Solved Trojan/DLL errors/ DEP error?

[Resolved] Trojan/DLL errors/ DEP error?

I have run a few scans, cc cleaner avg, ad aware and they cant seem to fully get rid of my problem. At the moment I am kind of at a loss as to what to do.

I get a few DLL errors on start-up along with some kind of DEP error.

I am also getting a few Trojan warnings.

It came from a file that was not supposed to get downloaded.

Here are the reports.

Thank you for any help you can give me with these problems and ill try to get what information i can.

I hope the infomration is listed corectly.

DDS (Ver_10-03-17.01) - NTFSx86
Run by Eric at 7:54:28.06 on Sat 07/24/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2558.1242 [GMT -6:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Documents and Settings\Eric\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5643
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [ManyCam] "c:\program files\manycam 2.4\ManyCam.exe "
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Aim6]
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [GEST] =
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [36X Raid Configurer] c:\windows\system32\xRaidSetup.exe boot
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe "
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [sta] rundll32 "krwup.dll ",,Run
mRun: [Xxowibu] rundll32.exe "c:\windows\ofirezuqah.dll ",Startup
StartupFolder: c:\docume~1\eric\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\1.0.150\SSScheduler.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1228586308328
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: avgrsstarter - avgrsstx.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe "

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\eric\applic~1\mozilla\firefox\profiles\qccgyw7e.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: XULRunner: {E3F9D99E-11B2-4A2D-8FAE-DCC443341E30} - c:\documents and settings\eric\local settings\application data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-1-21 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-6 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-12-6 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-6 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-12-6 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-12-6 297752]
R2 GEST Service;GEST Service for program management.;c:\program files\gigabyte\energysaver\GSvr.exe [2008-1-1 80392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 1029456]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [2006-11-8 16384]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [2006-11-8 37888]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-9-18 24652]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632]
R3 QCEmerald;Logitech QuickCam Web;c:\windows\system32\drivers\OVCE.sys [2009-1-10 31872]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-4-6 23064]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [2006-11-30 91648]
S2 gupdate1c98b9e492bc54e;Google Update Service (gupdate1c98b9e492bc54e);c:\program files\google\update\GoogleUpdate.exe [2009-2-10 133104]
S3 cpuz132;cpuz132;\??\c:\docume~1\eric\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\eric\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 UBFWNet;Unibrain 1394 FireNet Adapter NT Driver;c:\windows\system32\drivers\ubfwnet.sys [2006-12-5 24576]

=============== Created Last 30 ================

2010-07-21 21:43:43 0 d-----w- c:\program files\CCleaner
2010-07-21 21:33:05 0 d-----w- c:\program files\Perfect Optimizer
2010-07-21 18:13:19 120 ----a-w- c:\windows\Ywivigoreye.dat
2010-07-21 18:13:19 0 ----a-w- c:\windows\Idirilila.bin
2010-07-21 07:21:11 2804 ----a-w- c:\windows\esaxugesavad.dll
2010-07-21 04:30:56 0 d-----w- c:\docume~1\eric\applic~1\Street-Ads
2010-07-21 04:30:55 0 d-----w- c:\docume~1\eric\applic~1\Sky-Banners
2010-07-21 04:30:31 150 ----a-w- C:\zrpt.xml
2010-07-21 04:30:30 768000 ----a-w- c:\windows\system32\drivers\zfofr.sys
2010-07-21 04:29:42 0 d-----w- c:\docume~1\eric\applic~1\909BEF17AD3452D3055F0A06B15325E0

==================== Find3M ====================

2010-07-23 17:05:27 16608 ----a-w- c:\windows\gdrv.sys
2010-05-06 10:41:53 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys

============= FINISH: 7:55:40.48 ===============







UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 12/5/2008 1:03:00 PM
System Uptime: 7/23/2010 11:04:07 AM (20 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | EP45-UD3P
Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2400/266mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 466 GiB total, 22.64 GiB free.
D: is CDROM (UDF)
E: is CDROM ()
G: is FIXED (FAT32) - 931 GiB total, 1.499 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Unibrain 1394 FireNet Adapter
Device ID: UB1394\UNIBRAIN&1394_PC\007C8EA200001FD0
Manufacturer: Unibrain
Name: Unibrain 1394 FireNet Adapter
PNP Device ID: UB1394\UNIBRAIN&1394_PC\007C8EA200001FD0
Service: UBFWNet

==== System Restore Points ===================

RP513: 4/25/2010 12:25:11 PM - System Checkpoint
RP514: 4/26/2010 12:36:00 PM - System Checkpoint
RP515: 4/27/2010 1:24:01 PM - System Checkpoint
RP516: 4/28/2010 2:25:11 PM - System Checkpoint
RP517: 4/29/2010 2:36:19 PM - System Checkpoint
RP518: 4/30/2010 3:24:23 PM - System Checkpoint
RP519: 5/1/2010 3:36:23 PM - System Checkpoint
RP520: 5/2/2010 4:24:23 PM - System Checkpoint
RP521: 5/3/2010 5:36:26 PM - System Checkpoint
RP522: 5/4/2010 8:52:41 PM - System Checkpoint
RP523: 5/5/2010 9:36:25 PM - System Checkpoint
RP524: 5/7/2010 6:48:25 PM - System Checkpoint
RP525: 5/8/2010 9:17:09 PM - System Checkpoint
RP526: 5/9/2010 9:36:35 PM - System Checkpoint
RP527: 5/10/2010 10:36:36 PM - System Checkpoint
RP528: 5/12/2010 12:27:49 AM - System Checkpoint
RP529: 5/12/2010 3:00:13 AM - Software Distribution Service 3.0
RP530: 5/13/2010 3:37:05 AM - System Checkpoint
RP531: 5/14/2010 4:37:02 AM - System Checkpoint
RP532: 5/14/2010 8:37:32 AM - Removed Ask Toolbar.
RP533: 5/14/2010 8:37:49 AM - Removed Ask Toolbar.
RP534: 5/15/2010 9:37:02 AM - System Checkpoint
RP535: 5/16/2010 10:37:02 AM - System Checkpoint
RP536: 5/18/2010 6:47:17 AM - System Checkpoint
RP537: 5/19/2010 6:58:53 AM - System Checkpoint
RP538: 5/20/2010 12:25:23 PM - System Checkpoint
RP539: 5/21/2010 12:57:05 PM - System Checkpoint
RP540: 5/22/2010 1:45:06 PM - System Checkpoint
RP541: 5/23/2010 2:45:05 PM - System Checkpoint
RP542: 5/24/2010 3:45:05 PM - System Checkpoint
RP543: 5/26/2010 3:00:21 AM - Software Distribution Service 3.0
RP544: 5/27/2010 8:39:07 AM - System Checkpoint
RP545: 5/28/2010 9:28:44 AM - Installed League of Legends
RP546: 5/30/2010 1:39:43 PM - System Checkpoint
RP547: 5/31/2010 5:47:03 PM - System Checkpoint
RP548: 6/1/2010 9:13:06 AM - Installed League of Legends
RP549: 6/2/2010 4:18:15 PM - System Checkpoint
RP550: 6/3/2010 4:39:54 PM - System Checkpoint
RP551: 6/4/2010 3:00:12 AM - Software Distribution Service 3.0
RP552: 6/5/2010 8:07:19 PM - System Checkpoint
RP553: 6/7/2010 11:25:10 PM - System Checkpoint
RP554: 6/9/2010 4:19:14 AM - System Checkpoint
RP555: 6/10/2010 5:07:48 AM - System Checkpoint
RP556: 6/11/2010 5:55:48 AM - System Checkpoint
RP557: 6/12/2010 3:00:30 AM - Software Distribution Service 3.0
RP558: 6/13/2010 4:01:25 AM - System Checkpoint
RP559: 6/14/2010 7:14:02 AM - System Checkpoint
RP560: 6/15/2010 11:29:02 AM - System Checkpoint
RP561: 6/16/2010 1:14:23 PM - System Checkpoint
RP562: 6/17/2010 1:35:16 PM - System Checkpoint
RP563: 6/18/2010 1:41:09 PM - System Checkpoint
RP564: 6/19/2010 3:00:16 PM - System Checkpoint
RP565: 6/21/2010 7:32:33 AM - System Checkpoint
RP566: 6/22/2010 8:37:43 AM - Avg8 Update
RP567: 6/23/2010 8:38:04 AM - System Checkpoint
RP568: 6/24/2010 3:00:19 AM - Software Distribution Service 3.0
RP569: 6/25/2010 11:47:50 AM - System Checkpoint
RP570: 6/26/2010 2:14:40 PM - System Checkpoint
RP571: 6/27/2010 2:37:38 PM - System Checkpoint
RP572: 6/28/2010 8:08:26 PM - System Checkpoint
RP573: 6/30/2010 12:13:02 PM - System Checkpoint
RP574: 7/1/2010 12:39:17 PM - System Checkpoint
RP575: 7/2/2010 1:27:19 PM - System Checkpoint
RP576: 7/3/2010 7:58:24 PM - System Checkpoint
RP577: 7/4/2010 9:44:10 PM - System Checkpoint
RP578: 7/6/2010 1:23:45 AM - System Checkpoint
RP579: 7/7/2010 4:18:49 AM - System Checkpoint
RP580: 7/8/2010 7:20:43 AM - System Checkpoint
RP581: 7/9/2010 8:13:22 AM - Avg8 Update
RP582: 7/9/2010 8:14:20 AM - Avg8 Update
RP583: 7/10/2010 8:31:36 AM - System Checkpoint
RP584: 7/11/2010 9:25:49 AM - System Checkpoint
RP585: 7/12/2010 4:36:15 PM - System Checkpoint
RP586: 7/14/2010 7:45:08 AM - System Checkpoint
RP587: 7/15/2010 3:00:14 AM - Software Distribution Service 3.0
RP588: 7/16/2010 3:22:04 AM - System Checkpoint
RP589: 7/17/2010 10:31:22 AM - System Checkpoint
RP590: 7/18/2010 2:14:58 PM - System Checkpoint
RP591: 7/19/2010 4:29:45 PM - System Checkpoint
RP592: 7/20/2010 4:34:17 PM - System Checkpoint
RP593: 7/21/2010 5:49:12 PM - System Checkpoint
RP594: 7/22/2010 9:35:14 PM - System Checkpoint
RP595: 7/24/2010 12:01:41 AM - System Checkpoint

