Solved CashTitan - beware

ComboFix did not ask to reboot

Here is the log

ComboFix 10-08-18.04 - John 08/20/2010 13:54:22.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1331 [GMT 10:00]
Running from: e:\internet\downloads_new\ComboFix.exe
Command switches used :: e:\internet\downloads_new\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\system32\jpvxtgfukhcrdt.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\jpvxtgfukhcrdt.exe

.
((((((((((((((((((((((((( Files Created from 2010-07-20 to 2010-08-20 )))))))))))))))))))))))))))))))
.

2010-08-18 06:08 . 2010-08-18 06:08 -------- d-----w- c:\documents and settings\John\Application Data\Malwarebytes
2010-08-18 06:08 . 2010-04-29 05:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-18 06:08 . 2010-08-18 06:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-18 06:08 . 2010-08-18 06:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-18 06:08 . 2010-04-29 05:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-17 07:36 . 2010-07-12 08:55 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-08-17 06:47 . 2010-07-12 08:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-08-17 06:47 . 2010-08-17 06:47 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-08-17 06:46 . 2010-08-17 06:46 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Sunbelt Software
2010-08-17 06:45 . 2010-08-17 06:45 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-08-17 06:45 . 2010-07-12 08:56 2979280 -c--a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe
2010-08-17 06:08 . 2010-08-17 06:08 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Threat Expert
2010-08-16 11:52 . 2010-08-17 06:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-16 09:48 . 2004-05-11 00:56 423784 ----a-w- c:\windows\system32\XceedBkp.dll
2010-08-16 09:48 . 2003-11-19 04:59 512688 ----a-w- c:\windows\system32\XceedCry.dll
2010-08-16 09:48 . 2000-07-14 20:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2010-08-16 06:43 . 2010-08-16 06:43 -------- d-sh--w- c:\documents and settings\John\IECompatCache
2010-08-16 06:40 . 2010-08-16 06:40 -------- d-----w- c:\windows\system32\wbem\Repository
2010-08-16 06:15 . 2010-08-16 06:15 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Ashampoo
2010-08-15 04:41 . 2010-08-15 04:41 -------- d-----w- c:\program files\Microsoft Works
2010-08-15 04:41 . 2010-08-15 04:41 -------- d-----w- c:\program files\Microsoft.NET
2010-08-15 04:40 . 2010-08-15 04:40 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-08-15 04:39 . 2010-08-15 04:39 -------- d-----w- c:\windows\SHELLNEW
2010-08-15 04:39 . 2010-08-15 04:39 -------- d-----r- C:\MSOCache
2010-08-15 01:51 . 2010-08-15 01:51 87552 --sha-r- c:\windows\system32\comcat2.dll
2010-08-14 11:44 . 2006-10-26 09:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-08-14 11:44 . 2006-10-26 09:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-08-10 06:07 . 2010-08-10 06:07 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Microsoft Help
2010-08-10 06:07 . 2010-08-15 04:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-09 09:18 . 2010-08-09 09:18 12800 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3be5af51-n\decora-d3d.dll
2010-08-09 09:18 . 2010-08-09 09:18 61440 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3be5af51-n\decora-sse.dll
2010-08-09 09:18 . 2010-08-09 09:18 503808 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6e3699d8-n\msvcp71.dll
2010-08-09 09:18 . 2010-08-09 09:18 499712 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6e3699d8-n\jmc.dll
2010-08-09 09:18 . 2010-08-09 09:18 348160 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6e3699d8-n\msvcr71.dll
2010-08-05 08:45 . 2010-08-05 08:45 -------- d-----w- c:\program files\MSECache
2010-08-04 08:27 . 2010-08-04 08:27 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-08-04 08:27 . 2010-08-04 08:27 47360 ----a-w- c:\documents and settings\John\Application Data\pcouffin.sys
2010-08-04 08:27 . 2010-08-12 21:59 -------- d-----w- c:\documents and settings\John\Application Data\Vso
2010-08-04 08:27 . 2007-03-18 10:37 65602 ----a-w- c:\windows\system32\cook3260.dll
2010-08-04 08:27 . 2006-09-29 02:26 176165 ----a-w- c:\windows\system32\drv23260.dll
2010-08-04 08:27 . 2006-09-29 02:25 208935 ----a-w- c:\windows\system32\drv33260.dll
2010-08-04 08:27 . 2006-09-29 02:24 217127 ----a-w- c:\windows\system32\drv43260.dll
2010-08-04 08:27 . 2006-05-11 09:21 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2010-08-04 08:27 . 2002-12-09 16:20 102439 ----a-w- c:\windows\system32\sipr3260.dll
2010-08-04 08:27 . 2006-05-20 06:16 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2010-08-04 08:27 . 2010-08-04 08:27 -------- d-----w- c:\program files\VSO
2010-07-31 02:10 . 2010-07-31 06:21 -------- dc----w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2010-07-31 02:09 . 2010-08-16 09:09 -------- d-----w- c:\program files\Lavasoft
2010-07-31 02:09 . 2010-08-16 06:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-30 22:43 . 2010-07-30 22:43 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-07-28 07:32 . 2010-07-28 07:32 -------- dc----w- c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2010-07-24 12:01 . 2010-07-24 12:01 61440 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-16723bdb-n\decora-sse.dll
