-4265547694-1008\Software\SecuROM\License information*]
"datasecu "=hex:9e,14,98,85,c3,f0,e5,6c,ad,42,2c,67,00,38,2d,61,14,e6,0b,21,00,
c0,95,14,70,38,48,ef,7c,72,9e,0d,d4,7e,de,24,31,ab,d4,0a,b3,fe,1a,9b,ee,e6,\
"rkeysecu "=hex:3c,94,65,d3,99,03,c4,f4,c1,34,7a,38,01,8c,68,cd
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(636)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(2976)
c:\program files\RocketDock\RocketDock.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\ImgUtil.dll
c:\windows\system32\pngfilt.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\xpsp3res.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\program files\AIM6\aolsoftware.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2009-09-05 13:47 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-05 18:47
ComboFix2.txt 2009-09-05 06:26
ComboFix3.txt 2009-07-29 03:59

Pre-Run: 13,780,697,088 bytes free
Post-Run: 13,706,858,496 bytes free

449 --- E O F --- 2009-09-05 08:00

 

My Realtek HD Audio Manager seems to be thinking I am plugging something in, it keeps asking what I have plugged into the front port. Nothing is plugged in. It keeps popping up.
Here is the HJT log.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:39:50 PM, on 9/5/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\steam\steam.exe
C:\Program Files\ManyCam 2.4\ManyCam.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Compaq_Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O3 - Toolbar: Gaia Online Toolbar - {B3535C18-0E70-4D4B-B36B-BBFE139BB144} - C:\Program Files\Gaia Online Toolbar\Toolbar.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Steam] "c:\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ManyCam] "C:\Program Files\ManyCam 2.4\ManyCam.exe "
O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe "
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KXHCM10 Control) - http://202.213.247.128/kxhcm10.ocx
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {377FF862-62E0-4F33-B6E5-F58E0BC0F209} (NlsComm Component Class) - http://login.hanbiton.com/cab/NLSnSSO.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.7.109.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio2/downloads/sysinfo.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - http://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (BL_Camera) - http://67.154.21.186:8002/bl_camera.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - http://www.yoyogames.com/downloads/activex/YoYo.cab
O16 - DPF: {C4F22FDF-697D-4925-A566-FC9CD1CEBD37} (Method ActiveX Game Loader) - http://www.magnificentgizmosandgadgets.com/ActiveX/methodloader.cab
O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab
O18 - Protocol: navnet - {AD6E5643-7B0C-46AA-95AD-9773FF2A857A} - C:\Program Files\NavNetApp\ComUtilities.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c99b99b8455d68) (gupdate1c99b99b8455d68) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sentinel Keys Server (SentinelKeysServer) - SafeNet, Inc. - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: Windows Defender (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe

--
End of file - 12367 bytes

 

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/05/2009 at 11:02 PM

Application Version : 4.27.1002

Core Rules Database Version : 4086
Trace Rules Database Version: 2026

Scan type : Complete Scan
Total Scan Time : 05:31:58

Memory items scanned : 228
Memory threats detected : 0
Registry items scanned : 6897
Registry threats detected : 0
File items scanned : 339022
File threats detected : 20

Rogue.ProtectionSystem
C:\Documents and Settings\All Users\Start Menu\Programs\Protection System\Protection System Support.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Protection System\Protection System.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Protection System\Uninstall Protection System.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Protection System
C:\Documents and Settings\All Users\Desktop\Protection System.lnk
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\PROTECTION SYSTEM\PSYSTEM.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP739\A0211314.EXE

Trojan.Agent/Gen-FakeSpy[4]
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\MOVED\A0207506.EXE.VIR

Rogue.Agent/Gen-ProtectionSystem[Core]
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\PROTECTION SYSTEM\COREEXT.DLL.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP739\A0211311.DLL

Rogue.Agent/Gen-ProtectionSystem[Uninstall]
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\PROTECTION SYSTEM\UNINSTALL.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP739\A0211315.EXE

Trojan.Agent/Gen
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\UACJOAIOEVVBX.DLL.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211056.DLL

Trojan.Agent/Gen-Loader
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\~.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211091.EXE

Adware.Vundo/Variant-[Fixed]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211092.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211094.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211095.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211097.DLL


Next step, MBAM. I will run it and leave it overnight.

 

Malwarebytes' Anti-Malware 1.40
Database version: 2746
Windows 5.1.2600 Service Pack 2

9/6/2009 9:16:24 AM
mbam-log-2009-09-06 (09-16-24).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 505810
Time elapsed: 5 hour(s), 47 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\fyblb.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACodfqxaoljv.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wisdstr.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211058.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211087.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP737\A0211098.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\My Documents\Program Files\cortex command\THETA.nfo.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Desktop\Protection System Support.lnk (Rogue.Link) -> Quarantined and deleted successfully.

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:28:55 AM, on 9/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\steam\steam.exe
C:\Program Files\ManyCam 2.4\ManyCam.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Compaq_Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O3 - Toolbar: Gaia Online Toolbar - {B3535C18-0E70-4D4B-B36B-BBFE139BB144} - C:\Program Files\Gaia Online Toolbar\Toolbar.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Steam] "c:\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ManyCam] "C:\Program Files\ManyCam 2.4\ManyCam.exe "
O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe "
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KXHCM10 Control) - http://202.213.247.128/kxhcm10.ocx
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {377FF862-62E0-4F33-B6E5-F58E0BC0F209} (NlsComm Component Class) - http://login.hanbiton.com/cab/NLSnSSO.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.7.109.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio2/downloads/sysinfo.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - http://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (BL_Camera) - http://67.154.21.186:8002/bl_camera.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - http://www.yoyogames.com/downloads/activex/YoYo.cab
O16 - DPF: {C4F22FDF-697D-4925-A566-FC9CD1CEBD37} (Method ActiveX Game Loader) - http://www.magnificentgizmosandgadgets.com/ActiveX/methodloader.cab
O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab
O18 - Protocol: navnet - {AD6E5643-7B0C-46AA-95AD-9773FF2A857A} - C:\Program Files\NavNetApp\ComUtilities.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c99b99b8455d68) (gupdate1c99b99b8455d68) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sentinel Keys Server (SentinelKeysServer) - SafeNet, Inc. - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: Windows Defender (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe

--
End of file - 12275 bytes