==== Installed Programs ======================

µTorrent
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.3
AIM 6
Apple Mobile Device Support
Apple Software Update
AVG Free 8.5
BioShock 2
Bonjour
Browser Configuration Utility
Call of Duty(R) 4 - Modern Warfare(TM)
CCleaner
Command & Conquerâ„¢ Red Alertâ„¢ 3
Continuum 0.40
Crysis WARHEAD(R)
Driver Detective
DVD Flick 1.3.0.6
Energy Saver Advance B8.0905.1
Freelancer
GameSpy Arcade
Gigabyte Raid Configurer
Google Earth
Google Update Helper
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
iTunes
Java(TM) 6 Update 17
League of Legends
LightScribe System Software 1.10.27.1
LimeWire 5.5.8
Magic Online III
ManyCam 2.4 (remove only)
McAfee Security Scan
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Game Studios Common Redistributables Pack 1
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Halo Trial
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
mIRC
MorphVOX Junior
Mozilla Firefox (3.5.11)
MSN
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Nero 8
neroxml
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA PhysX
NX
Pando Media Booster
PokerStars.net
QuickTime
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
SecondLife (remove only)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Segoe UI
Skype web features
Skypeâ„¢ 4.1
SpeedSim
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
System Requirements Lab
ubCorePro
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB898461)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Ventrilo Client
Video DVD Maker v3.19.0.42
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
WebFldrs XP
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Media Format Runtime
WinRAR archiver
World of Warcraft
Yahoo! Messenger

==== Event Viewer Messages From Past Week ========

7/23/2010 11:05:41 AM, error: Service Control Manager [7023] - The Network Security service terminated with the following error: The specified module could not be found.
7/22/2010 8:42:33 PM, error: Service Control Manager [7023] - The Network Security service terminated with the following error: Access is denied.
7/21/2010 2:19:59 AM, error: System Error [1003] - Error code 100000d1, parameter1 0000002c, parameter2 00000002, parameter3 00000001, parameter4 abdee416.
7/21/2010 2:19:12 AM, error: System Error [1003] - Error code 10000050, parameter1 e8771118, parameter2 00000000, parameter3 bd0a1033, parameter4 00000001.
7/21/2010 1:50:30 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/21/2010 1:47:44 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
7/21/2010 1:47:08 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
7/21/2010 1:41:41 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
7/21/2010 1:38:37 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX Fips intelppm IPSec lusbaudio MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
7/21/2010 1:38:37 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
7/21/2010 1:38:37 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/21/2010 1:38:37 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/21/2010 1:38:37 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
7/21/2010 1:38:37 AM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/21/2010 1:38:37 AM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

==== End Of File ===========================

 

I ran the malwareBytes program without problems. But every time i try gmer something seems to stop it. It keeps either freezing or not finishing, or i cant seem to save without it freezing.

I have tried it in safe mode with and without devices selected.
I have also tried it several times in normal mode with and without devices selected.
I am also being sure i don't touch the computer as it runs so i don't know why it wont work at the moment.

Here is the MalwareBytes scan

Again thank you for all the help!

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4345

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/24/2010 3:02:09 PM
mbam-log-2010-07-24 (15-02-09).txt

Scan type: Quick scan
Objects scanned: 139591
Time elapsed: 12 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 11
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{84c3c236-f588-4c93-84f4-147b2abbe67b} (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{38061edc-40bb-4618-a8da-e56353347e6d} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7b6a2552-e65b-4a9e-add4-c45577ffd8fd} (Adware.EZLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Sky-Banners (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Sky-Banners (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\AVSolution (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sta (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Eric\Application Data\Sky-Banners (Adware.Adrotator) -> Quarantined and deleted successfully.
C:\Documents and Settings\Eric\Application Data\Sky-Banners\skb (Adware.Adrotator) -> Quarantined and deleted successfully.
C:\Documents and Settings\Eric\Application Data\Street-Ads (Adware.Adrotator) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Application (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FirstBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FullBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Service (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Temp (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Eric\Desktop\VLCSetup.exe (Adware.HotBar) -> Quarantined and deleted successfully.
C:\Documents and Settings\Eric\Local Settings\Temp\jqylg.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\PerfectOptimizer.ini (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\certstore.dat (Trojan.Agent) -> Quarantined and deleted successfully.

 

I had no problems running Combo Fix, here is the log.

ComboFix 10-07-24.06 - Eric 07/26/2010 22:52:31.1.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2558.1917 [GMT -6:00]
Running from: c:\documents and settings\Eric\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\esaxugesavad.dll
c:\windows\ofirezuqah.dll
c:\windows\system32\driVERs\zfofr.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Service_6to4
-------\Legacy_zfofr
-------\Service_zfofr


((((((((((((((((((((((((( Files Created from 2010-06-27 to 2010-07-27 )))))))))))))))))))))))))))))))
.

2010-07-25 13:30 . 2010-07-25 13:30 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-24 21:38 . 2010-07-24 21:38 -------- d-----w- c:\program files\Common Files\Skype
2010-07-24 20:46 . 2010-07-24 20:46 -------- d-----w- c:\documents and settings\Eric\Application Data\Malwarebytes
2010-07-24 20:46 . 2010-04-29 21:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-24 20:46 . 2010-07-24 20:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-24 20:46 . 2010-04-29 21:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-24 20:46 . 2010-07-24 20:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-23 16:50 . 2010-07-27 03:13 -------- d-----w- c:\documents and settings\Eric\Application Data\vlc
2010-07-21 21:43 . 2010-07-21 21:43 -------- d-----w- c:\program files\CCleaner
2010-07-21 18:13 . 2010-07-27 03:18 17418 ----a-w- c:\windows\Ywivigoreye.dat
2010-07-21 18:13 . 2010-07-25 23:31 0 ----a-w- c:\windows\Idirilila.bin
2010-07-21 18:13 . 2010-07-21 18:13 -------- d-----w- c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}
2010-07-21 09:21 . 2010-07-21 09:21 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-07-21 07:49 . 2010-07-21 07:49 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-07-21 07:39 . 2010-07-21 07:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-07-21 07:39 . 2010-07-21 07:39 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-07-21 04:30 . 2010-07-21 07:57 -------- d-----w- c:\documents and settings\Eric\Local Settings\Application Data\wppurlluw
2010-07-21 04:29 . 2010-07-21 04:29 -------- d-----w- c:\documents and settings\Eric\Application Data\909BEF17AD3452D3055F0A06B15325E0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 05:08 . 2008-12-31 22:36 -------- d-----w- c:\documents and settings\Eric\Application Data\LimeWire
2010-07-27 05:07 . 2009-09-10 19:04 -------- d-----w- c:\documents and settings\Eric\Application Data\Skype
2010-07-27 05:02 . 2008-01-01 06:16 16608 ----a-w- c:\windows\gdrv.sys
2010-07-27 03:46 . 2009-02-10 16:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-07-27 03:19 . 2009-09-10 19:05 -------- d-----w- c:\documents and settings\Eric\Application Data\skypePM
2010-07-24 19:56 . 2010-07-24 19:56 503808 ----a-w- c:\documents and settings\Eric\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4b9e5308-n\msvcp71.dll
2010-07-24 19:56 . 2010-07-24 19:56 499712 ----a-w- c:\documents and settings\Eric\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4b9e5308-n\jmc.dll
2010-07-24 19:56 . 2010-07-24 19:56 348160 ----a-w- c:\documents and settings\Eric\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4b9e5308-n\msvcr71.dll
2010-07-23 02:52 . 2009-01-21 16:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-22 12:58 . 2008-12-06 07:54 -------- d-----w- c:\program files\World of Warcraft
2010-07-21 07:22 . 2008-12-06 08:32 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-07-21 07:06 . 2008-01-02 08:11 -------- d-----w- c:\documents and settings\Eric\Application Data\uTorrent
2010-07-13 11:54 . 2010-07-22 05:32 142986 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1033.dat
2010-07-06 16:44 . 2010-07-21 18:14 221184 ----a-w- c:\documents and settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions\browserhighlighter@ebay.com\components\Shim.dll
2010-06-22 12:43 . 2009-08-21 03:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-06-14 14:31 . 2008-12-05 19:59 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-04 14:58 . 2010-02-26 00:47 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-01 15:16 . 2010-06-01 15:16 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-06-01 15:15 . 2010-07-21 07:38 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-01 15:15 . 2010-06-01 15:17 38784 ----a-w- c:\documents and settings\Eric\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-01 15:12 . 2010-05-28 15:10 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2010-05-29 12:26 . 2010-05-29 12:25 -------- d-----w- c:\program files\NVIDIA Corporation
2010-05-29 12:25 . 2010-05-29 12:25 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-05-29 11:36 . 2008-12-06 08:07 -------- d-----w- c:\program files\SystemRequirementsLab
2010-05-29 11:36 . 2010-05-29 11:36 290816 ----a-w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab\SRLProxy_nvd_4.dll
2010-05-29 11:36 . 2010-05-29 11:36 290816 ----a-w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab\SRLProxy_nvd_3.dll
2010-05-29 11:36 . 2010-05-29 11:36 290816 ----a-w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab\SRLProxy_nvd_2.dll
2010-05-29 11:36 . 2010-05-29 11:36 290816 ----a-w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab\SRLProxy_nvd_1.dll
2010-05-29 11:36 . 2010-05-29 11:36 -------- d-----w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab
2010-05-28 16:34 . 2010-05-28 16:34 -------- d-----w- c:\documents and settings\Eric\Application Data\LolClient
2010-05-28 15:28 . 2008-12-06 07:22 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-28 15:10 . 2010-05-28 15:10 -------- d-----w- c:\program files\Pando Networks
2010-05-06 10:41 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2008-04-14 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr "= "c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]
"LightScribe Control Panel "= "c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-12-05 2295072]
"ManyCam "= "c:\program files\ManyCam 2.4\ManyCam.exe" [2009-04-17 1824040]
"Skype "= "c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]
"Aim6 "=" " [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST "= "=" [X]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-09 2048352]
"JMB36X IDE Setup "= "c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer "= "c:\windows\system32\xRaidSetup.exe" [2007-11-19 1966080]
"RTHDCPL "= "RTHDCPL.EXE" [2008-11-17 17676288]
"Ad-Watch "= "c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-01 524632]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"NeroFilterCheck "= "c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan "= "c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]