2010-07-24 08:10 . 2010-07-24 08:11 -------- d-s---w- c:\documents and settings\Pat\Local Settings\Application Data\Microsoft
2010-07-23 08:47 . 2006-12-14 00:00 110592 ----a-w- c:\documents and settings\John\Application Data\U3\temp\cleanup.exe
2010-07-23 08:47 . 2007-02-12 07:46 3096576 ---ha-w- c:\documents and settings\John\Application Data\U3\temp\Launchpad Removal.exe
2010-07-23 08:47 . 2010-08-17 12:23 -------- d-----w- c:\documents and settings\John\Application Data\U3
2010-07-21 06:04 . 2010-07-21 06:04 921440 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgemc.exe
2010-07-21 06:04 . 2010-07-21 06:04 1615200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
2010-07-21 06:04 . 2010-07-21 06:04 1107296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
2010-07-21 06:04 . 2010-07-21 06:04 4368224 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-19 23:10 . 2010-02-27 11:33 17488 ----a-w- c:\windows\gdrv.sys
2010-08-19 22:20 . 2010-07-06 02:04 -------- d-----w- c:\program files\SpeedFan
2010-08-18 06:32 . 2010-02-28 05:36 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-08-16 20:42 . 2010-03-02 10:45 -------- d-----w- c:\documents and settings\John\Application Data\uTorrent
2010-08-16 10:10 . 2010-03-04 05:47 848 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-08-16 10:10 . 2010-03-04 05:47 848 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-08-16 06:39 . 2010-03-22 09:49 -------- d-----w- c:\program files\Ashampoo
2010-08-15 04:48 . 2010-02-27 11:45 57080 ----a-w- c:\documents and settings\John\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-15 04:41 . 2010-02-28 19:57 -------- d-----w- c:\program files\MSBuild
2010-08-14 22:49 . 2010-04-26 02:18 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-27 07:28 . 2010-03-01 08:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Ulead Systems
2010-07-24 12:01 . 2010-07-24 12:01 503808 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-23526d38-n\msvcp71.dll
2010-07-24 12:01 . 2010-07-24 12:01 499712 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-23526d38-n\jmc.dll
2010-07-24 12:01 . 2010-07-24 12:01 348160 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-23526d38-n\msvcr71.dll
2010-07-24 12:01 . 2010-07-24 12:01 12800 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-16723bdb-n\decora-d3d.dll
2010-07-24 08:11 . 2010-07-24 08:11 -------- d-----w- c:\documents and settings\Pat\Application Data\Ulead Systems
2010-07-17 08:47 . 2010-07-17 08:47 503808 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-12417a63-n\msvcp71.dll
2010-07-17 08:47 . 2010-07-17 08:47 499712 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-12417a63-n\jmc.dll
2010-07-17 08:47 . 2010-07-17 08:47 348160 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-12417a63-n\msvcr71.dll
2010-07-17 08:47 . 2010-07-17 08:47 61440 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-46028758-n\decora-sse.dll
2010-07-17 08:47 . 2010-07-17 08:47 12800 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-46028758-n\decora-d3d.dll
2010-07-15 23:00 . 2010-02-28 05:38 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 23:00 . 2010-07-15 23:00 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-15 22:59 . 2010-02-28 05:38 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-09 01:12 . 2010-07-09 01:12 -------- d-----w- c:\program files\FLV Player
2010-06-30 12:31 . 2008-04-14 08:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-30 11:02 . 2010-06-30 11:02 -------- d-----w- c:\program files\FS Design Tools
2010-06-24 12:22 . 2008-04-23 00:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2008-04-14 08:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-22 07:59 . 2010-06-22 07:59 -------- d-----w- c:\documents and settings\John\Application Data\Nero
2010-06-22 07:54 . 2010-06-22 07:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-06-22 07:54 . 2010-04-12 11:01 -------- d-----w- c:\program files\Common Files\Nero
2010-06-21 15:27 . 2008-04-14 08:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2008-04-14 08:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2010-02-27 11:17 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2008-04-14 08:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-03 06:14 . 2010-02-28 05:38 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-24 02:18 . 2010-05-24 02:18 503808 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-328723bd-n\msvcp71.dll
2010-05-24 02:18 . 2010-05-24 02:18 499712 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-328723bd-n\jmc.dll
2010-05-24 02:18 . 2010-05-24 02:18 348160 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-328723bd-n\msvcr71.dll
2010-05-24 02:18 . 2010-05-24 02:18 61440 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5d49d2aa-n\decora-sse.dll
2010-05-24 02:18 . 2010-05-24 02:18 12800 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5d49d2aa-n\decora-d3d.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\windows\system32\comcat2.dll ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 87552
Created time: 2010-08-15 01:51
Modified time: 2010-08-15 01:51
MD5: !HASH: COULD NOT OPEN FILE !!!!!
SHA1: !HASH: COULD NOT OPEN FILE !!!!!


------- Sigcheck -------

[-] 2008-07-12 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C} "= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-04-19 00:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829} "= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829} "= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL "= "RTHDCPL.EXE" [2009-01-13 18084864]
"AVG9_TRAY "= "c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-06-17 40368]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Corel File Shell Monitor "= "c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-08-08 16712]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-04-14 155648]
"UVS10 Preload "= "c:\program files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe" [2006-03-06 36864]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HP Lamp "= "c:\program files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe" [1998-11-23 42496]
"NeroFilterCheck "= "c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2 "= "shell32" [X]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-12-6 576104]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8} "= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2005-08-09 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 23:00 12536 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe "=
"c:\\Program Files\\uTorrent\\utorrent.exe "=
"c:\\WINDOWS\\system32\\dpvsetup.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/17/2010 4:47 PM 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/28/2010 3:38 PM 216400]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/28/2010 3:38 PM 243024]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/16/2010 8:59 AM 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/16/2010 9:00 AM 308136]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [2/27/2010 9:26 PM 68136]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 6:55 PM 1355416]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/17/2010 4:47 PM 15008]
.
Contents of the 'Scheduled Tasks' folder

2010-08-17 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 06:47]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\John\Application Data\Mozilla\Firefox\Profiles\w70g2neu.default\
FF - prefs.js: browser.startup.homepage - file:///E:/Graphics/mypage.htm
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.buffer.cache.count ", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.buffer.cache.size ", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-jpvxtgfukhcrdt - c:\windows\system32\jpvxtgfukhcrdt.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-20 13:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-08-20 13:57:05
ComboFix-quarantined-files.txt 2010-08-20 03:57
ComboFix2.txt 2010-08-19 23:16

Pre-Run: 89,983,332,352 bytes free
Post-Run: 89,965,355,008 bytes free

- - End Of File - - EC76E65241107B1C12B4DF13CEF10000

 

I don't have a COMCAT2.dll file in C:\WINDOWS\SYSTEM32
I only have a COMCAT.dll


Is there much more to do? I thank you very much for your efforts so far but it just seems to me that it would have been easier and quicker to reformat and reinstall.

Are there many more steps to go?

 

OTL.txt (EXTRAS.txt in next message as total is too long in one message)

OTL logfile created on: 8/20/2010 6:22:40 PM - Run 2
OTL by OldTimer - Version 3.2.10.0 Folder = E:\INTERNET\downloads_new
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 70.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97.65 Gb Total Space | 84.22 Gb Free Space | 86.24% Space Free | Partition Type: NTFS
Drive D: | 97.65 Gb Total Space | 20.77 Gb Free Space | 21.27% Space Free | Partition Type: NTFS
Drive E: | 136.71 Gb Total Space | 66.72 Gb Free Space | 48.80% Space Free | Partition Type: NTFS
Drive F: | 97.65 Gb Total Space | 95.40 Gb Free Space | 97.70% Space Free | Partition Type: NTFS
Drive G: | 36.08 Gb Total Space | 18.68 Gb Free Space | 51.77% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
Drive I: | 7.45 Gb Total Space | 2.88 Gb Free Space | 38.69% Space Free | Partition Type: FAT32
Drive J: | 1.78 Gb Total Space | 1.77 Gb Free Space | 99.55% Space Free | Partition Type: FAT32

Computer Name: HOME-B267D683C7
Current User Name: John
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/08/20 18:18:44 | 000,575,488 | ---- | M] (OldTimer Tools) -- E:\INTERNET\downloads_new\OTL.exe
PRC - [2010/07/21 16:03:43 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/07/16 09:00:21 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/07/16 09:00:17 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/07/16 09:00:17 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/16 09:00:16 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/16 08:59:53 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/07/16 08:59:52 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2009/02/06 20:44:34 | 000,068,136 | ---- | M] () -- C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
PRC - [2008/08/08 16:30:44 | 000,016,712 | R--- | M] () -- C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
PRC - [2008/04/14 18:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/12/06 13:39:12 | 000,576,104 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2007/07/24 10:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
PRC - [2006/10/03 11:15:44 | 002,658,304 | ---- | M] (QUALCOMM Incorporated) -- C:\Program Files\Qualcomm\Eudora\Eudora.exe
PRC - [2005/01/31 09:45:20 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [1998/11/24 02:00:00 | 000,042,496 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe


========== Modules (SafeList) ==========

MOD - [2010/08/20 18:18:44 | 000,575,488 | ---- | M] (OldTimer Tools) -- E:\INTERNET\downloads_new\OTL.exe
MOD - [2008/04/14 18:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2007/12/06 10:54:44 | 000,073,728 | ---- | M] (Broadcom Corporation.) -- C:\WINDOWS\system32\BtMmHook.dll
MOD - [2007/12/06 10:52:44 | 000,040,960 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/08/17 16:47:21 | 001,355,416 | ---- | M] (Lavasoft) [Auto | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010/07/21 16:03:43 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/16 09:00:16 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2009/02/06 20:44:34 | 000,068,136 | ---- | M] () [Auto | Running] -- C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe -- (GEST Service)
SRV - [2007/07/24 10:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2005/01/31 09:45:20 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\John\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/08/20 18:17:07 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2010/08/17 16:47:36 | 000,015,008 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2010/07/16 09:00:18 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/16 08:59:53 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/07/12 18:55:39 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2010/06/03 16:14:03 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2009/02/04 17:27:20 | 003,488,768 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2009/01/20 20:53:06 | 005,027,840 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/11/01 04:52:16 | 000,093,184 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2008/10/30 23:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/04/14 18:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/11/27 15:40:40 | 000,539,512 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2007/11/27 15:40:38 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2007/11/21 10:51:30 | 000,879,624 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2007/06/29 11:38:30 | 000,156,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2007/03/31 12:02:40 | 000,055,352 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)
DRV - [2007/03/23 09:50:08 | 000,037,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2006/09/24 23:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)
DRV - [1996/04/04 05:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7A 02 87 64 5A F3 CA 01 [binary data]
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "file:///E:/Graphics/mypage.htm "
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/08 10:26:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/15 14:41:30 | 000,000,000 | ---D | M]