c:\documents and settings\Eric\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-3-30 503808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-18 14:44 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-06-05 18:39 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 22:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\WINDOWS\\system32\\PnkBstrA.exe "=
"c:\\WINDOWS\\system32\\PnkBstrB.exe "=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe "=
"c:\\Program Files\\World of Warcraft\\Launcher.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Microsoft Games\\Freelancer\\EXE\\Freelancer.exe "=
"c:\\Program Files\\mIRC\\mirc.exe "=
"c:\\Program Files\\SecondLife\\SLVoice.exe "=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe "=
"c:\\Program Files\\SecondLife\\SecondLife.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\AIM6\\aim6.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
"c:\\Program Files\\2K Games\\BioShock 2\\SP\\Builds\\Binaries\\Bioshock2.exe "=
"c:\\Program Files\\2K Games\\BioShock 2\\MP\\Builds\\Binaries\\Bioshock2.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe "=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe "=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Riot Games\\League of Legends\\lol.launcher.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP "= 3724:TCP:Blizzard Downloader: 3724
"57040:TCP "= 57040:TCPando Media Booster
"57040:UDP "= 57040:UDPando Media Booster
"8378:TCP "= 8378:TCP:League of Legends Launcher
"8378:UDP "= 8378:UDP:League of Legends Launcher
"6885:TCP "= 6885:TCP:League of Legends Launcher
"6885:UDP "= 6885:UDP:League of Legends Launcher
"8379:TCP "= 8379:TCP:League of Legends Launcher
"8379:UDP "= 8379:UDP:League of Legends Launcher
"6932:TCP "= 6932:TCP:League of Legends Launcher
"6932:UDP "= 6932:UDP:League of Legends Launcher
"6947:TCP "= 6947:TCP:League of Legends Launcher
"6947:UDP "= 6947:UDP:League of Legends Launcher
"8393:TCP "= 8393:TCP:League of Legends Lobby
"8393:UDP "= 8393:UDP:League of Legends Lobby
"8390:TCP "= 8390:TCP:League of Legends Game Client
"8390:UDP "= 8390:UDP:League of Legends Game Client
"6966:TCP "= 6966:TCP:League of Legends Launcher
"6966:UDP "= 6966:UDP:League of Legends Launcher

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/21/2009 10:25 AM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/6/2008 2:32 AM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/6/2008 2:32 AM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [12/6/2008 2:32 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [12/6/2008 2:32 AM 297752]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [1/1/2008 12:17 AM 80392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 3:34 PM 1029456]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [11/8/2006 12:19 PM 16384]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [11/8/2006 12:20 PM 37888]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [9/18/2009 10:15 AM 24652]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 4:06 AM 21632]
R3 QCEmerald;Logitech QuickCam Web;c:\windows\system32\drivers\OVCE.sys [1/10/2009 1:46 AM 31872]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [4/6/2009 12:19 PM 23064]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [11/30/2006 12:55 PM 91648]
S2 gupdate1c98b9e492bc54e;Google Update Service (gupdate1c98b9e492bc54e);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2009 10:40 AM 133104]
S3 UBFWNet;Unibrain 1394 FireNet Adapter NT Driver;c:\windows\system32\drivers\ubfwnet.sys [12/5/2006 12:07 PM 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-12-05 17:27 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-07-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 17:30]

2010-07-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-10 07:18]

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 16:40]

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 16:40]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5643
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath - c:\documents and settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: XULRunner: {E3F9D99E-11B2-4A2D-8FAE-DCC443341E30} - c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-Aim6 - (no file)
HKLM-Run-nwiz - nwiz.exe
HKLM-Run-Xxowibu - c:\windows\ofirezuqah.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-26 23:03
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwEnumerateValueKey, ZwQueryDirectoryFile

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
xgukxzrvux.exe = c:\xgukxzrvux.exe\xgukxzrvux.exe

scanning hidden files ...


C:\xgukxzrvux.exe

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"xgukxzrvux.exe "= "c:\\xgukxzrvux.exe\\xgukxzrvux.exe "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-507921405-1482476501-1417001333-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?? "=hex:a4,d2,b9,70,a2,e0,34,d3,ef,ab,0e,c4,4f,db,ba,69,3b,ed,a0,67,3e,f8,57,
90,bc,a3,58,8c,2a,35,40,34,92,d5,ad,c5,4f,20,cb,1b,4a,7a,96,ef,82,42,9a,31,\
"?? "=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-507921405-1482476501-1417001333-1004\Software\SecuROM\License information*]
"datasecu "=hex:ff,82,57,d8,9e,1e,cb,59,35,aa,cc,2b,39,33,33,68,71,2b,43,e3,07,
bb,9e,74,06,46,72,52,c9,e1,f5,ca,c5,c2,b7,ce,58,07,ac,c3,38,08,10,ac,b9,e3,\
"rkeysecu "=hex:16,35,13,b9,37,dc,42,fe,2c,f0,6f,7d,e0,7e,04,43
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(980)
c:\windows\system32\WLDAP32.dll

- - - - - - - > 'explorer.exe'(2172)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\windows\system32\PnkBstrA.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Completion time: 2010-07-26 23:16:07 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-27 05:16

Pre-Run: 23,997,399,040 bytes free
Post-Run: 24,705,544,192 bytes free

- - End Of File - - 3F203B028354C51FACB6EE86CE923AEB

 

The combo fix ran just fine here is the new log.

ComboFix 10-07-24.06 - Eric 07/27/2010 0:14.2.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2558.1915 [GMT -6:00]
Running from: c:\documents and settings\Eric\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Eric\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\Idirilila.bin "
"c:\windows\Ywivigoreye.dat "
"c:\xgukxzrvux.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Idirilila.bin
c:\windows\Ywivigoreye.dat

.
((((((((((((((((((((((((( Files Created from 2010-06-27 to 2010-07-27 )))))))))))))))))))))))))))))))
.

2010-07-25 13:30 . 2010-07-25 13:30 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-24 21:38 . 2010-07-24 21:38 -------- d-----w- c:\program files\Common Files\Skype
2010-07-24 20:46 . 2010-07-24 20:46 -------- d-----w- c:\documents and settings\Eric\Application Data\Malwarebytes
2010-07-24 20:46 . 2010-04-29 21:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-24 20:46 . 2010-07-24 20:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-24 20:46 . 2010-04-29 21:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-24 20:46 . 2010-07-24 20:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-24 19:56 . 2010-07-24 19:56 503808 ----a-w- c:\documents and settings\Eric\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4b9e5308-n\msvcp71.dll
2010-07-24 19:56 . 2010-07-24 19:56 499712 ----a-w- c:\documents and settings\Eric\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4b9e5308-n\jmc.dll
2010-07-24 19:56 . 2010-07-24 19:56 348160 ----a-w- c:\documents and settings\Eric\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4b9e5308-n\msvcr71.dll
2010-07-23 16:50 . 2010-07-27 05:58 -------- d-----w- c:\documents and settings\Eric\Application Data\vlc
2010-07-21 21:43 . 2010-07-21 21:43 -------- d-----w- c:\program files\CCleaner
2010-07-21 18:14 . 2010-07-06 16:44 221184 ----a-w- c:\documents and settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions\browserhighlighter@ebay.com\components\Shim.dll
2010-07-21 18:13 . 2010-07-21 18:13 -------- d-----w- c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}
2010-07-21 09:21 . 2010-07-21 09:21 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-07-21 04:30 . 2010-07-21 07:57 -------- d-----w- c:\documents and settings\Eric\Local Settings\Application Data\wppurlluw
2010-07-21 04:29 . 2010-07-21 04:29 -------- d-----w- c:\documents and settings\Eric\Application Data\909BEF17AD3452D3055F0A06B15325E0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 05:59 . 2009-09-18 16:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-07-27 05:26 . 2009-09-10 19:04 -------- d-----w- c:\documents and settings\Eric\Application Data\Skype
2010-07-27 05:25 . 2008-12-31 22:36 -------- d-----w- c:\documents and settings\Eric\Application Data\LimeWire
2010-07-27 05:24 . 2008-01-01 06:16 16608 ----a-w- c:\windows\gdrv.sys
2010-07-27 03:46 . 2009-02-10 16:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-07-27 03:19 . 2009-09-10 19:05 -------- d-----w- c:\documents and settings\Eric\Application Data\skypePM
2010-07-23 02:52 . 2009-01-21 16:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-22 12:58 . 2008-12-06 07:54 -------- d-----w- c:\program files\World of Warcraft
2010-07-21 07:22 . 2008-12-06 08:32 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-07-21 07:06 . 2008-01-02 08:11 -------- d-----w- c:\documents and settings\Eric\Application Data\uTorrent
2010-07-13 11:54 . 2010-07-22 05:32 142986 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1033.dat
2010-06-22 12:43 . 2009-08-21 03:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-06-14 14:31 . 2008-12-05 19:59 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-04 14:58 . 2010-02-26 00:47 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-01 15:16 . 2010-06-01 15:16 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-06-01 15:15 . 2010-07-21 07:38 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-01 15:15 . 2010-06-01 15:17 38784 ----a-w- c:\documents and settings\Eric\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-01 15:12 . 2010-05-28 15:10 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2010-05-29 12:26 . 2010-05-29 12:25 -------- d-----w- c:\program files\NVIDIA Corporation
2010-05-29 12:25 . 2010-05-29 12:25 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-05-29 11:36 . 2008-12-06 08:07 -------- d-----w- c:\program files\SystemRequirementsLab
2010-05-29 11:36 . 2010-05-29 11:36 290816 ----a-w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab\SRLProxy_nvd_4.dll
2010-05-29 11:36 . 2010-05-29 11:36 290816 ----a-w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab\SRLProxy_nvd_3.dll
2010-05-29 11:36 . 2010-05-29 11:36 290816 ----a-w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab\SRLProxy_nvd_2.dll
2010-05-29 11:36 . 2010-05-29 11:36 290816 ----a-w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab\SRLProxy_nvd_1.dll
2010-05-29 11:36 . 2010-05-29 11:36 -------- d-----w- c:\documents and settings\Eric\Application Data\SystemRequirementsLab
2010-05-28 16:34 . 2010-05-28 16:34 -------- d-----w- c:\documents and settings\Eric\Application Data\LolClient
2010-05-28 15:28 . 2008-12-06 07:22 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-28 15:10 . 2010-05-28 15:10 -------- d-----w- c:\program files\Pando Networks
2010-05-06 10:41 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2008-04-14 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\Eric\Application Data\909BEF17AD3452D3055F0A06B15325E0 ----