[2010/03/01 15:20:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Mozilla\Extensions
[2010/08/19 16:15:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\w70g2neu.default\extensions
[2010/07/22 21:01:49 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\w70g2neu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/19 16:15:30 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/16 21:56:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/16 21:56:45 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/08/20 13:56:15 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe ()
O4 - HKLM..\Run: [HP Lamp] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe (Ulead Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 211.29.152.116 198.142.0.51
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files\Qualcomm\Eudora\EuShlExt.dll (Qualcomm Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/27 21:18:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\VIO\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.mpegacm - C:\Program Files\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.ulmp3acm - C:\Program Files\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/08/20 09:11:51 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/08/20 08:59:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/08/18 16:08:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\Application Data\Malwarebytes
[2010/08/18 16:08:10 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/08/18 16:08:09 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/08/18 16:08:09 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/18 16:08:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/08/17 16:47:42 | 000,064,288 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2010/08/17 16:47:41 | 000,095,024 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/08/17 16:46:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\Local Settings\Application Data\Sunbelt Software
[2010/08/17 16:45:44 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
[2010/08/17 16:08:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\Local Settings\Application Data\Threat Expert
[2010/08/16 21:52:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/08/16 19:48:11 | 001,435,272 | ---- | C] (Macromedia, Inc.) -- C:\WINDOWS\System32\Flash.ocx
[2010/08/16 19:48:11 | 000,512,688 | ---- | C] (Xceed Software Inc (450) 442-2626 support@xceedsoft.com www.xceedsoft.com) -- C:\WINDOWS\System32\XceedCry.dll
[2010/08/16 19:48:11 | 000,423,784 | ---- | C] (Xceed Software Inc (450) 442-2626 support@xceedsoft.com www.xceedsoft.com) -- C:\WINDOWS\System32\XceedBkp.dll
[2010/08/16 19:48:11 | 000,188,416 | ---- | C] (SoftShape Development) -- C:\WINDOWS\System32\actsplash.ocx
[2010/08/16 19:48:11 | 000,089,088 | ---- | C] (Ariad Software) -- C:\WINDOWS\System32\ProgressBar4.ocx
[2010/08/16 16:43:48 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\John\IECompatCache
[2010/08/16 16:15:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\Local Settings\Application Data\Ashampoo
[2010/08/15 14:41:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Works
[2010/08/15 14:41:19 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2010/08/15 14:41:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2010/08/15 14:41:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2010/08/15 14:40:12 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 8
[2010/08/15 14:39:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\SHELLNEW
[2010/08/15 14:39:00 | 000,000,000 | R--D | C] -- C:\MSOCache
[2010/08/13 17:34:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\My Documents\OVERSEAS TRIP 2011
[2010/08/10 16:07:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\Local Settings\Application Data\Microsoft Help
[2010/08/10 16:07:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2010/08/05 18:45:39 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2010/08/04 18:28:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\My Documents\ConvertXtoDVD
[2010/08/04 18:27:21 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\John\Application Data\pcouffin.sys
[2010/08/04 18:27:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\Application Data\Vso
[2010/08/04 18:27:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\My Documents\PcSetup
[2010/08/04 18:27:17 | 000,626,688 | ---- | C] (On2.com) -- C:\WINDOWS\System32\vp7vfw.dll
[2010/08/04 18:27:15 | 000,000,000 | ---D | C] -- C:\Program Files\VSO
[2010/07/31 12:10:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
[2010/07/31 12:09:59 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2010/07/31 12:09:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2010/07/28 17:32:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2010/07/23 18:47:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\Application Data\U3
[2010/07/16 09:00:17 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/07/09 11:12:27 | 000,000,000 | ---D | C] -- C:\Program Files\FLV Player
[2010/07/06 12:04:31 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedFan
[2010/06/30 21:02:52 | 000,000,000 | ---D | C] -- C:\Program Files\FS Design Tools
[2010/06/22 17:59:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John\Application Data\Nero
[2010/06/22 17:54:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Nero
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/08/20 18:17:15 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/08/20 18:16:57 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/08/20 18:16:56 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/08/20 18:16:55 | 000,121,808 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010/08/20 18:16:00 | 006,590,464 | ---- | M] () -- C:\Documents and Settings\John\ntuser.dat
[2010/08/20 18:16:00 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\John\ntuser.ini
[2010/08/20 13:56:20 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/08/20 13:56:15 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/08/20 13:52:48 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/08/20 12:06:25 | 000,109,056 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/20 12:03:31 | 000,023,040 | ---- | M] () -- C:\Documents and Settings\John\My Documents\HOOKER2010 20 AUG.doc