---- Directory of c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30} ----

2010-07-21 18:13 . 2010-07-21 18:13 5954 ----a-w- c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}\chrome\content\overlay.xul
2010-07-21 18:13 . 2010-07-21 18:13 2082 ----a-w- c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}\chrome\content\_cfg.js
2010-07-21 18:13 . 2010-07-21 18:13 764 ----a-w- c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}\install.rdf
2010-07-21 18:13 . 2010-07-21 18:13 122 ----a-w- c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}\chrome.manifest


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr "= "c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]
"LightScribe Control Panel "= "c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-12-05 2295072]
"ManyCam "= "c:\program files\ManyCam 2.4\ManyCam.exe" [2009-04-17 1824040]
"Skype "= "c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-09 2048352]
"JMB36X IDE Setup "= "c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer "= "c:\windows\system32\xRaidSetup.exe" [2007-11-19 1966080]
"RTHDCPL "= "RTHDCPL.EXE" [2008-11-17 17676288]
"Ad-Watch "= "c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-01 524632]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"NeroFilterCheck "= "c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan "= "c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]

c:\documents and settings\Eric\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-3-30 503808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-18 14:44 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-06-05 18:39 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 22:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\WINDOWS\\system32\\PnkBstrA.exe "=
"c:\\WINDOWS\\system32\\PnkBstrB.exe "=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe "=
"c:\\Program Files\\World of Warcraft\\Launcher.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Microsoft Games\\Freelancer\\EXE\\Freelancer.exe "=
"c:\\Program Files\\mIRC\\mirc.exe "=
"c:\\Program Files\\SecondLife\\SLVoice.exe "=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe "=
"c:\\Program Files\\SecondLife\\SecondLife.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\AIM6\\aim6.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe "=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
"c:\\Program Files\\2K Games\\BioShock 2\\SP\\Builds\\Binaries\\Bioshock2.exe "=
"c:\\Program Files\\2K Games\\BioShock 2\\MP\\Builds\\Binaries\\Bioshock2.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe "=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe "=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Riot Games\\League of Legends\\lol.launcher.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP "= 3724:TCP:Blizzard Downloader: 3724
"57040:TCP "= 57040:TCPando Media Booster
"57040:UDP "= 57040:UDPando Media Booster
"8378:TCP "= 8378:TCP:League of Legends Launcher
"8378:UDP "= 8378:UDP:League of Legends Launcher
"6885:TCP "= 6885:TCP:League of Legends Launcher
"6885:UDP "= 6885:UDP:League of Legends Launcher
"8379:TCP "= 8379:TCP:League of Legends Launcher
"8379:UDP "= 8379:UDP:League of Legends Launcher
"6932:TCP "= 6932:TCP:League of Legends Launcher
"6932:UDP "= 6932:UDP:League of Legends Launcher
"6947:TCP "= 6947:TCP:League of Legends Launcher
"6947:UDP "= 6947:UDP:League of Legends Launcher
"8393:TCP "= 8393:TCP:League of Legends Lobby
"8393:UDP "= 8393:UDP:League of Legends Lobby
"8390:TCP "= 8390:TCP:League of Legends Game Client
"8390:UDP "= 8390:UDP:League of Legends Game Client
"6966:TCP "= 6966:TCP:League of Legends Launcher
"6966:UDP "= 6966:UDP:League of Legends Launcher

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/21/2009 10:25 AM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/6/2008 2:32 AM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/6/2008 2:32 AM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [12/6/2008 2:32 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [12/6/2008 2:32 AM 297752]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [1/1/2008 12:17 AM 80392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 3:34 PM 1029456]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [11/8/2006 12:19 PM 16384]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [11/8/2006 12:20 PM 37888]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 4:06 AM 21632]
R3 QCEmerald;Logitech QuickCam Web;c:\windows\system32\drivers\OVCE.sys [1/10/2009 1:46 AM 31872]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [4/6/2009 12:19 PM 23064]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [11/30/2006 12:55 PM 91648]
S2 gupdate1c98b9e492bc54e;Google Update Service (gupdate1c98b9e492bc54e);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2009 10:40 AM 133104]
S3 UBFWNet;Unibrain 1394 FireNet Adapter NT Driver;c:\windows\system32\drivers\ubfwnet.sys [12/5/2006 12:07 PM 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-12-05 17:27 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-07-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 17:30]

2010-07-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-10 07:18]

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 16:40]

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 16:40]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath - c:\documents and settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - HiddenExtension: XULRunner: {E3F9D99E-11B2-4A2D-8FAE-DCC443341E30} - c:\documents and settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-27 00:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-507921405-1482476501-1417001333-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?? "=hex:a4,d2,b9,70,a2,e0,34,d3,ef,ab,0e,c4,4f,db,ba,69,3b,ed,a0,67,3e,f8,57,
90,bc,a3,58,8c,2a,35,40,34,92,d5,ad,c5,4f,20,cb,1b,4a,7a,96,ef,82,42,9a,31,\
"?? "=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-507921405-1482476501-1417001333-1004\Software\SecuROM\License information*]
"datasecu "=hex:ff,82,57,d8,9e,1e,cb,59,35,aa,cc,2b,39,33,33,68,71,2b,43,e3,07,
bb,9e,74,06,46,72,52,c9,e1,f5,ca,c5,c2,b7,ce,58,07,ac,c3,38,08,10,ac,b9,e3,\
"rkeysecu "=hex:16,35,13,b9,37,dc,42,fe,2c,f0,6f,7d,e0,7e,04,43
.
Completion time: 2010-07-27 00:21:22
ComboFix-quarantined-files.txt 2010-07-27 06:21
ComboFix2.txt 2010-07-27 05:16

Pre-Run: 24,703,811,584 bytes free
Post-Run: 24,689,565,696 bytes free

- - End Of File - - 2F9F66009C551D90A16E2D27070F3DE8

 

Computer is doing much better so far no more warnings on startup and such

Here are the OTL scans

OTL logfile created on: 7/28/2010 11:57:04 AM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Eric\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 76.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2100 10000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.62 Gb Total Space | 25.19 Gb Free Space | 5.41% Space Free | Partition Type: NTFS
Drive D: | 6.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 931.28 Gb Total Space | 1.50 Gb Free Space | 0.16% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ERIC-BACH
Current User Name: Eric
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/27 11:37:20 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Eric\Desktop\OTL.exe
PRC - [2010/07/09 08:13:34 | 002,048,352 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgtray.exe
PRC - [2010/03/01 11:29:14 | 000,524,632 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/03/01 11:28:48 | 001,029,456 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009/09/30 20:58:42 | 000,026,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Live\Contacts\wlcomm.exe
PRC - [2009/08/18 08:44:57 | 000,486,680 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgrsx.exe
PRC - [2009/08/18 08:44:56 | 000,693,016 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgcsrvx.exe
PRC - [2009/08/18 08:44:53 | 000,595,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgnsx.exe
PRC - [2009/08/18 08:44:51 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe
PRC - [2009/08/18 08:44:47 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe
PRC - [2009/07/27 18:19:10 | 000,199,184 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/08/08 14:24:42 | 000,080,392 | ---- | M] () -- C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
PRC - [2008/04/14 06:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2010/07/27 11:37:20 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Eric\Desktop\OTL.exe
MOD - [2008/04/14 06:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/03/01 11:28:48 | 001,029,456 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/08/18 08:44:51 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc)
SRV - [2009/08/18 08:44:47 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd)
SRV - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/08/08 14:24:42 | 000,080,392 | ---- | M] () [Auto | Running] -- C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe -- (GEST Service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Eric\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys -- (cpuz132)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Eric\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/07/28 11:51:37 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2010/04/03 16:55:31 | 010,232,128 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2009/08/18 08:44:56 | 000,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2009/08/18 08:44:56 | 000,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2009/05/09 08:35:48 | 000,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2009/04/22 09:25:16 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2009/04/06 12:19:46 | 000,023,064 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER)
DRV - [2008/11/25 16:37:50 | 004,952,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/07/30 20:21:08 | 000,079,960 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\jraid.sys -- (JRAID)
DRV - [2008/06/16 01:08:42 | 000,109,184 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/04/14 06:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/04/13 22:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2008/01/14 04:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ManyCam.sys -- (ManyCam)
DRV - [2006/12/05 12:07:26 | 000,024,576 | ---- | M] (Unibrain S.A.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ubfwnet.sys -- (UBFWNet)
DRV - [2006/11/30 12:55:26 | 000,091,648 | ---- | M] (Unibrain S.A.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ubohci.sys -- (ubohci)
DRV - [2006/11/08 12:20:16 | 000,037,888 | ---- | M] (Unibrain S.A.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\UBUMAPI.sys -- (ubumapi)
DRV - [2006/11/08 12:19:26 | 000,016,384 | ---- | M] (Unibrain S.A.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\UBSBM.sys -- (ubsbm)
DRV - [2001/08/17 14:05:20 | 000,031,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OVCE.sys -- (QCEmerald)
DRV - [2001/08/17 14:05:06 | 000,025,216 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\OVSound2.sys -- (lusbaudio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com "
FF - prefs.js..browser.search.defaultenginename: "Ask.com "
FF - prefs.js..browser.search.order.1: "Ask.com "
FF - prefs.js..browser.search.selectedEngine: "Ask.com "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}:1.9.1
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198