[2010/08/20 09:11:54 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/08/20 08:54:33 | 063,629,394 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/08/19 18:52:58 | 000,124,928 | ---- | M] () -- C:\Documents and Settings\John\My Documents\TAX_2010.xls
[2010/08/19 17:19:14 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2010/08/18 16:08:12 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/17 16:48:57 | 000,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/08/17 16:47:40 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/08/17 16:45:43 | 000,000,885 | ---- | M] () -- C:\Documents and Settings\John\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/08/17 16:45:43 | 000,000,867 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/08/16 20:10:11 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[2010/08/16 20:10:06 | 000,000,848 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2010/08/16 06:42:20 | 000,215,264 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/15 14:48:44 | 000,057,080 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/08/15 11:51:12 | 000,087,552 | RHS- | M] () -- C:\WINDOWS\System32\comcat2.dll
[2010/08/15 09:02:04 | 000,000,671 | ---- | M] () -- C:\Documents and Settings\John\Application Data\vso_ts_preview.xml
[2010/08/15 08:49:41 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/08/12 17:05:40 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/08/12 17:05:17 | 000,488,794 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/12 17:05:17 | 000,432,686 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/08/12 17:05:17 | 000,067,516 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/08/06 22:22:36 | 000,031,560 | ---- | M] () -- C:\Documents and Settings\John\Application Data\GDIPFONTCACHEV1.DAT
[2010/08/04 18:27:21 | 000,047,360 | ---- | M] (VSO Software) -- C:\Documents and Settings\John\Application Data\pcouffin.sys
[2010/08/04 18:27:21 | 000,007,887 | ---- | M] () -- C:\Documents and Settings\John\Application Data\pcouffin.cat
[2010/08/04 18:27:21 | 000,001,144 | ---- | M] () -- C:\Documents and Settings\John\Application Data\pcouffin.inf
[2010/08/04 18:27:20 | 000,000,827 | ---- | M] () -- C:\Documents and Settings\John\Desktop\ConvertXtoDvd 3.lnk
[2010/08/01 16:37:10 | 000,000,000 | ---- | M] () -- C:\WINDOWS\iplayer.INI
[2010/07/27 19:13:05 | 000,051,712 | ---- | M] () -- C:\Documents and Settings\John\My Documents\BILLS ACCOUNT.xls
[2010/07/24 08:46:46 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\John\My Documents\GENERAL ASSISTANT DUTIES.doc
[2010/07/23 11:45:33 | 000,156,748 | ---- | M] () -- C:\Documents and Settings\John\My Documents\PLUM MER.jpg
[2010/07/19 21:47:46 | 000,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI
[2010/07/18 17:55:41 | 000,035,840 | ---- | M] () -- C:\Documents and Settings\John\My Documents\PLUM Balance by investment options.doc
[2010/07/18 17:38:05 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\John\My Documents\APPLICATION FOR LEAVE - SURVEYORS.doc
[2010/07/18 17:37:07 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\John\My Documents\APPLICATION FOR LEAVE - RINGROSE.doc
[2010/07/17 09:03:58 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\John\My Documents\request for hilton invoice.doc
[2010/07/16 09:00:18 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/07/16 09:00:17 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/07/16 08:59:53 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/07/15 15:41:58 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\John\My Documents\WEEKLY AMOUNTS ALLOWED.doc
[2010/07/12 18:55:39 | 000,064,288 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2010/07/12 18:55:38 | 000,015,880 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe
[2010/07/09 11:12:28 | 000,000,701 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FLV Player.lnk
[2010/07/06 12:04:31 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\John\Desktop\SpeedFan.lnk
[2010/07/06 12:04:31 | 000,000,045 | ---- | M] () -- C:\WINDOWS\System32\initdebug.nfo
[2010/07/04 17:46:51 | 000,023,040 | ---- | M] () -- C:\Documents and Settings\John\My Documents\IDEAS FOR DAD.doc
[2010/07/03 21:45:41 | 000,049,664 | ---- | M] () -- C:\Documents and Settings\John\My Documents\zz RETIREMENT INFORMATION.xls
[2010/06/05 11:15:37 | 000,059,904 | ---- | M] () -- C:\Documents and Settings\John\My Documents\cats.doc
[2010/06/03 16:14:03 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/05/31 19:20:04 | 000,037,376 | ---- | M] () -- C:\Documents and Settings\John\My Documents\INVESTMENTS.xls
[2010/05/23 22:05:38 | 000,001,755 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/20 11:54:40 | 000,023,040 | ---- | C] () -- C:\Documents and Settings\John\My Documents\HOOKER2010 20 AUG.doc
[2010/08/20 09:11:54 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/08/20 09:11:52 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/08/18 16:08:12 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/17 17:36:09 | 000,015,880 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2010/08/17 16:45:43 | 000,000,885 | ---- | C] () -- C:\Documents and Settings\John\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/08/17 16:45:43 | 000,000,867 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/08/16 20:10:11 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2010/08/16 20:10:11 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2010/08/16 19:48:11 | 000,389,120 | ---- | C] () -- C:\WINDOWS\System32\ACTSKN43.OCX
[2010/08/16 19:48:11 | 000,011,012 | ---- | C] () -- C:\WINDOWS\System32\threadapi.tlb
[2010/08/15 17:21:42 | 006,590,464 | ---- | C] () -- C:\Documents and Settings\John\ntuser.dat
[2010/08/15 11:51:12 | 000,087,552 | RHS- | C] () -- C:\WINDOWS\System32\comcat2.dll
[2010/08/04 18:27:35 | 000,000,671 | ---- | C] () -- C:\Documents and Settings\John\Application Data\vso_ts_preview.xml
[2010/08/04 18:27:23 | 000,000,034 | ---- | C] () -- C:\Documents and Settings\John\Application Data\pcouffin.log
[2010/08/04 18:27:21 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\John\Application Data\pcouffin.cat
[2010/08/04 18:27:21 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\John\Application Data\pcouffin.inf
[2010/08/04 18:27:20 | 000,000,827 | ---- | C] () -- C:\Documents and Settings\John\Desktop\ConvertXtoDvd 3.lnk
[2010/08/01 16:37:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iplayer.INI
[2010/07/31 12:10:30 | 000,000,458 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/07/23 11:45:33 | 000,156,748 | ---- | C] () -- C:\Documents and Settings\John\My Documents\PLUM MER.jpg
[2010/07/20 22:17:00 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\John\My Documents\GENERAL ASSISTANT DUTIES.doc
[2010/07/19 21:47:43 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2010/07/18 17:55:40 | 000,035,840 | ---- | C] () -- C:\Documents and Settings\John\My Documents\PLUM Balance by investment options.doc
[2010/07/17 09:03:22 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\John\My Documents\request for hilton invoice.doc
[2010/07/15 15:41:58 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\John\My Documents\WEEKLY AMOUNTS ALLOWED.doc
[2010/07/09 11:12:28 | 000,000,701 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\FLV Player.lnk
[2010/07/06 12:04:31 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\John\Desktop\SpeedFan.lnk
[2010/07/06 12:04:30 | 000,000,045 | ---- | C] () -- C:\WINDOWS\System32\initdebug.nfo
[2010/07/04 20:05:34 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\John\My Documents\APPLICATION FOR LEAVE - RINGROSE.doc
[2010/07/04 20:03:13 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\John\My Documents\APPLICATION FOR LEAVE - SURVEYORS.doc
[2010/06/24 17:01:31 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010/06/05 11:15:37 | 000,059,904 | ---- | C] () -- C:\Documents and Settings\John\My Documents\cats.doc
[2010/05/23 22:05:38 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2010/05/22 19:09:20 | 000,049,664 | ---- | C] () -- C:\Documents and Settings\John\My Documents\zz RETIREMENT INFORMATION.xls
[2010/05/14 07:58:09 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\rmc_rtspdl.dll
[2010/04/23 19:05:42 | 000,000,928 | ---- | C] () -- C:\WINDOWS\System32\hpsj1695.dll
[2010/04/23 19:05:40 | 000,306,688 | ---- | C] () -- C:\WINDOWS\System32\Lffpx7.dll
[2010/04/23 19:05:40 | 000,095,232 | ---- | C] () -- C:\WINDOWS\System32\Lfkodak.dll
[2010/03/17 13:29:08 | 000,012,422 | -HS- | C] () -- C:\Documents and Settings\John\Local Settings\Application Data\NXhT2mK
[2010/03/17 13:29:08 | 000,012,422 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\NXhT2mK
[2010/03/04 15:47:24 | 000,000,848 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2010/03/03 15:51:44 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2010/03/02 15:40:35 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS61.DLL
[2010/03/02 15:15:52 | 000,109,056 | ---- | C] () -- C:\Documents and Settings\John\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/01 19:10:12 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/12/06 10:55:12 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2007/05/03 04:04:19 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007/05/02 12:33:57 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2005/02/17 11:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 11:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001/11/14 12:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1996/04/04 05:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2010/03/02 15:41:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/08/18 16:32:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/03/04 08:12:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GARMIN
[2010/04/15 21:34:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2010/08/17 16:29:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/07/27 17:28:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2010/07/31 16:21:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
[2010/07/28 17:32:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2010/08/17 16:45:45 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
[2010/03/22 19:50:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Ashampoo
[2010/04/12 16:09:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\CD-LabelPrint
[2010/05/21 08:25:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\GARMIN
[2010/05/06 21:09:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Softplicity
[2010/04/16 08:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Ulead Systems
[2010/08/17 06:42:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\uTorrent
[2010/08/13 07:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Vso
[2010/08/17 16:48:57 | 000,000,458 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/08/20 18:16:53 | 000,004,006 | ---- | M] () -- C:\aaw7boot.log
[2010/08/19 17:19:14 | 000,036,336 | ---- | M] () -- C:\ashampoo-acdw-log.txt
[2010/02/27 21:18:59 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/02/27 21:14:26 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/08/20 09:11:54 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2010/08/20 13:57:06 | 000,022,626 | ---- | M] () -- C:\ComboFix.txt
[2010/02/27 21:18:59 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/02/27 21:31:48 | 000,000,010 | ---- | M] () -- C:\csb.log
[2010/02/27 21:31:24 | 000,000,197 | ---- | M] () -- C:\Install.log
[2010/02/27 21:18:59 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/02/27 21:18:59 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 18:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 18:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/08/20 18:16:53 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2010/02/27 21:29:22 | 000,001,519 | ---- | M] () -- C:\RHDSetup.log
[2010/08/18 16:05:31 | 000,000,317 | ---- | M] () -- C:\rkill.log
[2010/08/20 18:23:09 | 000,003,406 | ---- | M] () -- C:\service.log
[2010/07/17 13:54:57 | 000,000,481 | ---- | M] () -- C:\stub.log