FF - HKLM\software\mozilla\Firefox\Extensions\\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}: C:\Documents and Settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30} [2010/07/21 12:13:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/28 11:44:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/26 23:59:01 | 000,000,000 | ---D | M]

[2010/04/28 05:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Mozilla\Extensions
[2010/04/28 05:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2010/07/27 10:01:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions
[2010/07/21 12:14:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/21 16:55:28 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/07/21 12:14:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions\browserhighlighter@ebay.com
[2010/04/28 15:49:20 | 000,002,425 | ---- | M] () -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\searchplugins\askcom.xml
[2010/07/27 10:01:45 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/24 15:39:08 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/07/25 08:21:59 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\browserhighlighter@ebay.com

O1 HOSTS File: ([2010/07/27 00:19:35 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe (Gigabyte Technology Corp.)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKCU..\Run: [ManyCam] C:\Program Files\ManyCam 2.4\ManyCam.exe (ManyCam LLC)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan.lnk = C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Eric\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1228586308328 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/12/05 14:01:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007/06/11 20:27:33 | 000,000,140 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer7 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer8 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer9 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave7 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave8 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave9 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/07/28 11:46:51 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010/07/28 10:40:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\My Documents\SC2-WingsOfLiberty-enUS-Installer
[2010/07/28 10:40:13 | 003,208,182 | ---- | C] (Blizzard Entertainment) -- C:\Documents and Settings\Eric\Desktop\StarCraft_2_NA_en-US.exe
[2010/07/27 11:37:19 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Eric\Desktop\OTL.exe
[2010/07/26 14:28:55 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/07/26 14:19:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/07/24 15:38:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010/07/24 14:46:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\Malwarebytes
[2010/07/24 14:46:30 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/24 14:46:28 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/24 14:46:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/24 14:46:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/23 10:50:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\vlc
[2010/07/22 20:50:30 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Eric\Recent
[2010/07/21 23:32:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/07/21 15:43:43 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/07/21 15:42:38 | 003,396,176 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\Eric\Desktop\ccsetup233.exe
[2010/07/21 12:13:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}
[2010/07/21 02:50:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/07/21 02:50:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/07/20 22:43:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/20 22:43:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/20 22:30:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Local Settings\Application Data\wppurlluw
[2010/07/20 22:29:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\909BEF17AD3452D3055F0A06B15325E0
[2010/07/06 22:09:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Desktop\The Imaginarium of Doctor Parnassus R5 LINE XviD-PrisM
[2010/07/06 21:39:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Desktop\Parasomnia.2008.720p.BRRip.XviD.AC3-Rx
[2010/06/01 09:16:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/05/29 06:25:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
[2010/05/29 06:25:42 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2010/05/29 06:24:58 | 000,061,440 | ---- | C] (Khronos Group) -- C:\WINDOWS\System32\OpenCL.dll
[2010/05/29 05:36:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\SystemRequirementsLab
[2010/05/28 10:34:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\LolClient
[2010/05/28 09:28:45 | 000,000,000 | ---D | C] -- C:\Riot Games
[2010/05/28 09:11:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Local Settings\Application Data\PMB Files
[2010/05/28 09:10:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/05/28 09:10:00 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2010/05/26 09:12:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Desktop\The Children of Hurin by J R R Tolkien
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/07/28 11:52:19 | 000,271,830 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010/07/28 11:51:50 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/28 11:51:48 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/28 11:51:27 | 000,001,374 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/28 11:51:27 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/28 11:51:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/28 11:49:33 | 006,815,744 | -H-- | M] () -- C:\Documents and Settings\Eric\NTUSER.DAT
[2010/07/28 11:44:08 | 000,000,169 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\moms number.rtf
[2010/07/28 11:42:01 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/28 10:40:14 | 003,208,182 | ---- | M] (Blizzard Entertainment) -- C:\Documents and Settings\Eric\Desktop\StarCraft_2_NA_en-US.exe
[2010/07/28 10:25:38 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/07/28 08:16:09 | 062,660,424 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/27 21:22:51 | 000,000,182 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/07/27 18:58:25 | 293,857,305 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\[HorribleSubs] Bleach - 281 [720p].mkv
[2010/07/27 11:37:20 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Eric\Desktop\OTL.exe
[2010/07/27 07:45:14 | 000,151,040 | ---- | M] () -- C:\Documents and Settings\Eric\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/27 00:19:40 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/07/27 00:19:35 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.msn
[2010/07/27 00:19:35 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/26 14:29:00 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/07/25 07:30:07 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/07/24 14:51:29 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\viddyli7.exe
[2010/07/24 14:46:33 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/23 12:00:48 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\dds.scr
[2010/07/23 10:48:03 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/07/23 06:24:40 | 000,000,175 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\infection.rtf
[2010/07/21 15:57:54 | 000,092,774 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\cc_20100721_155533.reg
[2010/07/21 15:43:46 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\CCleaner.lnk
[2010/07/21 15:42:43 | 003,396,176 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Eric\Desktop\ccsetup233.exe
[2010/07/20 22:30:32 | 000,000,150 | ---- | M] () -- C:\zrpt.xml
[2010/07/15 11:32:07 | 281,619,577 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\[HorribleSubs] Naruto Shippuuden - 168 [720p].mkv
[2010/07/14 08:48:25 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/07/09 20:12:32 | 000,000,495 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\Document.rtf
[2010/07/03 15:20:44 | 000,000,150 | ---- | M] () -- C:\Documents and Settings\Eric\default.pls
[2010/06/24 03:01:53 | 000,488,794 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/24 03:01:53 | 000,432,686 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/24 03:01:53 | 000,067,516 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/12 04:31:20 | 000,099,048 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/05/28 09:34:07 | 000,001,614 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play League of Legends.lnk
[2010/05/11 23:27:16 | 000,001,258 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\mirm list.rtf
[2010/05/08 01:38:14 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/05 12:40:17 | 005,104,796 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\13 rhapsody knigthrider of doom.mov
[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/28 11:44:07 | 000,000,169 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\moms number.rtf
[2010/07/27 18:26:50 | 293,857,305 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\[HorribleSubs] Bleach - 281 [720p].mkv
[2010/07/26 14:29:00 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/07/26 14:28:56 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/07/25 07:30:07 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/07/24 14:51:29 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\viddyli7.exe
[2010/07/24 14:46:33 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/23 12:00:48 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\dds.scr
[2010/07/23 10:48:03 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/07/23 06:24:40 | 000,000,175 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\infection.rtf
[2010/07/21 15:55:38 | 000,092,774 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\cc_20100721_155533.reg
[2010/07/21 15:43:46 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\CCleaner.lnk
[2010/07/20 22:30:31 | 000,000,150 | ---- | C] () -- C:\zrpt.xml
[2010/07/20 22:22:25 | 000,012,082 | ---- | C] () -- C:\Documents and Settings\Eric\hs_err_pid1628.log
[2010/07/15 11:08:43 | 281,619,577 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\[HorribleSubs] Naruto Shippuuden - 168 [720p].mkv
[2010/06/30 07:52:13 | 000,000,495 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\Document.rtf
[2010/05/29 06:24:58 | 000,009,046 | ---- | C] () -- C:\WINDOWS\System32\nvinfo.pb
[2010/05/29 06:24:56 | 002,183,470 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010/05/28 09:34:07 | 000,001,614 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play League of Legends.lnk
[2010/05/11 10:35:59 | 000,001,258 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\mirm list.rtf
[2010/05/08 01:38:14 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/05 12:38:45 | 005,104,796 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\13 rhapsody knigthrider of doom.mov
[2009/11/06 11:58:04 | 000,178,975 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009/07/17 22:00:58 | 001,051,136 | ---- | C] () -- C:\WINDOWS\System32\drivers\CAMTHWDM.sys
[2009/06/11 00:30:53 | 000,000,182 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/02/04 15:32:31 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2009/01/03 20:21:33 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/05/02 21:16:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/01/01 04:48:28 | 000,138,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/01/01 04:48:08 | 000,000,319 | ---- | C] () -- C:\WINDOWS\game.ini