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2004/06/15 15:00:00 | 000,017,920 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD61.DLL
[2004/06/15 15:00:00 | 000,054,272 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP61.DLL
[2008/07/06 22:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >


< %systemroot%\system32\*.dll /lockedfiles >
[2010/08/15 11:51:12 | 000,087,552 | RHS- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\comcat2.dll
[2009/03/08 03:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 03:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010/02/28 08:06:54 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010/02/28 08:06:54 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010/02/28 08:06:54 | 000,913,408 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 18:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 18:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 18:00:00 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMPFC5A2B2
< End of report >

 

EXTRAS.txt

OTL Extras logfile created on: 8/20/2010 6:20:24 PM - Run 1
OTL by OldTimer - Version 3.2.10.0 Folder = E:\INTERNET\downloads_new
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 71.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97.65 Gb Total Space | 84.22 Gb Free Space | 86.24% Space Free | Partition Type: NTFS
Drive D: | 97.65 Gb Total Space | 20.77 Gb Free Space | 21.27% Space Free | Partition Type: NTFS
Drive E: | 136.71 Gb Total Space | 66.72 Gb Free Space | 48.80% Space Free | Partition Type: NTFS
Drive F: | 97.65 Gb Total Space | 95.40 Gb Free Space | 97.70% Space Free | Partition Type: NTFS
Drive G: | 36.08 Gb Total Space | 18.68 Gb Free Space | 51.77% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
Drive I: | 7.45 Gb Total Space | 2.88 Gb Free Space | 38.69% Space Free | Partition Type: FAT32
Drive J: | 1.78 Gb Total Space | 1.77 Gb Free Space | 99.55% Space Free | Partition Type: FAT32

Computer Name: HOME-B267D683C7
Current User Name: John
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabledxpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\uTorrent\utorrent.exe" = C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{10B5900B-1217-458E-B3DA-E0A2E4A01033}" = Nero 8 Essentials
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{31E1050B-F69F-4A16-8F5A-E44D31901250}" = Ulead DVD DiskRecorder 2.1.1
"{328019A7-0012-401D-96A2-4CDDD02675A8}" = Garmin POI Loader
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{364AF5E6-8CAD-4A35-86AF-8AC11E3E55D2}" = Garmin City Navigator Australia 2008
"{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}" = QuickTime
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{58FA5D40-E35A-47ED-8AFA-68CCC758559E}" = Garmin MapSource
"{64E72FB1-2343-4977-B4A8-262CD53D0BD3}" = Corel Paint Shop Pro Photo X2
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{7078B4DE-B9C5-45D2-845C-F67F9BD8065D}" = Garmin Mobile PC
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD 3.3.4.106e
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7ED169D4-5053-4166-93DF-53B12AE6C539}" = Energy Saver Advance B9.0316.1
"{7F6AE002-7F7E-494E-B918-853731ACF4D1}" = Eudora
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{88F92798-59AB-474F-B40D-1EC5F782F7EE}" = Ulead VideoStudio 9.0
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C6E44C01-0DF8-465D-A6C0-F8B1159CBBB1}" = Garmin Communicator Plugin
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CC016F21-3970-11DE-B878-005056806466}" = Google Earth
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E188D820-1218-4E28-8BCA-91134C3664C2}" = Ulead VideoStudio 10
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{EEC8205A-E3DE-4C00-B60C-48E3B9B58B13}" = Garmin City Navigator Europe NT 2008
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"Arachnophilia version 4.0_is1" = Arachnophilia version 4.0
"Ashampoo Burning Studio 9_is1" = Ashampoo Burning Studio 9.03
"ATI Display Driver" = ATI Display Driver
"Audacity_is1" = Audacity 1.2.6
"AVG9Uninstall" = AVG Free 9.0
"CANONBJ_Deinstall_CNMCP61.DLL" = Canon PIXMA iP3000
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FLV Player" = FLV Player 2.0 (build 25)
"HP PrecisionScan" = HP PrecisionScan
"ie8" = Windows Internet Explorer 8
"InstallShield_{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}" = QuickTime
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"SpeedFan" = SpeedFan (remove only)
"uTorrent" = µTorrent
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/30/2010 4:07:52 AM | Computer Name = HOME-B267D683C7 | Source = Application Error | ID = 1000
Description = Faulting application vstudio.exe, version 9.0.0.0, faulting module
uvipp.dll, version 8.0.0.0, fault address 0x00142a96.

Error - 4/30/2010 6:06:27 AM | Computer Name = HOME-B267D683C7 | Source = Application Error | ID = 1000
Description = Faulting application vstudio.exe, version 9.0.0.0, faulting module
uvipp.dll, version 8.0.0.0, fault address 0x00142a96.

Error - 5/1/2010 2:26:23 AM | Computer Name = HOME-B267D683C7 | Source = Application Hang | ID = 1002
Description = Hanging application vstudio.exe, version 9.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/4/2010 7:27:04 AM | Computer Name = HOME-B267D683C7 | Source = Application Hang | ID = 1002
Description = Hanging application vstudio.exe, version 9.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/8/2010 1:27:06 AM | Computer Name = HOME-B267D683C7 | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/19/2010 7:40:04 AM | Computer Name = HOME-B267D683C7 | Source = Application Error | ID = 1000
Description = Faulting application rundii32.exe, version 0.0.0.0, faulting module
ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

Error - 5/20/2010 9:11:42 PM | Computer Name = HOME-B267D683C7 | Source = Application Error | ID = 1000
Description = Faulting application quicktimeplayer.exe, version 7.0.3.50, faulting
module quicktimeh264.qtx, version 7.0.3.50, fault address 0x00012ec0.