========== LOP Check ==========

[2009/09/18 10:15:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\acccore
[2009/06/11 00:30:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2008/12/06 01:21:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2010/06/01 09:12:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/07/26 23:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/01/21 10:24:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2009/06/10 15:04:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/07/20 22:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\909BEF17AD3452D3055F0A06B15325E0
[2009/09/18 10:16:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\acccore
[2010/01/13 17:10:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Bioshock
[2010/02/25 17:41:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Bioshock2
[2010/01/08 10:14:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Command & Conquer 3 Kane's Wrath
[2010/07/28 11:54:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\LimeWire
[2010/05/28 10:34:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\LolClient
[2009/07/17 22:05:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\ManyCam
[2010/01/06 20:25:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\New Folder
[2008/12/21 08:03:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Red Alert 3
[2009/06/13 14:40:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Screaming Bee
[2009/08/10 22:43:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\SecondLife
[2009/06/06 23:12:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\SpeedSim
[2010/05/29 05:36:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\SystemRequirementsLab
[2010/07/21 01:06:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\uTorrent
[2009/06/16 00:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Video DVD Maker FREE
[2009/07/17 22:01:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Webcammax
[2009/08/20 15:28:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Wizards of the Coast
[2010/07/28 10:25:38 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/07/28 11:51:03 | 000,026,876 | ---- | M] () -- C:\aaw7boot.log
[2008/12/05 14:01:46 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/01/21 10:41:39 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/07/26 14:29:00 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2010/07/27 00:21:22 | 000,020,384 | ---- | M] () -- C:\ComboFix.txt
[2008/12/05 14:01:46 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/01/01 00:23:58 | 000,000,197 | ---- | M] () -- C:\csb.log
[2009/06/13 14:41:29 | 000,000,000 | ---- | M] () -- C:\fftoutput.txt
[2008/12/05 14:01:46 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/09/18 10:15:35 | 000,000,371 | -H-- | M] () -- C:\IPH.PH
[2008/12/05 14:01:46 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 06:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 06:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/07/28 11:51:03 | 2202,009,600 | -HS- | M] () -- C:\pagefile.sys
[2008/01/01 00:18:36 | 000,000,429 | ---- | M] () -- C:\RHDSetup.log
[2010/07/28 11:51:48 | 000,000,125 | ---- | M] () -- C:\service.log
[2008/12/10 22:39:05 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/06/10 21:17:13 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/08/08 00:12:09 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2008/12/10 22:39:05 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/06/10 21:17:13 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/08/08 00:12:09 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2010/07/20 22:30:32 | 000,000,150 | ---- | M] () -- C:\zrpt.xml

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 06:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >


< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/12/05 07:46:00 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008/12/05 07:46:00 | 001,064,960 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008/12/05 07:45:59 | 000,937,984 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 06:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 06:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 06:00:00 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

 

And here is the scans from OTL "extras "

OTL Extras logfile created on: 7/28/2010 11:57:04 AM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Eric\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 76.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2100 10000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.62 Gb Total Space | 25.19 Gb Free Space | 5.41% Space Free | Partition Type: NTFS
Drive D: | 6.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 931.28 Gb Total Space | 1.50 Gb Free Space | 0.16% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ERIC-BACH
Current User Name: Eric
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"57040:TCP" = 57040:TCP:*:Enabledando Media Booster
"57040:UDP" = 57040:UDP:*:Enabledando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724
"139:TCP" = 139:TCP:LocalSubNetisabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNetisabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNetisabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNetisabledxpsp2res.dll,-22002
"57040:TCP" = 57040:TCP:*:Enabledando Media Booster
"57040:UDP" = 57040:UDP:*:Enabledando Media Booster
"8378:TCP" = 8378:TCP:*:Enabled:League of Legends Launcher
"8378:UDP" = 8378:UDP:*:Enabled:League of Legends Launcher
"6885:TCP" = 6885:TCP:*:Enabled:League of Legends Launcher
"6885:UDP" = 6885:UDP:*:Enabled:League of Legends Launcher
"8379:TCP" = 8379:TCP:*:Enabled:League of Legends Launcher
"8379:UDP" = 8379:UDP:*:Enabled:League of Legends Launcher
"6932:TCP" = 6932:TCP:*:Enabled:League of Legends Launcher
"6932:UDP" = 6932:UDP:*:Enabled:League of Legends Launcher
"6966:TCP" = 6966:TCP:*:Enabled:League of Legends Launcher
"6966:UDP" = 6966:UDP:*:Enabled:League of Legends Launcher

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabledando Media Booster -- ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe" = C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) -- ()
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Program Files\Ventrilo\Ventrilo.exe" = C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe -- ()
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Program Files\World of Warcraft\Launcher.exe" = C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher -- (Blizzard Entertainment)
"C:\Program Files\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\World of Warcraft\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Microsoft Games\Freelancer\EXE\Freelancer.exe" = C:\Program Files\Microsoft Games\Freelancer\EXE\Freelancer.exe:*:Enabled:Freelancer -- (Microsoft Corporation)
"C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.)
"C:\Program Files\SecondLife\SLVoice.exe" = C:\Program Files\SecondLife\SLVoice.exe:*:Enabled:SLVoice -- ()
"C:\Program Files\World of Warcraft\BackgroundDownloader.exe" = C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Program Files\SecondLife\SecondLife.exe" = C:\Program Files\SecondLife\SecondLife.exe:*:Enabled:Second Life -- (Linden Lab)
"C:\Program Files\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Program Files\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM -- (AOL LLC)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)
"C:\Program Files\2K Games\BioShock 2\SP\Builds\Binaries\Bioshock2.exe" = C:\Program Files\2K Games\BioShock 2\SP\Builds\Binaries\Bioshock2.exe:*:Enabled:BioShock 2 -- (Take-Two Interactive Software)
"C:\Program Files\2K Games\BioShock 2\MP\Builds\Binaries\Bioshock2.exe" = C:\Program Files\2K Games\BioShock 2\MP\Builds\Binaries\Bioshock2.exe:*:Enabled:BioShock 2 Multiplayer -- (2K Games)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabledando Media Booster -- ()
"C:\Riot Games\League of Legends\air\LolClient.exe" = C:\Riot Games\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby -- ()
"C:\Riot Games\League of Legends\game\League of Legends.exe" = C:\Riot Games\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client -- ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{1A3E23D7-7A1E-43EC-B35D-EB2A31BED943}" = Video DVD Maker v3.19.0.42
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 17
"{296D8550-CB06-48E4-9A8B-E5034FB64715}" = Command & Conquerâ„¢ Red Alertâ„¢ 3
"{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}" = Microsoft Games for Windows - LIVE
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Configurer
"{402ED8C0-824E-48A2-AB07-C8820E9CD8E9}" = MorphVOX Junior
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A8B461A-9336-4CF9-98F4-14DD38E673F0}" = BioShock 2
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes
"{621C02EA-AAFF-4026-A903-165D59529A16}" = Driver Detective
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7353BAE6-5E49-46C4-A9B5-8A269A313789}" = Crysis WARHEAD(R)
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7ED169D4-5053-4166-93DF-53B12AE6C539}" = Energy Saver Advance B8.0905.1
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AEA4BE2-2B52-41C0-BB7D-9F2D17AF1033}" = Nero 8
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A4A5FB2-AA50-4AF2-BD51-67BDB3B2FB85}" = NX
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF7733C1-FB0B-4FED-9730-E0433AF7A2EF}" = Magic Online III
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CBCF859F-04BE-4A07-B6FA-F4FAD69EF1ED}" = LightScribe System Software 1.10.27.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE7CB214-DB11-4B5D-A6AF-3B4ED47C68B7}" = Microsoft Game Studios Common Redistributables Pack 1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skypeâ„¢ 4.2
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E8AEA11B-E60A-455E-B008-E4E763604612}" = Browser Configuration Utility
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F65FE148-FCF5-42F7-8803-FA0B7DA8B8A4}" = ubCorePro
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{F94CFF0E-600E-4E1C-A0A5-5053C1816A9F}" = League of Legends
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIM_6" = AIM 6
"AVG8Uninstall" = AVG Free 8.5
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Continuum_is1" = Continuum 0.40
"Crysis WARHEAD(R)" = Crysis WARHEAD(R)
"DVD Flick_is1" = DVD Flick 1.3.0.6
"Freelancer 1.0" = Freelancer
"GameSpy Arcade" = GameSpy Arcade
"Google Updater" = Google Updater
"Halo Trial" = Microsoft Halo Trial
"ie8" = Windows Internet Explorer 8
"InstallShield_{621C02EA-AAFF-4026-A903-165D59529A16}" = Driver Detective
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{F65FE148-FCF5-42F7-8803-FA0B7DA8B8A4}" = ubCorePro
"LimeWire" = LimeWire 5.5.8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.4 (remove only)
"McAfee Security Scan" = McAfee Security Scan
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"Mozilla Firefox (3.5.11)" = Mozilla Firefox (3.5.11)
"MSNINST" = MSN
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PokerStars.net" = PokerStars.net
"SecondLife" = SecondLife (remove only)
"SpeedSim" = SpeedSim
"SystemRequirementsLab" = System Requirements Lab
"VLC media player" = VLC media player 1.0.1
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"World of Warcraft" = World of Warcraft
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/25/2010 6:15:24 AM | Computer Name = ERIC-BACH | Source = ESENT | ID = 455
Description = wuaueng.dll (5960) SUS20ClientDataStore: Error -1032 (0xfffffbf8)
occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.

Error - 7/25/2010 6:15:55 AM | Computer Name = ERIC-BACH | Source = ESENT | ID = 489
Description = wuauclt (6028) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "
for read only access failed with system error 32 (0x00000020): "The process cannot
access the file because it is being used by another process. ". The open file
operation will fail with error -1032 (0xfffffbf8).