Error - 5/20/2010 9:11:52 PM | Computer Name = HOME-B267D683C7 | Source = Application Error | ID = 1000
Description = Faulting application quicktimeplayer.exe, version 7.0.3.50, faulting
module quicktimeh264.qtx, version 7.0.3.50, fault address 0x00012ec0.

Error - 6/7/2010 8:15:54 AM | Computer Name = HOME-B267D683C7 | Source = Application Error | ID = 1000
Description = Faulting application eudora.exe, version 7.1.0.9, faulting module
unknown, version 0.0.0.0, fault address 0x635028aa.

Error - 6/7/2010 8:15:58 AM | Computer Name = HOME-B267D683C7 | Source = Application Error | ID = 1000
Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

[ System Events ]
Error - 8/19/2010 5:47:51 PM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7000
Description = The ASPI32 service failed to start due to the following error: %%2

Error - 8/19/2010 7:00:49 PM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7000
Description = The ASPI32 service failed to start due to the following error: %%2

Error - 8/19/2010 7:06:52 PM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7000
Description = The ASPI32 service failed to start due to the following error: %%2

Error - 8/19/2010 7:06:52 PM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 8/19/2010 7:10:11 PM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7000
Description = The ASPI32 service failed to start due to the following error: %%2

Error - 8/19/2010 7:10:11 PM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 8/20/2010 4:07:58 AM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7000
Description = The ASPI32 service failed to start due to the following error: %%2

Error - 8/20/2010 4:07:58 AM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 8/20/2010 4:17:08 AM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7000
Description = The ASPI32 service failed to start due to the following error: %%2

Error - 8/20/2010 4:17:08 AM | Computer Name = HOME-B267D683C7 | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126


< End of report >

 

Wow the Kaspersky scan is complete at last (after running for 3.5+ hours).

I cannot find CHECKUP.TXT (from SECURITYCHECK). I thought that I saved it but after a SEARCH of my entire system it cannot be found - I guess I am so tired from this very taxing process (do you blame me?).

The report produced by Kaspersky was EMPTY (no treats found).

 

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Free 9.0
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
Java(TM) 6 Update 21
Adobe Flash Player 10.0.45.2
Adobe Reader 8.2.3
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.8)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

 

Thanks Broni

Thanks for all the time you have given.

In restrospect though I now think that I would have chosen to reformat and reinstall everything. I don't have a huge amount of applications installed and think that I could have perhaps reformatted and reinstalled everything TWICE in the time it has taken me to do all that you have advised.

I think that I picked up my malware from a website even though I have some plugins installed which warned me against entering some websites.

A few months earlier I seemed to have picked up a 'bug' when attempting to play a video file either downloaded or given to me by someone as I can remember Windows Media Player displaying ACQUIRING CODEC and never either 'acquired' and downloaded it or advised that it could not be found - I ended up aborting. A short time later I was aware that I had picked up some malware - can this happen in this way?
I got out of that problem by RESTORING WINDOWS to a day prior to when I tried to play the video file.

THIS TIME however when I attempted to do the same I found that I had NO previous restore points - I guess the malware had erased them.

IS IT POSSIBLE to backup restore points and use them later should they 'disappear'?

ALSO please advise and BACKUP utilities which I could use to backup my entire system whcih I could use to RESTORE my system after a REFORMAT should I get 'infected' again. I know of GHOST but I was wondering if there is a freeware application to do similar.

I WILL attempt to run Malware bytes and TFC regularly.

LASTLY my PC now appears to have an extra 'hardware profile' (as my system boots up I briefly see a page displayed which appears to be one which invites the selection of the required profile (I think that one of the selections (the default) is Windows XP). The profile is NOT listed in SYSTEM>HARDWARE>HARDWARE PROFILES.
Please advise what it could be and how do I get rid of it.


Thanks again.

 

Sorry but never did I receive ANY information to indicate how much was ahead of me.
Every time I received a reply I thought that this was the finish only to receive another post with more downloads/procedures.
Not sure if you knew exactly what was necessary to complete the 'clean' until after each 'log' was posted but if you did then perhaps in future you could forewarn that the 'clean' process would take 'x' steps and approximately 'y' hours to complete and then leave it up to the user to decide if they wanted to proceed.

Don't get me wrong I am VERY appreciative of YOUR time but in restrospect if I had been forewarned I probably would have saved YOU time as well as myself (and performed a reformat/re-install).

I guess though that I have been made aware (by yourself) of some useful applications.

Maybe I misled you regarding this. What I meant was that once I detemned that I had become infected (BEFORE I contacted Windows BBS) I decided to try and RESTORE but there were NO restore points (and I had NOT removed them).
I realise that 'we just reset them'.

Please advise HOW then I utilise the recovery console option and under what circumstances - or point me to a web site explaining it all.

Thanks again for your never ending assistance

 

Yes

I now do have a few restore points

I looked to close this post but could not find anything