Error - 7/25/2010 6:15:55 AM | Computer Name = ERIC-BACH | Source = ESENT | ID = 455
Description = wuaueng.dll (6028) SUS20ClientDataStore: Error -1032 (0xfffffbf8)
occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.

Error - 7/25/2010 6:16:05 AM | Computer Name = ERIC-BACH | Source = ESENT | ID = 489
Description = wuauclt (6028) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "
for read only access failed with system error 32 (0x00000020): "The process cannot
access the file because it is being used by another process. ". The open file
operation will fail with error -1032 (0xfffffbf8).

Error - 7/25/2010 6:16:05 AM | Computer Name = ERIC-BACH | Source = ESENT | ID = 455
Description = wuaueng.dll (6028) SUS20ClientDataStore: Error -1032 (0xfffffbf8)
occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.

Error - 7/25/2010 8:26:50 AM | Computer Name = ERIC-BACH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module ofirezuqah.dll, version 0.0.0.0, fault address 0x00012577.

Error - 7/25/2010 7:42:05 PM | Computer Name = ERIC-BACH | Source = Google Update | ID = 20
Description =

Error - 7/26/2010 8:56:09 AM | Computer Name = ERIC-BACH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module ofirezuqah.dll, version 0.0.0.0, fault address 0x00012577.

Error - 7/26/2010 12:18:43 PM | Computer Name = ERIC-BACH | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module urlmon.dll, version 8.0.6001.18923, fault address 0x0002df76.

Error - 7/28/2010 1:46:32 PM | Computer Name = ERIC-BACH | Source = Application Error | ID = 1000
Description = Faulting application mcuicnt.exe, version 2.11.103.0, faulting module
ieframe.dll, version 8.0.6001.18928, fault address 0x00126e44.

[ System Events ]
Error - 7/26/2010 1:57:27 PM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7034
Description = The Bonjour Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 7/26/2010 4:21:21 PM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7031
Description = The AVG Free8 WatchDog service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 7/26/2010 4:21:56 PM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7034
Description = The AVG Free8 E-mail Scanner service terminated unexpectedly. It
has done this 1 time(s).

Error - 7/26/2010 4:22:02 PM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7031
Description = The AVG Free8 WatchDog service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 7/26/2010 11:17:51 PM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7023
Description = The Network Security service terminated with the following error:
%%126

Error - 7/26/2010 11:17:51 PM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 7/27/2010 1:00:12 AM | Computer Name = ERIC-BACH | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_ZFOFR\0000 disappeared from the system without
first being prepared for removal.

Error - 7/27/2010 1:02:52 AM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 7/27/2010 1:24:22 AM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 7/28/2010 1:51:46 PM | Computer Name = ERIC-BACH | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126


< End of report >

 

Here is the scan after the reboot.
Also i did get a pop up with about 6 things listed *all the same* of some kind of Trojan that my avg couldn't remove or do anything with.


All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
C:\ComboFix folder moved successfully.
C:\Documents and Settings\Eric\Local Settings\Application Data\wppurlluw folder moved successfully.
C:\WINDOWS\NV6001144.TMP folder deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 5675 bytes
->FireFox cache emptied: 3474807 bytes
->Flash cache emptied: 41661 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41661 bytes

User: Eric
->Temp folder emptied: 76762762 bytes
->Temporary Internet Files folder emptied: 5404141 bytes
->Java cache emptied: 10955760 bytes
->FireFox cache emptied: 37598139 bytes
->Flash cache emptied: 50406 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1654918 bytes
->Flash cache emptied: 18194 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 21064 bytes
->Flash cache emptied: 19456 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 130.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: Eric
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 07292010_194935

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...








And Here is the scan run later.

OTL logfile created on: 7/29/2010 7:59:18 PM - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Eric\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 70.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2100 10000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.62 Gb Total Space | 10.17 Gb Free Space | 2.18% Space Free | Partition Type: NTFS
Drive D: | 6.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 931.28 Gb Total Space | 1.50 Gb Free Space | 0.16% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ERIC-BACH
Current User Name: Eric
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/27 11:37:20 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Eric\Desktop\OTL.exe
PRC - [2010/07/21 11:58:08 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/07/09 08:13:34 | 002,048,352 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgtray.exe
PRC - [2010/03/01 11:29:14 | 000,524,632 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/03/01 11:28:48 | 001,029,456 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009/09/30 20:58:42 | 000,026,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Live\Contacts\wlcomm.exe
PRC - [2009/08/18 08:44:57 | 000,486,680 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgrsx.exe
PRC - [2009/08/18 08:44:56 | 000,693,016 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgcsrvx.exe
PRC - [2009/08/18 08:44:53 | 000,595,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgnsx.exe
PRC - [2009/08/18 08:44:51 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe
PRC - [2009/08/18 08:44:47 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe
PRC - [2009/07/27 18:19:10 | 000,199,184 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009/04/17 00:19:22 | 001,824,040 | ---- | M] (ManyCam LLC) -- C:\Program Files\ManyCam 2.4\ManyCam.exe
PRC - [2008/08/08 14:24:42 | 000,080,392 | ---- | M] () -- C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
PRC - [2008/04/14 06:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2010/07/27 11:37:20 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Eric\Desktop\OTL.exe
MOD - [2008/04/14 06:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/03/01 11:28:48 | 001,029,456 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/08/18 08:44:51 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc)
SRV - [2009/08/18 08:44:47 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd)
SRV - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/08/08 14:24:42 | 000,080,392 | ---- | M] () [Auto | Running] -- C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe -- (GEST Service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Eric\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys -- (cpuz132)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Eric\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/07/29 19:53:36 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2010/04/03 16:55:31 | 010,232,128 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2009/08/18 08:44:56 | 000,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2009/08/18 08:44:56 | 000,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2009/05/09 08:35:48 | 000,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2009/04/22 09:25:16 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2009/04/06 12:19:46 | 000,023,064 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER)
DRV - [2008/11/25 16:37:50 | 004,952,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/07/30 20:21:08 | 000,079,960 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\jraid.sys -- (JRAID)
DRV - [2008/06/16 01:08:42 | 000,109,184 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/04/14 06:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/04/13 22:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2008/01/14 04:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ManyCam.sys -- (ManyCam)
DRV - [2006/12/05 12:07:26 | 000,024,576 | ---- | M] (Unibrain S.A.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ubfwnet.sys -- (UBFWNet)
DRV - [2006/11/30 12:55:26 | 000,091,648 | ---- | M] (Unibrain S.A.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ubohci.sys -- (ubohci)
DRV - [2006/11/08 12:20:16 | 000,037,888 | ---- | M] (Unibrain S.A.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\UBUMAPI.sys -- (ubumapi)
DRV - [2006/11/08 12:19:26 | 000,016,384 | ---- | M] (Unibrain S.A.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\UBSBM.sys -- (ubsbm)
DRV - [2001/08/17 14:05:20 | 000,031,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OVCE.sys -- (QCEmerald)
DRV - [2001/08/17 14:05:06 | 000,025,216 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\OVSound2.sys -- (lusbaudio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com "
FF - prefs.js..browser.search.defaultenginename: "Ask.com "
FF - prefs.js..browser.search.order.1: "Ask.com "
FF - prefs.js..browser.search.selectedEngine: "Ask.com "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}:1.9.1


FF - HKLM\software\mozilla\Firefox\Extensions\\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}: C:\Documents and Settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30} [2010/07/21 12:13:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/28 11:44:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/29 19:47:33 | 000,000,000 | ---D | M]

[2010/04/28 05:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Mozilla\Extensions
[2010/04/28 05:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2010/07/29 19:48:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions
[2010/07/21 12:14:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/21 12:14:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\extensions\browserhighlighter@ebay.com
[2010/04/28 15:49:20 | 000,002,425 | ---- | M] () -- C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qccgyw7e.default\searchplugins\askcom.xml
[2010/07/29 19:48:22 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/24 15:39:08 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/07/29 19:47:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/25 08:21:59 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\browserhighlighter@ebay.com
[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/07/27 00:19:35 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe (Gigabyte Technology Corp.)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKCU..\Run: [ManyCam] C:\Program Files\ManyCam 2.4\ManyCam.exe (ManyCam LLC)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan.lnk = C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Eric\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1228586308328 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/12/05 14:01:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007/06/11 20:27:33 | 000,000,140 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/07/29 19:50:00 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/07/29 19:49:35 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/07/29 19:47:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/07/29 19:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/07/29 06:18:39 | 000,000,000 | ---D | C] -- C:\Program Files\StarCraft II
[2010/07/29 06:18:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\My Documents\StarCraft II
[2010/07/28 10:40:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\My Documents\SC2-WingsOfLiberty-enUS-Installer
[2010/07/28 10:40:13 | 003,208,182 | ---- | C] (Blizzard Entertainment) -- C:\Documents and Settings\Eric\Desktop\StarCraft_2_NA_en-US.exe
[2010/07/27 11:37:19 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Eric\Desktop\OTL.exe
[2010/07/26 14:28:55 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/07/26 14:19:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/07/24 15:38:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010/07/24 14:46:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\Malwarebytes
[2010/07/24 14:46:30 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/24 14:46:28 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/24 14:46:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/24 14:46:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/23 10:50:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\vlc
[2010/07/22 20:50:30 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Eric\Recent
[2010/07/21 23:32:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/07/21 15:43:43 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/07/21 15:42:38 | 003,396,176 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\Eric\Desktop\ccsetup233.exe
[2010/07/21 12:13:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Local Settings\Application Data\{E3F9D99E-11B2-4A2D-8FAE-DCC443341E30}
[2010/07/21 02:50:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/07/21 02:50:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/07/20 22:43:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/20 22:43:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/20 22:29:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\909BEF17AD3452D3055F0A06B15325E0
[2010/07/06 22:09:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Desktop\The Imaginarium of Doctor Parnassus R5 LINE XviD-PrisM
[2010/07/06 21:39:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Desktop\Parasomnia.2008.720p.BRRip.XviD.AC3-Rx
[2010/06/01 09:16:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/05/29 06:25:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
[2010/05/29 06:25:42 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2010/05/29 06:24:58 | 000,061,440 | ---- | C] (Khronos Group) -- C:\WINDOWS\System32\OpenCL.dll
[2010/05/29 05:36:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\SystemRequirementsLab
[2010/05/28 10:34:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Application Data\LolClient
[2010/05/28 09:28:45 | 000,000,000 | ---D | C] -- C:\Riot Games
[2010/05/28 09:11:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Local Settings\Application Data\PMB Files
[2010/05/28 09:10:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/05/28 09:10:00 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2010/05/26 09:12:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric\Desktop\The Children of Hurin by J R R Tolkien

========== Files - Modified Within 90 Days ==========

[2010/07/29 19:54:16 | 000,271,830 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010/07/29 19:53:46 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/29 19:53:32 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/29 19:53:28 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/29 19:53:26 | 000,001,374 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/29 19:53:08 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/29 19:51:18 | 006,815,744 | -H-- | M] () -- C:\Documents and Settings\Eric\NTUSER.DAT
[2010/07/29 19:42:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/29 08:15:12 | 062,714,598 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/29 06:51:16 | 000,000,768 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\StarCraft II.lnk
[2010/07/28 19:00:44 | 000,000,182 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/07/28 18:56:17 | 000,071,798 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\JavaRa.zip
[2010/07/28 11:44:08 | 000,000,169 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\moms number.rtf
[2010/07/28 10:40:14 | 003,208,182 | ---- | M] (Blizzard Entertainment) -- C:\Documents and Settings\Eric\Desktop\StarCraft_2_NA_en-US.exe
[2010/07/28 10:25:38 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/07/27 18:58:25 | 293,857,305 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\[HorribleSubs] Bleach - 281 [720p].mkv
[2010/07/27 11:37:20 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Eric\Desktop\OTL.exe
[2010/07/27 07:45:14 | 000,151,040 | ---- | M] () -- C:\Documents and Settings\Eric\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/27 00:19:40 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/07/27 00:19:35 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.msn
[2010/07/27 00:19:35 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/26 14:29:00 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/07/25 07:30:07 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/07/24 14:51:29 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\viddyli7.exe
[2010/07/24 14:46:33 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/23 12:00:48 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\dds.scr
[2010/07/23 10:48:03 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/07/23 06:24:40 | 000,000,175 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\infection.rtf
[2010/07/21 15:57:54 | 000,092,774 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\cc_20100721_155533.reg
[2010/07/21 15:43:46 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\CCleaner.lnk
[2010/07/21 15:42:43 | 003,396,176 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Eric\Desktop\ccsetup233.exe
[2010/07/20 22:30:32 | 000,000,150 | ---- | M] () -- C:\zrpt.xml
[2010/07/15 11:32:07 | 281,619,577 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\[HorribleSubs] Naruto Shippuuden - 168 [720p].mkv
[2010/07/14 08:48:25 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/07/09 20:12:32 | 000,000,495 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\Document.rtf
[2010/07/03 15:20:44 | 000,000,150 | ---- | M] () -- C:\Documents and Settings\Eric\default.pls
[2010/06/24 03:01:53 | 000,488,794 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/24 03:01:53 | 000,432,686 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/24 03:01:53 | 000,067,516 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/12 04:31:20 | 000,099,048 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/05/28 09:34:07 | 000,001,614 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play League of Legends.lnk
[2010/05/11 23:27:16 | 000,001,258 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\mirm list.rtf
[2010/05/08 01:38:14 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/05 12:40:17 | 005,104,796 | ---- | M] () -- C:\Documents and Settings\Eric\Desktop\13 rhapsody knigthrider of doom.mov

========== Files Created - No Company Name ==========

[2010/07/29 06:18:39 | 000,000,768 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\StarCraft II.lnk
[2010/07/28 18:56:16 | 000,071,798 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\JavaRa.zip
[2010/07/28 11:44:07 | 000,000,169 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\moms number.rtf
[2010/07/27 18:26:50 | 293,857,305 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\[HorribleSubs] Bleach - 281 [720p].mkv
[2010/07/26 14:29:00 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/07/26 14:28:56 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/07/25 07:30:07 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/07/24 14:51:29 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\viddyli7.exe
[2010/07/24 14:46:33 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/23 12:00:48 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\dds.scr
[2010/07/23 10:48:03 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/07/23 06:24:40 | 000,000,175 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\infection.rtf
[2010/07/21 15:55:38 | 000,092,774 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\cc_20100721_155533.reg
[2010/07/21 15:43:46 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\CCleaner.lnk
[2010/07/20 22:30:31 | 000,000,150 | ---- | C] () -- C:\zrpt.xml
[2010/07/20 22:22:25 | 000,012,082 | ---- | C] () -- C:\Documents and Settings\Eric\hs_err_pid1628.log
[2010/07/15 11:08:43 | 281,619,577 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\[HorribleSubs] Naruto Shippuuden - 168 [720p].mkv
[2010/06/30 07:52:13 | 000,000,495 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\Document.rtf
[2010/05/29 06:24:58 | 000,009,046 | ---- | C] () -- C:\WINDOWS\System32\nvinfo.pb
[2010/05/29 06:24:56 | 002,183,470 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010/05/28 09:34:07 | 000,001,614 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play League of Legends.lnk
[2010/05/11 10:35:59 | 000,001,258 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\mirm list.rtf
[2010/05/08 01:38:14 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/05 12:38:45 | 005,104,796 | ---- | C] () -- C:\Documents and Settings\Eric\Desktop\13 rhapsody knigthrider of doom.mov
[2009/11/06 11:58:04 | 000,178,975 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009/07/17 22:00:58 | 001,051,136 | ---- | C] () -- C:\WINDOWS\System32\drivers\CAMTHWDM.sys
[2009/06/11 00:30:53 | 000,000,182 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/02/04 15:32:31 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2009/01/03 20:21:33 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/05/02 21:16:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/01/01 04:48:28 | 000,138,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/01/01 04:48:08 | 000,000,319 | ---- | C] () -- C:\WINDOWS\game.ini

========== LOP Check ==========

[2009/09/18 10:15:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\acccore
[2009/06/11 00:30:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2008/12/06 01:21:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2010/06/01 09:12:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/07/26 23:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/01/21 10:24:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2009/06/10 15:04:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/07/20 22:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\909BEF17AD3452D3055F0A06B15325E0
[2009/09/18 10:16:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\acccore
[2010/01/13 17:10:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Bioshock
[2010/02/25 17:41:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Bioshock2
[2010/01/08 10:14:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Command & Conquer 3 Kane's Wrath
[2010/07/29 19:55:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\LimeWire
[2010/05/28 10:34:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\LolClient
[2009/07/17 22:05:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\ManyCam
[2010/01/06 20:25:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\New Folder
[2008/12/21 08:03:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Red Alert 3
[2009/06/13 14:40:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Screaming Bee
[2009/08/10 22:43:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\SecondLife
[2009/06/06 23:12:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\SpeedSim
[2010/05/29 05:36:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\SystemRequirementsLab
[2010/07/21 01:06:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\uTorrent
[2009/06/16 00:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Video DVD Maker FREE
[2009/07/17 22:01:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Webcammax
[2009/08/20 15:28:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric\Application Data\Wizards of the Coast
[2010/07/28 10:25:38 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========


< End of report >

 

OK i did all 3 scans, the TFC went fine and here are the other two reports.

Results of screen317's Security Check version 0.99.4
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Free 8.5
McAfee Security Scan
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 21
Out of date Java installed!
Adobe Flash Player 10.1.53.64
Adobe Reader 9.3.3
Mozilla Firefox (3.5.11) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe
Ad-Aware AAWTray.exe
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:
Unknown. This method cannot test your vulnerability to DNS cache poisoning.

``````````End of Log````````````









--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, August 1, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, August 01, 2010 00:31:19
Records in database: 4178720
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
G:\

Scan statistics:
Objects scanned: 124216
Threats found: 2
Infected objects found: 3
Suspicious objects found: 0
Scan duration: 09:52:19


File name / Threat / Threats count
C:\Documents and Settings\Eric\Desktop\New Music\Total Guitar - Offspring-Want You Bad - Complete track 2009.wma Infected: Trojan-Downloader.Multi.MusLdr.c 1
C:\Documents and Settings\Eric\Desktop\Other\mirc635.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1

Scanning stopped by the user.

 

Ran just fine here is the scan. *haven't seen any errors for a while now*

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\Eric\Desktop\New Music\Total Guitar - Offspring-Want You Bad - Complete track 2009.wma moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Eric
->Temp folder emptied: 107168108 bytes
->Temporary Internet Files folder emptied: 438994 bytes
->Java cache emptied: 128094 bytes
->FireFox cache emptied: 36150199 bytes
->Flash cache emptied: 1153 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 137.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: Eric
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 08012010_190702

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\Arj.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\avlib.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\Avp1.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\AvpMgr.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\CAB.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\dmap.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\dtreg.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\FsDrvPlg.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\FSSync.dll not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\HashCont.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\HashMD5.PPL not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\HCCMP.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\ichk2.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\iChkSA.ppl not found!
File\Folder C:\Documents and Settings\Eric\Local Settings\Temp\jkos-Eric\binaries\IWGen.ppl not found!

Registry entries deleted on Reboot...

 

Thank you all very much for all the help on fixing my computer up. ill be sure to avoid U torrent and lime wire and the such. I will give it some time but everything seems to be back to normal once again.

Again thanks for all your time and help with this.

*also whats the best free anti virus i could have at the moment? and if i where to buy one, whats the best to actually buy.?